| *** germs has quit IRC | 00:02 | |
| *** germs has joined #openstack-keystone | 00:03 | |
| *** germs has quit IRC | 00:03 | |
| *** germs has joined #openstack-keystone | 00:03 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 00:28 | |
| *** edmondsw has joined #openstack-keystone | 01:02 | |
| *** edmondsw has quit IRC | 01:07 | |
| *** namnh has joined #openstack-keystone | 01:17 | |
| *** gyankum has joined #openstack-keystone | 01:17 | |
| *** lifeless has quit IRC | 01:22 | |
| *** gagehugo has joined #openstack-keystone | 01:22 | |
| *** bhagyashris_ has quit IRC | 01:26 | |
| *** lifeless has joined #openstack-keystone | 01:27 | |
| *** bhagyashris_ has joined #openstack-keystone | 01:27 | |
| *** gagehugo has quit IRC | 01:31 | |
| *** eschwartz has quit IRC | 01:34 | |
| *** eschwartz has joined #openstack-keystone | 01:34 | |
| *** gagehugo has joined #openstack-keystone | 01:36 | |
| *** lifeless has quit IRC | 01:46 | |
| *** lifeless has joined #openstack-keystone | 01:53 | |
| redrobot | o/ | 02:03 |
|---|---|---|
| redrobot | Assuming there's no team meeting today because of Memorial Day in the US... | 02:03 |
| *** threestrands has quit IRC | 02:05 | |
| *** threestrands_ has joined #openstack-keystone | 02:05 | |
| *** yankcrime has quit IRC | 02:07 | |
| *** _nick has joined #openstack-keystone | 02:08 | |
| *** baffle has quit IRC | 02:24 | |
| *** eschwartz has quit IRC | 02:25 | |
| *** eschwartz[m]_ has joined #openstack-keystone | 02:25 | |
| *** baffle has joined #openstack-keystone | 02:25 | |
| *** lbragstad[m] has quit IRC | 02:37 | |
| *** knikolla[m] has quit IRC | 02:37 | |
| *** jhesketh has quit IRC | 02:37 | |
| *** lbragstad[m] has joined #openstack-keystone | 02:37 | |
| *** knikolla[m] has joined #openstack-keystone | 02:37 | |
| *** jhesketh has joined #openstack-keystone | 02:37 | |
| *** raginbajin has quit IRC | 02:40 | |
| *** raginbajin has joined #openstack-keystone | 02:40 | |
| *** lbragstad[m] has quit IRC | 02:41 | |
| *** knikolla[m] has quit IRC | 02:41 | |
| *** nicolasbock[m] has quit IRC | 02:41 | |
| *** cmurphy[m] has quit IRC | 02:41 | |
| *** namnh has quit IRC | 02:41 | |
| *** baffle has quit IRC | 02:41 | |
| *** baffle has joined #openstack-keystone | 02:42 | |
| *** namnh has joined #openstack-keystone | 02:42 | |
| *** germs_ has joined #openstack-keystone | 02:44 | |
| *** germs has quit IRC | 02:44 | |
| *** germs_ has quit IRC | 02:44 | |
| *** mtreinish has quit IRC | 02:44 | |
| *** toddnni has quit IRC | 02:44 | |
| *** Tahvok has quit IRC | 02:44 | |
| *** Rhvs has quit IRC | 02:44 | |
| *** zhongjun_ has quit IRC | 02:44 | |
| *** jmlowe_ has quit IRC | 02:44 | |
| *** chrome0 has quit IRC | 02:44 | |
| *** zeus has quit IRC | 02:44 | |
| *** hugokuo has quit IRC | 02:44 | |
| *** portdirect has quit IRC | 02:44 | |
| *** jmlowe_ has joined #openstack-keystone | 02:45 | |
| *** chrome0 has joined #openstack-keystone | 02:45 | |
| *** zeus has joined #openstack-keystone | 02:45 | |
| *** hugokuo has joined #openstack-keystone | 02:45 | |
| *** portdirect has joined #openstack-keystone | 02:45 | |
| *** germs_ has joined #openstack-keystone | 02:45 | |
| *** mtreinish has joined #openstack-keystone | 02:45 | |
| *** toddnni has joined #openstack-keystone | 02:45 | |
| *** Tahvok has joined #openstack-keystone | 02:45 | |
| *** Rhvs has joined #openstack-keystone | 02:45 | |
| *** zhongjun_ has joined #openstack-keystone | 02:45 | |
| *** gyankum has quit IRC | 02:46 | |
| *** hoonetorg has quit IRC | 02:46 | |
| *** liuzz_ has quit IRC | 02:46 | |
| *** hemna has quit IRC | 02:46 | |
| *** redrobot has quit IRC | 02:46 | |
| *** evrardjp has quit IRC | 02:46 | |
| *** slunkad has quit IRC | 02:46 | |
| *** andreykurilin has quit IRC | 02:46 | |
| *** eEbx has quit IRC | 02:46 | |
| *** bhagyashris_ has quit IRC | 02:46 | |
| *** Dinesh_Bhor has quit IRC | 02:46 | |
| *** rcernin has quit IRC | 02:46 | |
| *** openstackgerrit has quit IRC | 02:46 | |
| *** zzzeek has quit IRC | 02:46 | |
| *** brad[] has quit IRC | 02:46 | |
| *** eglute has quit IRC | 02:46 | |
| *** alex_xu has quit IRC | 02:46 | |
| *** frickler has quit IRC | 02:46 | |
| *** germs_ has quit IRC | 02:47 | |
| *** gyankum has joined #openstack-keystone | 02:47 | |
| *** hoonetorg has joined #openstack-keystone | 02:47 | |
| *** liuzz_ has joined #openstack-keystone | 02:47 | |
| *** hemna has joined #openstack-keystone | 02:47 | |
| *** redrobot has joined #openstack-keystone | 02:47 | |
| *** evrardjp has joined #openstack-keystone | 02:47 | |
| *** slunkad has joined #openstack-keystone | 02:47 | |
| *** andreykurilin has joined #openstack-keystone | 02:47 | |
| *** eEbx has joined #openstack-keystone | 02:47 | |
| *** germs has joined #openstack-keystone | 02:47 | |
| *** germs has quit IRC | 02:47 | |
| *** germs has joined #openstack-keystone | 02:47 | |
| *** bhagyashris_ has joined #openstack-keystone | 02:48 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 02:48 | |
| *** rcernin has joined #openstack-keystone | 02:48 | |
| *** openstackgerrit has joined #openstack-keystone | 02:48 | |
| *** zzzeek has joined #openstack-keystone | 02:48 | |
| *** brad[] has joined #openstack-keystone | 02:48 | |
| *** eglute has joined #openstack-keystone | 02:48 | |
| *** alex_xu has joined #openstack-keystone | 02:48 | |
| *** frickler has joined #openstack-keystone | 02:48 | |
| *** mchlumsky has quit IRC | 02:50 | |
| *** freerunner has quit IRC | 02:50 | |
| *** pooja_jadhav has quit IRC | 02:50 | |
| *** vegarl has quit IRC | 02:50 | |
| *** cz2 has quit IRC | 02:50 | |
| *** mgagne has quit IRC | 02:50 | |
| *** tobberydberg has quit IRC | 02:50 | |
| *** isssp has quit IRC | 02:50 | |
| *** adriant has quit IRC | 02:50 | |
| *** jroll has quit IRC | 02:50 | |
| *** jrist has quit IRC | 02:50 | |
| *** charz has quit IRC | 02:50 | |
| *** lifeless has quit IRC | 02:50 | |
| *** markvoelker has quit IRC | 02:50 | |
| *** weezhard has quit IRC | 02:50 | |
| *** dtruong has quit IRC | 02:50 | |
| *** jmccrory has quit IRC | 02:50 | |
