Wednesday, 2018-03-14

*** germs has quit IRC00:15
*** germs has joined #openstack-keystone00:17
*** gyee has quit IRC00:20
*** germs has quit IRC00:32
*** germs has joined #openstack-keystone00:42
*** germs has quit IRC00:42
*** germs has joined #openstack-keystone00:42
*** Dinesh_Bhor has joined #openstack-keystone00:47
*** germs has quit IRC00:48
*** germs has joined #openstack-keystone00:49
*** Dinesh_Bhor has quit IRC00:51
*** germs has quit IRC00:53
*** odyssey4me has quit IRC00:53
*** odyssey4me has joined #openstack-keystone00:53
*** Dinesh_Bhor has joined #openstack-keystone00:54
*** Dinesh__Bhor has joined #openstack-keystone00:59
*** Dinesh__Bhor has quit IRC00:59
*** Dinesh_Bhor has quit IRC01:00
*** r-daneel has quit IRC01:02
*** Dinesh_Bhor has joined #openstack-keystone01:02
Dinesh_Bhorcmurphy: Hi, you there? Thank you for reviewing the patch:
*** oikiki has quit IRC01:07
*** itlinux has quit IRC01:12
*** harlowja has quit IRC01:20
*** edmondsw has joined #openstack-keystone01:25
*** gongysh has quit IRC01:27
*** edmondsw has quit IRC01:29
*** ionel has quit IRC01:31
*** gongysh has joined #openstack-keystone01:39
lbragstadkmalloc: ayoung .... what happened?01:40
lbragstadthe scrollback is ridiculous01:40
lbragstadabout the hmt bits...02:02
lbragstadif project A has children B and C02:02
lbragstadif i get a token scoped to A and list all servers, I should be able to see servers in A, B, and C02:02
lbragstadbut that does require nova to callback to keystone to understand the tree structure02:02
lbragstador at least iterate through a list of projects and return the servers owned by them02:03
lbragstadthe advantage is that it helps introduce granularity in the APIs that might actually get used by end-users (versus just operators)02:04
lbragstadwxy: o/02:04
wxylbragstad: hi, online now. wake up late this morning.02:06
lbragstadwxy: ha - it happens02:07
lbragstadwxy: is it 9:00 AM there?02:07
lbragstador 8:00AM?02:07
wxylbragstad: 10:00 AM02:07
lbragstad"off by 1" errors02:08
wxyanything I can help?02:08
lbragstadjust wanted to check in - we made some updates to the trello board during office hours02:08
lbragstad(not sure if you've parsed it yet)02:08
wxythanks for reminding me. I'll check it later.02:09
lbragstadi know we talked a bit earlier about splitting up the token provider API refactor, are you still interested in that as a precursor to the JWT work?02:12
wxylbragstad: hmm, so I have some works on yaml catalog, limit description, token provider refactor and help you to enhance unified limit and oslo.limit.02:13
wxylbragstad: that's sound good.02:13
lbragstadwxy: you're ambitious :)02:13
lbragstadthe token provider refactor is still a bit of a mess02:14
wxylbragstad: It' my pleasure to help upstream work and you guys trust me.02:14
lbragstadi'll make a point to sit down with tomorrow and work through it a bit more02:15
lbragstadi'll see if i can split it into pieces that are easier to review02:16
wxycool. it's a good start.02:16
lbragstadi think so, too02:17
lbragstadi know knikolla was interested in that work as well02:17
wxyWe may work together to make it perfect.02:19
lbragstadhey - how was your trip back home?02:19
lbragstaddid you hit any issues with travel?02:19
openstackgerritwangxiyuan proposed openstack/keystone master: Deprecate the templated catalog
openstackgerritwangxiyuan proposed openstack/keystone master: [WIP]Add yaml-loaded filesystem catalog backend
*** germs has joined #openstack-keystone02:20
*** germs has quit IRC02:20
*** germs has joined #openstack-keystone02:20
openstackgerritwangxiyuan proposed openstack/keystone master: [WIP]Add yaml-loaded filesystem catalog backend
wxyI was blocked at Frankfurt. But just delayed a few hours fortunately.02:21
lbragstaddid you fly direct from Frankfurt to China?02:22
wxyyeah, to BeiJing, then to Xi'An02:22
lbragstadoh - cool02:23
lbragstadso you made it back when you expected to02:23
lbragstadthat's good02:23