| *** threestrands_ has quit IRC | 02:50 | |
| *** gagehugo has quit IRC | 02:50 | |
| *** jaosorior has quit IRC | 02:50 | |
| *** timss has quit IRC | 02:50 | |
| *** rvba has quit IRC | 02:50 | |
| *** cloudnull has quit IRC | 02:50 | |
| *** rybridges has quit IRC | 02:50 | |
| *** mchlumsky has joined #openstack-keystone | 02:50 | |
| *** freerunner has joined #openstack-keystone | 02:50 | |
| *** pooja_jadhav has joined #openstack-keystone | 02:50 | |
| *** vegarl has joined #openstack-keystone | 02:50 | |
| *** cz2 has joined #openstack-keystone | 02:50 | |
| *** mgagne has joined #openstack-keystone | 02:50 | |
| *** tobberydberg has joined #openstack-keystone | 02:50 | |
| *** isssp has joined #openstack-keystone | 02:50 | |
| *** adriant has joined #openstack-keystone | 02:50 | |
| *** jroll has joined #openstack-keystone | 02:50 | |
| *** jrist has joined #openstack-keystone | 02:50 | |
| *** charz has joined #openstack-keystone | 02:50 | |
| *** lifeless has joined #openstack-keystone | 02:50 | |
| *** markvoelker has joined #openstack-keystone | 02:50 | |
| *** weezhard has joined #openstack-keystone | 02:50 | |
| *** dtruong has joined #openstack-keystone | 02:50 | |
| *** jmccrory has joined #openstack-keystone | 02:50 | |
| *** edmondsw has joined #openstack-keystone | 02:51 | |
| *** threestrands_ has joined #openstack-keystone | 02:51 | |
| *** gagehugo has joined #openstack-keystone | 02:51 | |
| *** jaosorior has joined #openstack-keystone | 02:51 | |
| *** timss has joined #openstack-keystone | 02:51 | |
| *** rvba has joined #openstack-keystone | 02:51 | |
| *** cloudnull has joined #openstack-keystone | 02:51 | |
| *** rybridges has joined #openstack-keystone | 02:51 | |
| *** Dinesh_Bhor has quit IRC | 02:52 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 02:53 | |
| *** edmondsw has quit IRC | 02:55 | |
| *** Dinesh_Bhor has quit IRC | 03:05 | |
| *** germs has quit IRC | 03:11 | |
| *** cmurphy[m] has joined #openstack-keystone | 03:12 | |
| *** germs has joined #openstack-keystone | 03:12 | |
| *** germs has quit IRC | 03:12 | |
| *** germs has joined #openstack-keystone | 03:12 | |
| *** annp has joined #openstack-keystone | 03:14 | |
| *** nicolasbock[m] has joined #openstack-keystone | 03:27 | |
| *** lbragstad[m] has joined #openstack-keystone | 03:27 | |
| *** knikolla[m] has joined #openstack-keystone | 03:27 | |
| *** sonuk has joined #openstack-keystone | 03:41 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 03:45 | |
| *** germs has quit IRC | 04:04 | |
| redrobot | haha, just realized I was on the wrong channel... oops. >_< | 04:05 |
| *** mvk has joined #openstack-keystone | 04:09 | |
| *** markvoelker has quit IRC | 04:19 | |
| *** markvoelker has joined #openstack-keystone | 04:22 | |
| *** pcichy has joined #openstack-keystone | 04:27 | |
| *** Dinesh_Bhor has quit IRC | 04:29 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:53 | |
| *** masber has quit IRC | 05:08 | |
| *** felipemonteiro has joined #openstack-keystone | 05:16 | |
| *** dikonoor has joined #openstack-keystone | 05:19 | |
| *** masber has joined #openstack-keystone | 05:29 | |
| *** mujahidali has joined #openstack-keystone | 05:41 | |
| *** links has joined #openstack-keystone | 06:02 | |
| *** eschwartz[m]_ is now known as eschwartz | 06:06 | |
| *** gongysh has joined #openstack-keystone | 06:08 | |
| *** felipemonteiro has quit IRC | 06:11 | |
| *** hoonetorg has quit IRC | 06:14 | |
| *** masuberu has joined #openstack-keystone | 06:27 | |
| *** masber has quit IRC | 06:29 | |
| *** hoonetorg has joined #openstack-keystone | 06:31 | |
| *** pcaruana has joined #openstack-keystone | 06:37 | |
| *** martinus__ has joined #openstack-keystone | 06:46 | |
| *** Dinesh_Bhor has quit IRC | 06:48 | |
| *** lifeless has quit IRC | 06:50 | |
| *** lifeless has joined #openstack-keystone | 06:56 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 06:58 | |
| *** apple01 has joined #openstack-keystone | 07:01 | |
| *** dikonoor has quit IRC | 07:07 | |
| *** dmellado has joined #openstack-keystone | 07:12 | |
| *** threestrands_ has quit IRC | 07:14 | |
| *** tesseract has joined #openstack-keystone | 07:14 | |
| *** belmoreira has joined #openstack-keystone | 07:15 | |
| *** apple01 has quit IRC | 07:20 | |
| *** apple01 has joined #openstack-keystone | 07:23 | |
| *** mujahidali has quit IRC | 07:29 | |
| *** apple01 has quit IRC | 07:29 | |
| *** apple01 has joined #openstack-keystone | 07:39 | |
| *** belmoreira has quit IRC | 07:42 | |
| *** rcernin has quit IRC | 07:42 | |
| *** apple01 has quit IRC | 07:44 | |
| *** apple01 has joined #openstack-keystone | 07:44 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:46 | |
| *** jaosorior has quit IRC | 07:48 | |
| *** lifeless has quit IRC | 07:54 | |
| *** belmoreira has joined #openstack-keystone | 07:54 | |
| *** Dinesh_Bhor has quit IRC | 08:02 | |
| *** rajalokan has joined #openstack-keystone | 08:07 | |
| *** belmoreira has quit IRC | 08:07 | |
| *** belmoreira has joined #openstack-keystone | 08:08 | |
| *** apple01 has quit IRC | 08:22 | |
| *** apple01 has joined #openstack-keystone | 08:29 | |
| *** mvk has quit IRC | 08:31 | |
| *** mvk has joined #openstack-keystone | 08:31 | |
| *** jaosorior has joined #openstack-keystone | 08:32 | |
| *** d0ugal has joined #openstack-keystone | 08:43 | |
| *** d0ugal has quit IRC | 08:43 | |
| *** d0ugal has joined #openstack-keystone | 08:43 | |
| *** sonuk has quit IRC | 08:44 | |
| *** sonuk_ has joined #openstack-keystone | 08:44 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 08:51 | |
| *** rcernin has joined #openstack-keystone | 08:58 | |
| *** belmoreira has quit IRC | 09:03 | |
| *** belmoreira has joined #openstack-keystone | 09:11 | |
| *** markvoelker has quit IRC | 09:15 | |
| *** dikonoor has joined #openstack-keystone | 09:18 | |
| *** pcaruana has quit IRC | 09:23 | |
| *** lifeless has joined #openstack-keystone | 09:24 | |
| *** pcaruana has joined #openstack-keystone | 09:27 | |
| *** s10 has joined #openstack-keystone | 09:33 | |
| *** _nick is now known as yankcrime | 09:35 | |
| *** Dinesh_Bhor has quit IRC | 09:45 | |
| *** pcaruana has quit IRC | 09:54 | |
| *** timothyb89 has quit IRC | 09:56 | |
| *** timothyb89 has joined #openstack-keystone | 09:57 | |
| *** rcernin has quit IRC | 10:10 | |
| *** pcaruana has joined #openstack-keystone | 10:10 | |
| *** gyankum has quit IRC | 10:11 | |
| *** namnh has quit IRC | 10:15 | |
| *** markvoelker has joined #openstack-keystone | 10:16 | |
| *** gongysh has quit IRC | 10:16 | |
| *** belmoreira has quit IRC | 10:20 | |
| *** gongysh has joined #openstack-keystone | 10:21 | |
| *** gongysh has quit IRC | 10:21 | |
| *** jmlowe_ has quit IRC | 10:23 | |
| *** jmlowe has joined #openstack-keystone | 10:23 | |
| *** nicolasbock has joined #openstack-keystone | 10:38 | |
| *** belmoreira has joined #openstack-keystone | 10:49 | |
| *** markvoelker has quit IRC | 10:51 | |
| *** nicolasbock[m] has left #openstack-keystone | 11:06 | |
| *** gyankum has joined #openstack-keystone | 11:24 | |
| *** pcaruana has quit IRC | 11:42 | |
| *** nicolasbock has quit IRC | 11:48 | |
| *** markvoelker has joined #openstack-keystone | 11:48 | |
| *** nicolasbock has joined #openstack-keystone | 11:51 | |
| *** neha_alhat has joined #openstack-keystone | 11:55 | |
| neha_alhat | mordred: Hi | 11:56 |
| *** rajalokan has quit IRC | 11:56 | |
| *** pcaruana has joined #openstack-keystone | 12:02 | |
| *** dikonoor has quit IRC | 12:05 | |
| *** raildo has joined #openstack-keystone | 12:06 | |
| *** sonuk_ has quit IRC | 12:10 | |
| *** edmondsw_ has joined #openstack-keystone | 12:11 | |
| *** markvoelker has quit IRC | 12:21 | |
| neha_alhat | cmurphy: Hi | 12:21 |
| cmurphy | neha_alhat: it's good practice to provide some context for what you need when you try to get someone's attention https://blogs.gnome.org/markmc/2014/02/20/naked-pings/ | 12:23 |
| cmurphy | i'm in a meeting but if you provide context it could be that someone else is around who can help :) | 12:27 |
| *** mvenesio has joined #openstack-keystone | 12:32 | |
| *** Alexey_Abashkin has joined #openstack-keystone | 12:33 | |
| *** AlexeyAbashkin has quit IRC | 12:36 | |
| *** Alexey_Abashkin is now known as AlexeyAbashkin | 12:36 | |
| neha_alhat | cmurphy: Actually I want to know why these parameters are registered in keystonemiddleware and also in keystoneauth. https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_opts.py#L88-L95 | 12:39 |
| neha_alhat | cmurphy: do you hav any idea? | 12:39 |
| neha_alhat | cmurphy: in keystoneauth it is registered here: https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/loading/session.py#L170 | 12:41 |
| *** dklyle has quit IRC | 12:42 | |
| *** belmoreira has quit IRC | 12:43 | |
| *** dikonoor has joined #openstack-keystone | 12:50 | |
| openstackgerrit | Dmitry Tantsur proposed openstack/keystoneauth master: Add optional support for retrying certain HTTP codes https://review.openstack.org/570934 | 12:56 |
| cmurphy | neha_alhat: i think it's because of the comment here https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L919-L922 | 12:58 |
| neha_alhat | cmurphy: Ok | 13:02 |
| *** ayoung has joined #openstack-keystone | 13:10 | |
| hrybacki | o/ | 13:13 |
| *** dikonoor has quit IRC | 13:15 | |
| *** markvoelker has joined #openstack-keystone | 13:17 | |
| *** links has quit IRC | 13:20 | |
| *** dave-mccowan has joined #openstack-keystone | 13:22 | |
| *** markvoelker has quit IRC | 13:22 | |
| *** dave-mcc_ has joined #openstack-keystone | 13:25 | |
| *** dave-mccowan has quit IRC | 13:26 | |
| *** rmascena has joined #openstack-keystone | 13:27 | |
| *** dikonoor has joined #openstack-keystone | 13:28 | |
| *** belmoreira has joined #openstack-keystone | 13:29 | |
| *** raildo has quit IRC | 13:29 | |
| *** lbragstad has joined #openstack-keystone | 13:32 | |
| *** ChanServ sets mode: +o lbragstad | 13:32 | |
| *** mvk has quit IRC | 13:33 | |
| *** markvoelker has joined #openstack-keystone | 13:33 | |
| *** mvk has joined #openstack-keystone | 13:33 | |
| *** glb has joined #openstack-keystone | 13:40 | |
| *** apple01 has quit IRC | 13:41 | |
| *** apple01 has joined #openstack-keystone | 13:42 | |
| *** edmondsw_ is now known as edmondsw | 13:42 | |
| *** r-daneel has joined #openstack-keystone | 13:52 | |
| *** dave-mcc_ has quit IRC | 13:54 | |
| *** dave-mccowan has joined #openstack-keystone | 13:56 | |
| *** jroll has quit IRC | 14:01 | |
| *** jroll has joined #openstack-keystone | 14:02 | |
| *** apple01 has quit IRC | 14:18 | |
| *** apple01 has joined #openstack-keystone | 14:19 | |
| *** dave-mcc_ has joined #openstack-keystone | 14:19 | |
| *** felipemonteiro has joined #openstack-keystone | 14:20 | |
| *** dave-mccowan has quit IRC | 14:21 | |
| *** markvoelker has quit IRC | 14:24 | |
| *** s10 has quit IRC | 14:25 | |
| *** markvoelker has joined #openstack-keystone | 14:26 | |
| *** felipemonteiro has quit IRC | 14:28 | |
| *** markvoelker has quit IRC | 14:30 | |
| *** lifeless_ has joined #openstack-keystone | 14:31 | |
| *** lifeless has quit IRC | 14:32 | |
| *** apple01 has quit IRC | 14:32 | |
| *** spilla has joined #openstack-keystone | 14:34 | |
| *** jistr is now known as jistr|mtg | 14:36 | |
| *** felipemonteiro has joined #openstack-keystone | 14:40 | |
| knikolla | o/ | 14:42 |
| gagehugo | o/ | 14:47 |
| *** wxy| has joined #openstack-keystone | 14:48 | |
| *** felipemonteiro has quit IRC | 14:50 | |
| *** felipemonteiro has joined #openstack-keystone | 14:51 | |
| *** jistr|mtg is now known as jistr | 14:52 | |
| *** felipemonteiro_ has joined #openstack-keystone | 14:54 | |
| lbragstad | o/ | 14:56 |
| *** felipemonteiro has quit IRC | 14:58 | |
| *** felipemonteiro_ is now known as felipemonteiro | 14:59 | |
| hrybacki | uhoh keystone cores: https://review.openstack.org/#/c/570940/1/reference/principles.rst | 15:00 |
| cmurphy | I think the keystone team has a pretty good culture of not nitpicking :) | 15:04 |
| knikolla | gotta love that nitpicking in a patch about not nitpicking | 15:05 |