*** r-daneel has joined #openstack-keystone02:26
*** Dinesh_Bhor has quit IRC02:27
*** pcichy has quit IRC02:28
*** Dinesh_Bhor has joined #openstack-keystone02:30
*** AlexeyAbashkin has joined #openstack-keystone02:36
*** AlexeyAbashkin has quit IRC02:40
*** germs has quit IRC02:43
*** germs has joined #openstack-keystone02:43
*** germs has quit IRC02:43
*** germs has joined #openstack-keystone02:43
*** germs has quit IRC02:48
*** Dinesh_Bhor has quit IRC02:52
*** Dinesh_Bhor has joined #openstack-keystone02:52
*** Dinesh_Bhor has quit IRC02:58
*** Dinesh_Bhor has joined #openstack-keystone03:00
*** edmondsw has joined #openstack-keystone03:14
*** gongysh has quit IRC03:17
*** edmondsw has quit IRC03:18
*** nicolasbock has quit IRC03:26
*** AlexeyAbashkin has joined #openstack-keystone03:36
*** AlexeyAbashkin has quit IRC03:40
*** david-lyle has joined #openstack-keystone03:55
*** gongysh has joined #openstack-keystone04:00
*** Dinesh_Bhor has quit IRC04:07
*** namnh has joined #openstack-keystone04:09
*** harlowja has joined #openstack-keystone04:12
*** abhi89 has joined #openstack-keystone04:15
*** dave-mccowan has quit IRC04:17
*** links has joined #openstack-keystone04:22
ayounglbragstad, had to shovel snow.  Kicked my ass.  2 feet.04:26
ayounglbragstad, yeah, the issue is that if we go with Morgan's plan, I can't see a way to close out 968696 in a timely manner, and I was kindof gobsmacked by that.04:27
ayoungAnd with that, I am going to bed.04:27
*** karthi has joined #openstack-keystone04:39
*** harlowja has quit IRC04:40
*** Dinesh_Bhor has joined #openstack-keystone04:42
*** igrcafii has joined #openstack-keystone04:50
*** igrcafii has quit IRC04:52
*** Dinesh_Bhor has quit IRC04:57
*** Dinesh_Bhor has joined #openstack-keystone05:00
openstackgerritDinesh Bhor proposed openstack/python-keystoneclient master: Add Response class to return request-id to caller
openstackgerritDinesh Bhor proposed openstack/python-keystoneclient master: Add return-request-id-to-caller function(v3)
*** karthi has quit IRC05:04
*** karthi has joined #openstack-keystone05:05
*** karthi has quit IRC05:09
*** Dinesh_Bhor has quit IRC05:17
*** karthi has joined #openstack-keystone05:22
openstackgerritOpenStack Proposal Bot proposed openstack/keystone master: Updated from global requirements
openstackgerritOpenStack Proposal Bot proposed openstack/keystone-tempest-plugin master: Updated from global requirements
openstackgerritOpenStack Proposal Bot proposed openstack/keystoneauth master: Updated from global requirements
openstackgerritOpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements
*** abhi89 has quit IRC05:48
*** karthi has quit IRC06:03
*** karthi has joined #openstack-keystone06:11
*** karthi has quit IRC06:15
*** karthi has joined #openstack-keystone06:18
*** pcichy has joined #openstack-keystone06:21
*** Dinesh_Bhor has joined #openstack-keystone06:35
*** dims has quit IRC06:41
*** dims has joined #openstack-keystone06:43
*** dims has quit IRC06:48
*** dims has joined #openstack-keystone06:49
*** edmondsw has joined #openstack-keystone06:50
*** pcichy has quit IRC06:52
*** edmondsw has quit IRC06:54
*** abhi89 has joined #openstack-keystone07:03
*** pcaruana has joined #openstack-keystone07:04
*** karthi has quit IRC07:15
*** Dinesh_Bhor has quit IRC07:15
*** karthi has joined #openstack-keystone07:15
*** Dinesh_Bhor has joined #openstack-keystone07:16
*** Dinesh_Bhor has quit IRC07:20
*** Dinesh_Bhor has joined #openstack-keystone07:27
*** Dinesh_Bhor has quit IRC07:37
*** karthi has quit IRC07:38
*** martinus__ has joined #openstack-keystone07:38
*** karthi has joined #openstack-keystone07:38
*** AlexeyAbashkin has joined #openstack-keystone07:57
*** karthi has quit IRC08:10
*** tesseract has joined #openstack-keystone08:14
*** karthi has joined #openstack-keystone08:16
*** Dinesh_Bhor has joined #openstack-keystone08:17
*** hoonetorg has quit IRC08:30
*** karthi has quit IRC08:33
*** edmondsw has joined #openstack-keystone08:38
*** Dinesh_Bhor has quit IRC08:38
*** edmondsw has quit IRC08:43
*** hoonetorg has joined #openstack-keystone08:44
*** karthi has joined #openstack-keystone09:03
*** Dinesh_Bhor has joined #openstack-keystone09:15
*** Dinesh_Bhor has quit IRC09:16
*** Dinesh_Bhor has joined #openstack-keystone09:21
*** gongysh has quit IRC09:22
*** karthi has quit IRC09:24
openstackgerritwangxiyuan proposed openstack/keystone master: Add yaml-loaded filesystem catalog backend
*** karthi has joined #openstack-keystone09:24
*** Dinesh_Bhor has quit IRC09:30
*** karthi has quit IRC09:43
*** namnh has quit IRC10:00
*** rcernin has quit IRC10:13
*** karthi has joined #openstack-keystone10:14
*** karthi has quit IRC10:22
*** karthi has joined #openstack-keystone10:23
*** nicolasbock has joined #openstack-keystone10:25
*** edmondsw has joined #openstack-keystone10:26
*** karthi has quit IRC10:29
*** jmlowe has quit IRC10:30
*** edmondsw has quit IRC10:31
*** karthi has joined #openstack-keystone10:32
openstackgerritJohannes Grassler proposed openstack/keystone-specs master: Add whitelist-extension-for-app-creds
*** belmoreira has joined #openstack-keystone10:56
*** panbalag has quit IRC10:58
*** HW-Peter has quit IRC11:22
*** jmlowe has joined #openstack-keystone11:23
*** jmlowe has quit IRC11:27
*** karthi has quit IRC11:28
*** karthi has joined #openstack-keystone11:36
*** karthi has quit IRC11:38
*** raildo has joined #openstack-keystone12:07
*** zhongjun has quit IRC12:14
*** edmondsw has joined #openstack-keystone12:24
*** dave-mccowan has joined #openstack-keystone12:32
*** panbalag has joined #openstack-keystone12:37
*** karthi has joined #openstack-keystone12:45
*** odyssey4me has quit IRC12:47
*** odyssey4me has joined #openstack-keystone12:47
*** r-daneel has quit IRC12:53
*** edmondsw_ has joined #openstack-keystone12:55
*** edmondsw has quit IRC12:58
*** spilla has joined #openstack-keystone13:01
*** felipemonteiro_ has joined #openstack-keystone13:23
*** edmondsw_ is now known as edmondsw13:27
*** karthi has quit IRC13:31
*** felipemonteiro_ has quit IRC13:51
*** zhongjun has joined #openstack-keystone13:53
gagehugodocs building seems broken14:01
wxySphinx v1.6.7 lead the error14:06
wxyif a package only contain, it will be ignored to generate the toc.14:07
lbragstadin case anyone is interested in the oslo.limit proposal -
wxykeystone.contrib, keysotne.tests and keystone.tests.unit.contrib have this problem.14:09
*** karthi has joined #openstack-keystone14:14
lbragstadtrying to recreate locally14:19
lbragstadis this the failure everyone else is getting - v14:25
wxylbragstad: yeah, it's the error.14:26
lbragstadis there a way to tell sphinx not to ignore those?14:34
wxylbragstad: I'm checking the code, but seems no way IMO.14:35
*** germs has joined #openstack-keystone14:35
*** germs has quit IRC14:35
*** germs has joined #openstack-keystone14:35
*** wes_dillingham has joined #openstack-keystone14:39
*** mvk has quit IRC14:40
*** felipemonteiro_ has joined #openstack-keystone14:49
*** felipemonteiro__ has joined #openstack-keystone14:51
gagehugolbragstad yeah14:51
lbragstadwe didn't consume a major version of sphinx did we?14:53
lbragstaddoesn't look like it14:53
*** germs has quit IRC14:55
*** felipemonteiro_ has quit IRC14:55
*** mvk has joined #openstack-keystone14:55
*** ayoung has quit IRC15:08
*** itlinux has joined #openstack-keystone15:12
*** germs has joined #openstack-keystone15:13
*** germs has quit IRC15:14
*** germs has joined #openstack-keystone15:15
*** germs has quit IRC15:15
*** germs has joined #openstack-keystone15:15
*** links has quit IRC15:18
*** ayoung has joined #openstack-keystone15:20
*** wes_dillingham has quit IRC15:22
ayounglbragstad, so I see you noticed the long convo between me and Morgan15:27
openstackgerritLance Bragstad proposed openstack/keystone master: Update modules to contain for Sphinx
lbragstadnot sure if ^ is the right fix... but we'll need to refactor a few modules in order for Sphinx to work properly15:27