| lbragstad | i'd say most, if not all, folks here are pretty good with follow-on patches | 15:05 |
| hrybacki | it's fun to tease all the same ;) | 15:05 |
| hrybacki | I think the keystone team has a pretty good culture in general | 15:06 |
| cmurphy | <3 | 15:06 |
| *** apple01 has joined #openstack-keystone | 15:09 | |
| lbragstad | i have recording after recording queued... there is more to catch up on than i thought | 15:10 |
| *** gyee has joined #openstack-keystone | 15:10 | |
| *** mvenesio has quit IRC | 15:10 | |
| *** dave-mcc_ is now known as dave-mccowan | 15:13 | |
| *** dklyle has joined #openstack-keystone | 15:15 | |
| * hrybacki needs to remember to read everyones' blog this week | 15:17 | |
| * cmurphy furiously blogwriting | 15:18 | |
| cmurphy | so many notes | 15:18 |
| *** mvk has quit IRC | 15:19 | |
| *** mvk has joined #openstack-keystone | 15:20 | |
| *** apple01 has quit IRC | 15:21 | |
| *** apple01 has joined #openstack-keystone | 15:21 | |
| *** felipemonteiro has quit IRC | 15:23 | |
| *** felipemonteiro has joined #openstack-keystone | 15:24 | |
| *** lifeless_ has quit IRC | 15:24 | |
| *** apple01 has quit IRC | 15:36 | |
| *** belmoreira has quit IRC | 15:37 | |
| lbragstad | yeah - i'm in the same boat... trying to get the pictures and words out of my head and on paper.... | 15:42 |
| lbragstad | hrybacki: do you have a patch up for the role name bits? | 15:43 |
| lbragstad | for the default roles stuff? | 15:43 |
| hrybacki | the follow-up? I will today | 15:43 |
| lbragstad | ok - just making sure i didn't miss it | 15:43 |
| hrybacki | we landed on Jack, Johny, and Jane, right? | 15:43 |
| hrybacki | kmalloc: ^^ | 15:43 |
| gagehugo | thought it was Alice, Bob, and Eve | 15:47 |
| kmalloc | hrybacki: "jack, johnny, and the "Grady Twins" *shiftyeyes* | 15:48 |
| *** AlexeyAbashkin has quit IRC | 15:49 | |
| openstackgerrit | Raildo Mascena proposed openstack/keystone master: [WIP] - Exposing bug/1754677 https://review.openstack.org/570438 | 16:02 |
| *** fiddletw_ has joined #openstack-keystone | 16:14 | |
| *** fiddletw_ has quit IRC | 16:19 | |
| *** fiddletwix has joined #openstack-keystone | 16:19 | |
| *** fiddletwix has quit IRC | 16:20 | |
| *** fiddletwix has joined #openstack-keystone | 16:21 | |
| *** pcichy has quit IRC | 16:21 | |
| *** mvenesio has joined #openstack-keystone | 16:28 | |
| *** dikonoor has quit IRC | 16:34 | |
| *** mvenesio has quit IRC | 16:39 | |
| *** pcaruana has quit IRC | 16:39 | |
| *** mvenesio has joined #openstack-keystone | 16:39 | |
| kmalloc | oh wow, flask middleware is so very much easier to work with than webob things. | 16:46 |
| * kmalloc rips apart some silly middleware we have. | 16:46 | |
| *** rmascena is now known as raildo | 16:50 | |
| *** markvoelker has joined #openstack-keystone | 16:52 | |
| *** markvoelker_ has joined #openstack-keystone | 16:53 | |
| *** eandersson has quit IRC | 16:53 | |
| *** markvoelker has quit IRC | 16:57 | |
| *** r-daneel has quit IRC | 16:59 | |
| lbragstad | knikolla: i have you down first thing next week to go through the proxy call stuff | 17:01 |
| knikolla | ack | 17:01 |
| lbragstad | #startmeeting keystone-office-hours | 17:02 |
| openstack | Meeting started Tue May 29 17:02:15 2018 UTC and is due to finish in 60 minutes. The chair is lbragstad. Information about MeetBot at http://wiki.debian.org/MeetBot. | 17:02 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 17:02 |
| openstack | The meeting name has been set to 'keystone_office_hours' | 17:02 |
| *** wxy| has quit IRC | 17:02 | |
| * knikolla goes to grab lunch | 17:02 | |
| * gagehugo ditto | 17:03 | |
| hrybacki | tritto | 17:05 |
| *** dklyle has quit IRC | 17:12 | |
| lbragstad | quaditto | 17:17 |
| *** prashkre has joined #openstack-keystone | 17:32 | |
| *** pcichy has joined #openstack-keystone | 17:39 | |
| *** pcaruana has joined #openstack-keystone | 17:43 | |
| *** r-daneel has joined #openstack-keystone | 17:48 | |
| *** jaosorior has quit IRC | 17:49 | |
| openstackgerrit | Harry Rybacki proposed openstack/keystone-specs master: Follow-up -- replace 'auditor' role with 'reader' https://review.openstack.org/570990 | 17:55 |
| hrybacki | lbragstad: ^^ | 17:55 |
| lbragstad | sweet | 17:55 |
| *** prashkre has quit IRC | 17:59 | |
| *** gyankum has quit IRC | 18:02 | |
| *** prashkre has joined #openstack-keystone | 18:05 | |
| *** prashkre_ has joined #openstack-keystone | 18:07 | |
| *** prashkre has quit IRC | 18:10 | |
| ayoung | knikolla, I think your proxy and Istio are covering similar ground. What I am wondering is what the API would look like for Proxy to consume | 18:22 |
| ayoung | lbragstad, did you go to https://www.youtube.com/watch?time_continue=143&v=x9PhSDg4k6M ? Its pretty much Dynamic Policy reborn...how many years ago was that? | 18:23 |
| lbragstad | i didn't go to the one | 18:23 |
| *** eschwartz has quit IRC | 18:23 | |
| lbragstad | i had a conflict with something else i think | 18:23 |
| *** ztrawhcse has joined #openstack-keystone | 18:24 | |
| lbragstad | it was on my schedule to watch later though | 18:24 |
| *** prashkre_ has quit IRC | 18:25 | |
| ayoung | lbragstad, just watched through it. Basically, a service prior to Keystone that update multiple un-synced keystones | 18:25 |
| knikolla | ayoung: what API are you referring to? | 18:25 |
| ayoung | hub and spoke model | 18:25 |
| ayoung | knikolla, the cross-project access thing | 18:26 |
| *** ztrawhcse is now known as eschwartz | 18:26 | |
| ayoung | if a user from one project needs to access a resource in another and has to get a new token, its kinda yucky | 18:26 |
| knikolla | ayoung: the normal openstack APIs. the proxy is transparent. | 18:26 |
| ayoung | knikolla, right now it is K2K, but using the users creds | 18:26 |
| knikolla | ayoung: the proxy just goes through all the projects the user has access to | 18:27 |
| ayoung | I guess that would be more like get the resource, find what proejct it is, and request a token for that project..all done by the proxy? | 18:27 |
| knikolla | ayoung: yes. | 18:27 |