ayoungquestion:  what should a service scoped token be able to do on Nova?15:27
ayoungbecause right now, an admin token can do a lot, like cross project operations15:28
ayoungand I think that people are building on top of that15:28
lbragstadservice scoped token in that "you have the admin role on the compute service in regionOne"?15:28
lbragstador like nova's service account15:29
ayounglbragstad, the first15:29
ayoungsystem scoped15:29
ayoungthe new stuff15:29
lbragstadso - i would think that would be all system scoped operations for nova15:29
lbragstadfor example15:30
lbragstadif i give ayoung the admin role on the compute service, you should be able to generate system-scoped tokens that allow you to execute all of nova's system-level APIs15:30
ayoungwhat about list-servers and delete-server?15:30
lbragstadbut i should be able to give kmalloc the admin role on the storage service, so that he can execute all of cinder's system-level APIs15:30
lbragstadthose are project-scoped operations15:31
lbragstadi can't remember what level of RBAC that pertains to from the NIST documentation, level 3 or 4 i think15:31
lbragstadwhere you separate and disperse administrative actions across a set of users15:32
*** wes_dillingham has joined #openstack-keystone15:33
*** felipemonteiro__ has quit IRC15:34
gagehugolbragstad I thought it looked like the issue was fixed in 1.7.115:35
gagehugofrom the link wxy posted15:35
*** felipemonteiro__ has joined #openstack-keystone15:35
lbragstadah - beat me to it15:36
lbragstadnice, so maybe we just upgrade to 1.7.1?15:36
lbragstadand blacklist 1.6.715:36
gagehugowonder if sphinx is capped currently?15:38
lbragstadlooks like it -
lbragstadlooks like proposes a bump15:42
lbragstadto 1.7.115:42
ayounglbragstad, so the question is what do we do about all of the third party apps out there that do things with "admin scoped to project" on dehalf of another user?  Stuff that should never have been allowed, but is now the norm15:53
ayoungI think we CloudForms, we can get away with using HMT, but that is kindof by luck15:53
ayounglist all projects on the server  uses an admin token, but actual operations that change state use a (properly scoped) project token15:54
ayoungnot sure if this is the case elsewhere15:54
ayoungbut it was things like this that had the hack in is_admin_project that allowed it to always be set...gave a transition plan15:54
lbragstadideally - we don't want that behavior, right?16:01
*** felipemonteiro_ has joined #openstack-keystone16:01
*** felipemonteiro_ has quit IRC16:02
*** felipemonteiro_ has joined #openstack-keystone16:03
*** felipemonteiro__ has quit IRC16:04
*** felipemonteiro__ has joined #openstack-keystone16:06
*** felipemonteiro_ has quit IRC16:09
lbragstadwxy: gagehugo Sphinx 1.6.5 doesn't seem to have that behavior16:15
lbragstadactually - wrong link16:15
*** r-daneel has joined #openstack-keystone16:15
gagehugolbragstad yeah I got the same result16:15
lbragstadlooks like updating to 1.7.1 isn't feasible16:15
lbragstadbecause it depends on a new version of pbr16:16
gagehugodoes doc/requirements.txt not get used?16:16
lbragstadand there are apparently issues there16:16
gagehugooh global-requrements.txt16:16
gagehugosomething was overriding doc/requirements.txt16:16
lbragstadthat should go through and propose an update to our doc/requirements.txt i think16:16
lbragstad needs to get updated16:17
lbragstador it should get updated once the g-r patch merges16:17
cmurphyis this ? i guess they released a new version without fixing that?16:18
gagehugocmurphy yeah16:19
lbragstaddhellmann proposed a fix -
lbragstadwhich appears to be in version 1.7.116:19
lbragstadnot sure why that doesn't close #444616:20
*** felipemonteiro__ has quit IRC16:20
lbragstadoh - nevermind16:21
lbragstadi think it does16:21
lbragstadit should - just not linked directly i don't think?16:21
*** karthi has quit IRC16:27
*** AlexeyAbashkin has quit IRC16:30
*** karthi has joined #openstack-keystone16:35
lbragstadgrabbing lunch16:39
*** karthi has quit IRC16:44
*** sapd_ has joined #openstack-keystone17:01
*** sapd has quit IRC17:05
*** pcaruana has quit IRC17:18
*** ayoung has quit IRC17:21
openstackgerritPavlo Shchelokovskyy proposed openstack/keystone master: Allow to block self-service password change
*** abhi89 has quit IRC17:36
*** panbalag has left #openstack-keystone17:49
*** itlinux has quit IRC17:50
*** links has joined #openstack-keystone17:57
*** itlinux has joined #openstack-keystone17:58
*** gyee has joined #openstack-keystone18:05
*** AlexeyAbashkin has joined #openstack-keystone18:07
*** harlowja has joined #openstack-keystone18:11
*** AlexeyAbashkin has quit IRC18:11
*** felipemonteiro_ has joined #openstack-keystone18:12
*** felipemonteiro__ has joined #openstack-keystone18:15
*** felipemonteiro_ has quit IRC18:19
*** felipemonteiro__ has quit IRC18:30
*** felipemonteiro__ has joined #openstack-keystone18:30
*** mvk has quit IRC18:41
*** itlinux has quit IRC18:57
*** itlinux_ has joined #openstack-keystone18:57
jdennisper user auth (A.K.A. multi-factor auth) was added in Ocata. Do I understand correctly in order to enforce MFA the MFA rules need to be explicitly set for each user as opposed to a site-wide MFA configuration with the per user auth providing an exception for the site-wide MFA policy?19:07
*** mvk has joined #openstack-keystone19:09
*** idlemind has joined #openstack-keystone19:14
jdennislbragstad: ^^^19:15
lbragstadjdennis: yes - unfortunately19:15
lbragstadthere was some usability issues with policy/rbac and MFA19:15
jdennislbragstad: thanks, are there any plans for a site wide policy?19:16
lbragstadbecause technically you'd need to have an administrator to update the user secrets19:16
lbragstadtechnically - that'd be something that we should fix by including a scope check in code19:16
lbragstadadriant: was working on some of that stuff19:16
lbragstadi think was part of that problem19:16
openstackLaunchpad bug 1750678 in OpenStack Identity (keystone) "The ec2 credential API should account for different scopes" [High,Triaged]19:16
lbragstadanother example -
*** tesseract has quit IRC19:20
kmallocjdennis: we don't have site-wide scheduled, but it could be implemneted, it would need to allow for the current system to override site-wide19:22
lbragstadyeah - technically a user should be able to update their own credential secrets19:23
kmallocjdennis: the key was we wanted to land the base functionality first before site-wide - hitting the initial use-case19:23
jdennislbragstad, kmalloc: thanks19:23
lbragstadbut right now the policies aren't that smart :(19:23
kmalloci would not be opposed to a site-wide setup if someone wants to help contribute.19:23
kmallocbut it absolutely needs to address cases for users (service users) that cannot have MFA.19:23
kmallocwhich was the main sticking point to starting with site-wide first.19:24
jdenniskmalloc: but I though we had an per user mfa exception19:24
kmallocright now we have per-user19:24
kmallocthe option when we implemented it was per-user or site-wide, just due to code bandwidth19:24
kmallocwe opted for per-user since that is more functional19:25
kmalloc(it was driven by the need for the user-option mechanism in SQL)19:25
kmallocso, now we could do a site-wide with the current system overriding (and/or add a mechanism to disable)19:25
kmallocor a way to flag groups of users with say MFA rules.19:26
kmalloc(vs. site-wide)19:26
jdenniskmalloc: what I was trying to get at was your comment "needs to address cases for users (service users) that cannot have MFA", and I thought we had an exception mechanism for that today19:26
kmalloctl;dr, we opted for base use of enable per user to start. Someone is welcome to contribute enhancemnets :)19:26
kmallocright, today the default is no MFA rules.19:26
kmallocso service users are by default exempted. if we implement a site wide, we need to still maintain that exemption19:27
kmallocservice users are fundamentally just users and could have MFA rules.19:27