| ayoung | might have some scale issues there. I would rather know which project a-priori....somehow | 18:28 |
| knikolla | ayoung: caching works | 18:28 |
| knikolla | go where it was last time | 18:28 |
| knikolla | or there might be a push model by listening through the messagebus for notifications of creations | 18:29 |
| ayoung | knikolla, like a symlink | 18:29 |
| ayoung | knikolla, lets use the volume mount as the example | 18:29 |
| ayoung | P1 holds the Vm | 18:29 |
| ayoung | P2 holds the volume | 18:29 |
| ayoung | Ideally, I would add a symlink in P1 to the volume | 18:30 |
| ayoung | a placeholder that says "when you get this resource, go to P2 to get it" | 18:30 |
| knikolla | so explicit instead of implicit by searching for it? | 18:30 |
| ayoung | but...it should be at the keystone level | 18:30 |
| ayoung | knikolla, what if we tagged the P1 project itself | 18:30 |
| *** tesseract has quit IRC | 18:30 | |
| ayoung | "additional resources located in P2" | 18:31 |
| knikolla | ayoung: maybe do this at the level above in the project hierarchy | 18:31 |
| ayoung | knikolla, its not a strict hierarchy thing | 18:32 |
| ayoung | should be a hint: not enforcing RBAC, | 18:32 |
| ayoung | its almost like a shadow service catalog | 18:33 |
| knikolla | ayoung: but it makes things easier to understand. and provides a cleaner way to implement granularity by subdiving a project. | 18:33 |
| ayoung | "get Network from PN, Storage from PS, IMage from PI" | 18:33 |
| *** markvoelker_ has quit IRC | 18:33 | |
| ayoung | and...yes, you should be able to tag that on a parent project and have it inherited down | 18:34 |
| knikolla | ayoung: same thing but with different clouds and you have the open cloud exchange we want. | 18:34 |
| ayoung | knikolla, ooooooh | 18:34 |
| *** eschwartz has quit IRC | 18:35 | |
| ayoung | so...part of it could be the Auth URL for the remote project | 18:35 |
| knikolla | ayoung: it's in the keystone service catalog. all service providers are there. | 18:35 |
| ayoung | knikolla, but in this case it would be a pointer to the SP | 18:35 |
| ayoung | like "on this project, for networkm, us SP1:PN | 18:36 |
| ayoung | use | 18:36 |
| ayoung | project level hints | 18:36 |
| knikolla | like a local project symlinking to a remote cloud's project? | 18:36 |
| ayoung | 'zactly! | 18:36 |
| knikolla | i've called these sister-projects during presentations. | 18:37 |
| ayoung | knikolla, do you have a formal proposal for how to annotate the sister-projects? | 18:38 |
| *** pcaruana has quit IRC | 18:39 | |
| *** lbragstad has quit IRC | 18:39 | |
| knikolla | ayoung: no I don't. In my notes I have "scope to a project with the same name as the local one, on the domain assigned to the IdP". | 18:40 |
| *** ztrawhcse has joined #openstack-keystone | 18:40 | |
| ayoung | knikolla, OK...starting another etherpad for this | 18:40 |
| ayoung | https://etherpad.openstack.org/p/sister-projects | 18:40 |
| *** felipemonteiro_ has joined #openstack-keystone | 18:40 | |
| *** ztrawhcse is now known as eschwartz | 18:41 | |
| *** markvoelker has joined #openstack-keystone | 18:42 | |
| *** dtruong_ has joined #openstack-keystone | 18:43 | |
| knikolla | ayoung: minus the annotation stuff (proxy goes everywhere searching for stuff), the cross-attaching thing works already. | 18:44 |
| *** felipemonteiro has quit IRC | 18:44 | |
| ayoung | knikolla, ++ | 18:45 |
| *** pcichy_ has joined #openstack-keystone | 18:45 | |
| ayoung | knikolla, this could be big | 18:45 |
| *** spilla has quit IRC | 18:46 | |
| ayoung | knikolla, I think we have the topic for our Berlin presentation | 18:46 |
| knikolla | ayoung: what's different this time than the other times I proposed this? | 18:46 |
| ayoung | "We've done unspeakable things with Keystone" | 18:46 |
| ayoung | knikolla, the fact that we can use it inside a single openstack deployment for one | 18:47 |
| ayoung | the annotations for second | 18:47 |
| ayoung | and constant repitition to beat it through people's heads, of course | 18:47 |
| *** timothyb89_ has joined #openstack-keystone | 18:47 | |
| ayoung | we call it keystone-istio to get people's attention, too | 18:47 |
| ayoung | its real service mesh type stuff | 18:47 |
| *** weezhard_ has joined #openstack-keystone | 18:48 | |
| *** felipemonteiro_ has quit IRC | 18:51 | |
| *** felipemonteiro_ has joined #openstack-keystone | 18:51 | |
| *** jmccrory_ has joined #openstack-keystone | 18:51 | |
| *** pcichy has quit IRC | 18:52 | |
| *** timothyb89 has quit IRC | 18:52 | |
| *** weezhard has quit IRC | 18:52 | |
| *** dtruong has quit IRC | 18:53 | |
| *** jmccrory has quit IRC | 18:53 | |
| *** pcichy_ is now known as pcichy | 18:53 | |
| *** jmccrory_ is now known as jmccrory | 18:53 | |
| *** lbragstad has joined #openstack-keystone | 19:00 | |
| *** ChanServ sets mode: +o lbragstad | 19:00 | |
| *** Guest32198 is now known as melwitt | 19:06 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 19:06 | |
| *** AlexeyAbashkin has quit IRC | 19:10 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 19:11 | |
| *** dave-mccowan has quit IRC | 19:12 | |
| knikolla | ayoung: istio is more about connecting apps though, right? | 19:13 |
| ayoung | knikolla, its about any app to app communication, and used for multiple use cases. pretty much all cross cutting concernts | 19:14 |
| ayoung | access control, Denial of Service control, bl;ue/green deployments | 19:15 |
| ayoung | it is a proxy layer. those are typically used for 3 things | 19:15 |
| ayoung | security, lazy load, remote access | 19:15 |
| ayoung | https://en.wikipedia.org/wiki/Proxy_pattern#Possible_Usage_Scenarios | 19:16 |
| ayoung | logging is often done that way, too | 19:16 |
| knikolla | i have concerns on performance for a generic app proxy with python. the openstack-service to openstack-service use case is slightly different since they are terribly slow anyway. | 19:17 |
| ayoung | knikolla, Istio is in Go | 19:18 |
| *** markvoelker has quit IRC | 19:18 | |
| ayoung | kmalloc, who makes your 1/4 rack? | 19:18 |