kmallocbut it would be a bad idea :P19:27
*** links has quit IRC19:34
*** panbalag has joined #openstack-keystone19:38
*** itlinux_ has quit IRC19:40
*** itlinux has joined #openstack-keystone19:52
*** ayoung has joined #openstack-keystone20:08
*** Supun has joined #openstack-keystone20:12
*** jmlowe has joined #openstack-keystone20:35
*** AlexeyAbashkin has joined #openstack-keystone20:36
knikollaper domain mfa options?20:36
kmallocknikolla: sure.20:36
kmallocthat'd be fine20:36
kmallocas long as user options override.20:36
*** raildo has quit IRC20:38
*** Supun has quit IRC20:39
*** AlexeyAbashkin has quit IRC20:40
openstackgerritNicolas Helgeson proposed openstack/python-keystoneclient master: Extends tags comparator support to KSC
*** wes_dillingham has quit IRC20:44
*** idlemind_ has joined #openstack-keystone20:44
*** idlemind_ has quit IRC20:44
*** idlemind has quit IRC20:44
aningcmurphy: Bug #1755906 has been created for the upgrade keystone DB deadlock issue during db_sync --contract20:45
openstackbug 1755906 in OpenStack Identity (keystone) "Occasional deadlock during db_sync --contract during Newton to Pike live upgrade" [Undecided,New]
aningCool, the bug popped up here by itself :)20:46
gagehugolbragstad tags question20:51
gagehugoif I have 2 projects: p1 with tags:["red", "blue"] and p2 with tags:["red", "blue", "green"]20:52
gagehugoand I do GET keystone/v3/projects?tags=red,blue20:52
gagehugoshould only p1 be returned (exact match) or p1 & p2 (subset match)20:53
lbragstadi thought the tags qp only filtered exact matching sets20:53
lbragstadso just p1 would be returned?20:53
lbragstadbut tags_any=red,blue would return both20:54
kmallocthat was my understanding too lbragstad20:55
openstackgerritNicolas Helgeson proposed openstack/keystone master: Extend comparator support for project list by tags
lbragstaddoes it not work that way?20:56
gagehugoright now keystone does exact20:56
lbragstadfor tags=red,blue ?20:57
lbragstadisn't that working as designed then?20:57
gagehugothe question I have is should it be exact vs subset20:57
lbragstadtags_any should be subset, right?20:58
lbragstadif i use tags=red,blue i want a list of all projects with only those tags20:58
lbragstadif i use tags_any=red,blue i want a list of all projects with that set of tags as a subset or complete set20:58
gagehugotags-any would return all projects with red OR blue, not just both though21:00
gagehugoso p3 with tags: ["red" "green"] would be included21:02
*** wes_dillingham has joined #openstack-keystone21:03
lbragstadshould it include subsets?21:03
gagehugoI think there was some concern about potential ambiguity in the api-wg spec21:04
lbragstadso - does that mean keep tags from returning subsets?21:05
gagehugoI wonder what nova does21:05
lbragstadi assume strict checking with tags (versus tags-any) would mitigate concerns about ambiguity21:07
lbragstadif i want ambiguity, i should use tags-any..21:07
lbragstadif i want exact matches, i should use tags21:07
*** rcernin has joined #openstack-keystone21:08
gagehugothat's what I assume21:12
*** jessegler has joined #openstack-keystone21:19
gagehugojessegler o/21:19
gagehugothe case is I want all projects with red AND blue, and if there are others I don't mind21:23
jesseglerI'm coming in late to this party21:23
jesseglerSo, to recap, I think we've got a bug with the keystone tags. The spec says you can do: GET /v3/projects?tags=foo,bar&tags-any=red,blue21:25
jesseglerAnd that you can get back: Example that returns any projects that have the “foo” and “bar” tags, plus at least one of “red” and “blue”.21:25
jesseglerI think that implies that tags shouldn't be exact -- that it should be the superset or as @gagehugo said if there are others I don't mind21:26
*** dave-mccowan has quit IRC21:26
jesseglerBecause otherwise you're AND'ing the set of projects that contain both 'foo' and 'bar' with the set of projects that contain 'red' or 'blue'21:26
jesseglerAnd that's an empty set, because the left side would give you only projects that contain 'foo' and 'bar' and nothing else21:27
jesseglerSo they couldn't contain 'red' or 'blue'21:27
jesseglerMake sense?21:27
lbragstadso - we'd need to loosen the tags query parameter to include subsets21:32
lbragstador update the specification to say GET /v3/projects?tags=foo,bar,blue21:32
lbragstador GET /v3/projects?tags=foo,bar,red21:32
jesseglerThat wouldn't solve @gagehugo's case though.21:33
*** dave-mccowan has joined #openstack-keystone21:33
jesseglerEh, I don't think that would solve the issue?21:34
jesseglerIf you do tags=foo,bar,blue currently you'd only get back projects with [foo, bar, blue] (and no other tags)21:35
lbragstadit sounds like the bug is that the documentation expects tags to handle subsets21:35
jesseglerI definitely agree that the documentation is not great here.21:35
jesseglerBut I think exact tags is a weird user experience21:35
jesseglerIf I search for tags=red,blue I'd expect to get back all the projects that have red AND blue AND maybe some other tags21:36
gagehugoI would think subsets would allow for MORE exact if you just keep including more tags21:36
lbragstadthat feels like it's also something that tags-any should do, too21:36
jesseglerAnd maybe you could tell me to do tags-any=red,blue but then I'm getting projects that maybe just have red or just have blue21:37
gagehugotags-any=red & tags-any=blue21:37
jesseglerThat might work, but it doesn't match the example in the spec21:38
lbragstadthe spec or documentation needs to be updated i think21:38
lbragstador we update the implementation21:39
jesseglerI think both?21:39
jesseglerI think tags --> exact list is a weird user experience and shouldn't be the default.21:39
*** itlinux has quit IRC21:40
jesseglerIf I'm searching for music, and I look for songs tagged "90s", I'd expect to get back all the songs with a "90s" tag, even if they were also tagged "pop" for instance.21:40
jesseglerI'd argue that if we want an exact tag match, that's fine (maybe a little weird, but fine) but we should have like a "tags-exact" for it or something21:41
*** edmondsw has quit IRC21:41
lbragstadyou'd also get that by doing tags-any=90s21:42
jesseglerCurrently you could.21:42
jesseglerBut, I think that the one parameter case is weird21:43
lbragstadi guess it depends on what we expect `tags` to actually mean21:43
jesseglerI think for one parameter tags should be equivalent to tags-any21:43
jesseglerAnd then for more parameters tags should AND the parameters21:44
jesseglerAnd tags-any should OR them21:44
jesseglerFor one parameter there's nothing to AND or OR the single parameter against so comes out the same21:44
*** belmoreira has quit IRC21:45
jesseglerIt also will make startswith/endswith/contains sane(r).21:47
jesseglerIf we have a project with a tag [happy]21:47
jesseglerand we do tags__contains=app,y21:48
jesseglerAre we looking for two tags? Or should we match that project?21:48
*** martinus__ has quit IRC21:55
lbragstadare we consistent with other services?21:56
jesseglerI can figure out what Nova is doing and get back to you?21:57
jesseglerSounds good21:58
openstackgerritayoung proposed openstack/keystone-specs master: Add whitelist-extension-for-app-creds
jamielennoxlbragstad: hey, we never talked last week - did you figure out what you need/22:08
*** felipemonteiro_ has joined #openstack-keystone22:20
*** felipemonteiro__ has quit IRC22:23
*** wes_dillingham has quit IRC22:38
*** dave-mccowan has quit IRC22:47
*** spilla has quit IRC22:48
*** felipemonteiro_ has quit IRC22:49
*** david-lyle has quit IRC23:21
*** david-lyle has joined #openstack-keystone23:26
*** david-lyle has quit IRC23:28
*** david-lyle has joined #openstack-keystone23:30
*** kmalloc has quit IRC23:38
*** itlinux has joined #openstack-keystone23:47
*** bigjools_ is now known as bigjools23:59
*** bigjools has quit IRC23:59
*** bigjools has joined #openstack-keystone23:59

Generated by 2.15.3 by Marius Gedminas - find it at!