| knikolla | ayoung: you want to adopt istio or make what we have more similar to istio? | 19:19 |
| kmalloc | ayoung: startach | 19:19 |
| kmalloc | ayoung: or something like that, sec | 19:19 |
| *** markvoelker has joined #openstack-keystone | 19:19 | |
| ayoung | https://www.amazon.com/12U-4-Post-Open-Rack/dp/B0037ECAJA kmalloc | 19:19 |
| kmalloc | ayoung: https://www.amazon.com/gp/product/B00P1RJ9LS/ref=oh_aui_search_detailpage?ie=UTF8&psc=1 | 19:19 |
| kmalloc | same thing, different seller | 19:20 |
| ayoung | kmalloc, ah even better price tho | 19:20 |
| kmalloc | yup | 19:20 |
| kmalloc | they make a few options, up to 42U | 19:20 |
| kmalloc | do not get the 2-post or the 2-post-HD. wont work for you | 19:21 |
| ayoung | kmalloc, these the shelve rails | 19:21 |
| ayoung | https://www.amazon.com/NavePoint-Adjustable-Mount-Server-Shelves/dp/B0060RUVBA/ref=pd_lutyp_sspa_dk_typ_pt_comp_1_6?_encoding=UTF8&pd_rd_i=B0060RUVBA&pd_rd_r=736717d5-d9cf-40f1-a796-f73d9ba525bc&pd_rd_w=4OmZr&pd_rd_wg=wiOng&pf_rd_i=desktop-typ-carousels&pf_rd_m=ATVPDKIKX0DER&pf_rd_p=8337014667200814173&pf_rd_r=8M47S57ND2AEMDDDBMQF&pf_rd_s=desktop-typ-carousels&pf_rd_t=40701&psc=1&refRID=8M47S57ND2AEMDDDBMQF | 19:21 |
| *** markvoelker has quit IRC | 19:22 | |
| kmalloc | ayoung: i used https://www.amazon.com/gp/product/B00TCELZTK for the UPS, you can also get https://www.amazon.com/gp/product/B0013KCLQC for heavier items | 19:22 |
| kmalloc | the full shelf is VERY nice. | 19:22 |
| ayoung | I think for the poweredges I want the rail version | 19:23 |
| kmalloc | sure, be wary though, some of the rail versons don't play well with server cases, they consume just enough (~1-2mm) space that the servers scrape | 19:24 |
| kmalloc | so measure your servers and make sure you have a few mm on either side where the rails would normally go | 19:24 |
| kmalloc | shouldn't really be an issue with any "real" server with rail mount points | 19:24 |
| kmalloc | but.... | 19:24 |
| kmalloc | ymmv | 19:25 |
| ayoung | understood | 19:25 |
| ayoung | what about these: | 19:25 |
| ayoung | https://www.amazon.com/dp/B00JQYUI7G/ref=sspa_dk_detail_6?psc=1&pd_rd_i=B00JQYUI7G&pd_rd_wg=yrH6s&pd_rd_r=XHT079H16NRJYSZAQ9ER&pd_rd_w=hzj5S | 19:25 |
| kmalloc | i don't see how those would work for anything | 19:26 |
| kmalloc | not surew what the heck those even are | 19:26 |
| ayoung | yeah...thought they were rails at first | 19:26 |
| knikolla | ayoung: ping again, you are thinking of adopting istio or morphing what we already have in mixmatch to be more like istio? | 19:31 |
| ayoung | knikolla, I'm still digesting what I saw at the summit | 19:31 |
| ayoung | I think we need something like Istio | 19:31 |
| ayoung | whether that is Istio or your proxy or something else yet is unclear | 19:31 |
| knikolla | ack | 19:32 |
| ayoung | knikolla, I think that the proxuy technology is one question, and what APIs Keystone needs to support it is a second related one | 19:33 |
| *** lifeless has joined #openstack-keystone | 19:34 | |
| *** AlexeyAbashkin has quit IRC | 19:34 | |
| knikolla | ayoung: it depends how many birds are you trying to hit | 19:34 |
| knikolla | i have something that fits the openstack-service to openstack-service | 19:34 |
| knikolla | which probably won't work with app to app. | 19:35 |
| ayoung | knikolla, take some time to look at Istio, and tell me if it is an effort you could support. | 19:36 |
| knikolla | ayoung: i'll play around with it. | 19:37 |
| ayoung | knikolla, TYVM | 19:37 |
| knikolla | it was about time i learned Go. :/ | 19:45 |
| *** felipemonteiro_ has quit IRC | 19:49 | |
| *** markvoelker has joined #openstack-keystone | 19:49 | |
| *** markvoelker_ has joined #openstack-keystone | 19:50 | |
| *** felipemonteiro has joined #openstack-keystone | 19:51 | |
| *** markvoelker has quit IRC | 19:54 | |
| *** harlowja has joined #openstack-keystone | 20:00 | |
| *** homeski has joined #openstack-keystone | 20:01 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 20:20 | |
| *** AlexeyAbashkin has quit IRC | 20:25 | |
| *** pcichy has quit IRC | 20:27 | |
| *** mvenesio has quit IRC | 20:29 | |
| *** mvenesio has joined #openstack-keystone | 20:30 | |
| *** mvenesio_ has joined #openstack-keystone | 20:33 | |
| *** spilla has joined #openstack-keystone | 20:34 | |
| *** r-daneel has quit IRC | 20:34 | |
| *** mvenesio has quit IRC | 20:34 | |
| *** r-daneel has joined #openstack-keystone | 20:34 | |
| *** mvenesio_ has quit IRC | 20:37 | |
| rm_work | keystone seems to do hard-deletes on projects in the DB -- is that a correct assessment? and if so, is there any way to make it do soft-deletes, or any specific reason it wasn't done that way? | 20:42 |
| *** jmlowe has quit IRC | 20:42 | |
| lbragstad | rm_work: we support disabling projects, which does just about the same thing you'd expect a soft delete to do | 20:42 |
| rm_work | ok | 20:42 |
| rm_work | so it may just be a "using it wrong" issue | 20:43 |
| lbragstad | if you disable a project, users can't authenticate to it, use it, etc... | 20:43 |
| rm_work | k | 20:43 |
| *** jmlowe has joined #openstack-keystone | 20:44 | |
| *** martinus__ has quit IRC | 21:00 | |
| *** StefanPaetowJisc has joined #openstack-keystone | 21:03 | |
| *** raildo has quit IRC | 21:03 | |
| *** edmondsw has quit IRC | 21:13 | |
| rm_work | lbragstad: the issue we're trying to solve is around orphaned objects -- keystone projects get deleted and we have servers and stuff that we now can't see who owned them | 21:13 |
| lbragstad | yeah - that's a problem | 21:13 |
| rm_work | but if we can't control exactly what users do -- i feel like we should be able to enforce soft-delete (disable) only | 21:13 |
| lbragstad | one thing that might help | 21:13 |
| rm_work | like i'd be tempted to locally patch the delete call to just set the disabled flag instead | 21:14 |
| rm_work | if `soft_delete = True` or something in config | 21:14 |
| lbragstad | what if your delete flow does a disable first? | 21:14 |
| rm_work | i mean this is like | 21:14 |
| rm_work | end-users delete a project | 21:15 |
| rm_work | it's not really something we control, unless we refuse project deletes based on policy | 21:15 |
| lbragstad | then consume the notification from keystone about the disabled project and clean things up before you delete it | 21:15 |
| rm_work | which is just confusing for everyone involved | 21:15 |
| lbragstad | that was one of the main reasons we implemented notification support in keystone | 21:16 |
| rm_work | ok well isn't that still a patch to keystone we'd have to do? | 21:16 |
| rm_work | to change the "delete" call to do a disable first? | 21:16 |
| lbragstad | no - more like horizon, but still a patch somewhere, yes | 21:16 |
| rm_work | I can't control what John Doe CloudUser does with his projects | 21:16 |
| rm_work | we don't use horizon, just API | 21:16 |
| rm_work | and the issue is when random end-users create projects, use them, and then delete them with resources still on them | 21:17 |
| rm_work | via the API | 21:17 |
| lbragstad | the idea was that keystone would emit notifications about state changes for projects, then other services would subscribe to the queue | 21:17 |
| lbragstad | it could see the notification come in via the message bus (which still isn't ideal... but) | 21:17 |
| lbragstad | pull the project id out of the payload | 21:17 |
| lbragstad | and clean up instances/volumes accordingly | 21:18 |
| rm_work | so we should be listening to the keystone notifications and deleting everything that exists for projects based on their ID? (this sounds like a Reaper related thing) | 21:18 |
| rm_work | but that's ... really not what we want, I think. what we want is just a soft-delete <_< | 21:18 |
| lbragstad | even if you have a soft delete, something has to do the clean up | 21:19 |
| rm_work | I guess we could have something listen to the notifications, and for each deleted project it sees, just archive that to another table or something | 21:19 |
| lbragstad | right? | 21:19 |
| rm_work | not necessarily | 21:19 |
| rm_work | sometimes it's because someone left the company and we need to reassign their stuff to another project, or deal with it intelligently at least | 21:19 |
| rm_work | rather than blindly wipe everything out | 21:19 |
| rm_work | or just someone does something dumb | 21:19 |
| rm_work | and we need to undo it | 21:19 |
| rm_work | and it's a lot easier to undo an accidental project delete, than wiping out all resources in the cloud for that project :P | 21:20 |
| rm_work | or rather | 21:20 |
| rm_work | it's a lot easier to undo an accidental project delete *when all it did is remove one DB record*, as opposed to issuing cascading deletes to all services in the cloud for all objects | 21:21 |
| lbragstad | i'm hearing two different use cases here | 21:21 |
| rm_work | you're not wrong i guess | 21:22 |
| lbragstad | 1.) you want to clean up orphaned objects in certain cases | 21:22 |
| lbragstad | 2.) and transfer of ownership | 21:22 |
| rm_work | well, we don't want it automated in ANY case | 21:22 |
| rm_work | we want to be able to deal with it later | 21:22 |
| rm_work | in all cases | 21:22 |
| lbragstad | sure | 21:22 |
| rm_work | just that the way projects get deleted might be different | 21:22 |
| rm_work | but in all cases, what we want is them to be soft-deleted | 21:22 |
| rm_work | and not clean up anything | 21:23 |
| rm_work | the issue is not that the orphans exist | 21:23 |
| rm_work | it's that we can't tell who they used to belong to | 21:23 |
| rm_work | for auditing purposes, or making a decision on cleanup | 21:23 |
| lbragstad | kmalloc: has opinions on this, and we were going to discuss it in YVR but i'm not sure we did | 21:24 |
| rm_work | just seems like soft-delete is done in most places, except keystone (and maybe neutron?) | 21:25 |
| lbragstad | if you had a soft delete capability in keystone, how would you expect it to work differently from disable? | 21:25 |
| rm_work | i'm not sure i would | 21:25 |
| rm_work | i mean i would probably literally implement it as "if CONF.soft_delete: disable; else: delete" | 21:26 |
| rm_work | you COULD go a little further and have a deleted flag... and just use that as a sort of explicit filter (?show_deleted=true) | 21:26 |
| lbragstad | so - why not restrict project deletion to system administrators and just leave disable available to customers | 21:27 |
| rm_work | but i don't know if that's necessary | 21:27 |
| rm_work | lbragstad: that's what i mentioned earlier as the only solution i could think of | 21:27 |
| lbragstad | right | 21:27 |
| rm_work | but it seems like a bad solution just because as an outlier it is very confusing to people | 21:27 |
| rm_work | but yes, we could do that | 21:27 |
| lbragstad | if your users can disable/enable and not delete - then you can manually do whatever you need to as a system admin | 21:27 |
| *** r-daneel has quit IRC | 21:28 | |
| rm_work | not sure how many thousands of workflows we'd break | 21:28 |
| *** r-daneel has joined #openstack-keystone | 21:28 | |
| lbragstad | would those workflows still break if you had CONF.soft_delete? | 21:28 |
| rm_work | which seems like the main blocker, because if we did that there's a good chance whoever ok'd it would be fired :P | 21:28 |
| rm_work | no | 21:28 |
| rm_work | because it would still say "204 OK" or whatever | 21:28 |
| rm_work | and then ideally be filtered from API lists | 21:29 |
| rm_work | (by default) | 21:29 |
| rm_work | the same as how every other soft-delete that i'm aware of works | 21:29 |
| rm_work | basically it just pretends to delete, unless you really go digging | 21:29 |
| rm_work | so from a typical user's perspective, they couldn't tell the difference | 21:30 |
| rm_work | but it doesn't remove the DB entry and throw a wrench in auditing | 21:30 |
| rm_work | a quick fix for us could be like, throw a delete-trigger on the project table and have it archive -- at least we could look them up later if we HAD to <_< right now even that isn't possible. sometimes we get lucky looking through backups if the project was long-lived... | 21:31 |
| rm_work | ^^ but that is dumb and i would never actually do that (it's just an example) | 21:32 |
| rm_work | I'm honestly surprised this hasn't come up frequently | 21:32 |
| lbragstad | it has | 21:33 |
| lbragstad | very often actually | 21:33 |
| lbragstad | https://www.lbragstad.com/blog/improving-auditing-in-keystone | 21:33 |
| rm_work | k | 21:35 |
| rm_work | basically yes, that seems right | 21:35 |
| rm_work | but I wouldn't say it's *too* heavy handed | 21:36 |
| lbragstad | it would be a lot of work to our API | 21:38 |
| rm_work | it seems like the work would be more on the backends side | 21:39 |
| rm_work | for the API wouldn't you just have to add another query param? | 21:39 |
| rm_work | like "show_deleted"? | 21:39 |
| lbragstad | yeah - we'd probably need to support something like that | 21:39 |
| lbragstad | and implement soft deletes for all keystone resources, mainly for consistency | 21:39 |
| rm_work | yeah that expands the scope of things a little, but i don't think you're wrong | 21:40 |
| lbragstad | (i can imagine it being frustrating to have projects soft delete but not something else like users or groups) | 21:40 |
| rm_work | i still think it's something that's needed. | 21:40 |
| lbragstad | we'd also need to double check the api with HMT | 21:40 |
| rm_work | but i guess maybe there aren't enough people that agree with my opinion for it to have happened | 21:41 |
| *** felipemonteiro has quit IRC | 21:41 | |
| rm_work | which means it probably won't any time soon, unless I go do it :P (and then get agreement from enough cores to accept the patches) | 21:41 |
| lbragstad | i don't think people is disagreeing with you, but no one has really stepped up to do the work | 21:41 |
| lbragstad | s/is/are/ | 21:41 |
| rm_work | so you think if it was done, no one would object to merging? | 21:41 |
| lbragstad | the last time i discussed it around the Newton time frame, people were only opposed to the dev resource aspect of it | 21:42 |
| rm_work | k | 21:42 |
| lbragstad | and making sure if we did it, it was done consistently | 21:42 |
| lbragstad | afaik | 21:42 |
| rm_work | noted | 21:42 |
| lbragstad | i don't think people had super strong opinions on saying absolutely not to soft-deletes | 21:42 |
| lbragstad | s/not/no/ | 21:43 |
| lbragstad | wow - typing is really hard | 21:43 |
| rm_work | it can be, yes :P | 21:43 |
| lbragstad | that was the main purpose of the post that i wrote | 21:43 |
| lbragstad | i think the use case for auditing is important, but at the time those were the three options that were clear to me | 21:43 |
| lbragstad | based on my discussions with various people | 21:44 |
| lbragstad | but - yeah... it's an important use case and I get it, but i also know kmalloc and ayoung have a bunch of thoughts on this | 21:46 |
| lbragstad | i wouldn't be opposed to discussing it again, and seeing if we can do something to Stein or T | 21:47 |
| lbragstad | discussing it as a larger group* | 21:47 |
| rm_work | yeah, I mean, I'll be in Denver | 21:47 |
| lbragstad | for the PTG? | 21:47 |
| rm_work | yeah | 21:48 |
| rm_work | if we want to discuss it then | 21:48 |
| lbragstad | sure | 21:48 |
| lbragstad | we can throw it on the meeting agenda to for next week | 21:48 |
| lbragstad | if you feel like getting more feedback sooner than september | 21:48 |
| *** mvk has quit IRC | 21:50 | |
| rm_work | what time are your meetings? | 21:50 |
| lbragstad | https://etherpad.openstack.org/p/keystone-weekly-meeting | 21:51 |
| lbragstad | 1600 UTC on tuesdays | 21:51 |
| lbragstad | so - 11:00 AM central | 21:51 |
| lbragstad | rm_work: are you based in texas? | 21:51 |
| rm_work | not anymore | 21:52 |
| rm_work | kinda ... nomadic | 21:52 |
| lbragstad | ack - i wasn't sure | 21:52 |
| rm_work | yeah after I left castle, I go all over :P | 21:52 |
| lbragstad | cool | 21:52 |
| lbragstad | well - we can throw it on the agenda for next week if you'll be around | 21:53 |
| lbragstad | otherwise, the use case seems straight-forward enough to kickstart on the mailing list | 21:53 |
| rm_work | yeah we could do a quick topic on it I suppose -- I can try to show up for that | 21:57 |
| gyee | lbragstad, I supposed we don't support directly mapping a federated user into a domain admin (domain-scoped token) do we? It's been awhile since I looked that piece of code. Just curious if anything has changed. | 21:57 |
| rm_work | just for feedback purposes -- though whether or not it is important enough to us to get resources on it anytime soon is another question | 21:57 |
| rm_work | which is why i figured PTG would be easier timing | 21:57 |
| *** spilla has quit IRC | 21:57 | |
| lbragstad | gyee: ummm | 21:58 |
| lbragstad | you could map a user into a group with an admin role assignment on a domain | 21:59 |
| lbragstad | but are you asking if trading a SAML assertion for a domain-scoped token works? | 21:59 |
| gyee | but do we directly issued a domain-scoped token as the result of that? | 21:59 |
| gyee | right | 21:59 |
| lbragstad | hnmmm | 21:59 |
| gyee | I don't remember we ever support that | 21:59 |
| lbragstad | gyee: https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_v3_federation.py#L3861 ? | 22:01 |
| lbragstad | oh - wait... | 22:01 |
| lbragstad | nevermind | 22:01 |
| lbragstad | that's an IDP test case | 22:01 |
| gyee | yeah | 22:02 |
| lbragstad | all these tests seem to authenticate for an unscoped token before trading it for a domain-scoped token | 22:02 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_v3_federation.py#L3147 | 22:02 |
| *** StefanPaetowJisc has quit IRC | 22:03 | |
| gyee | right, that's what I thought | 22:03 |
| lbragstad | but part of that flow with horizon is asking which project you want | 22:03 |
| lbragstad | to work on | 22:03 |
| lbragstad | so if it lists domains, horizon might support building a domain-scoped authentication request | 22:04 |
| gyee | let me dive into that code again, someone told me today you can get a domain-scoped token for federation user | 22:04 |
| lbragstad | i feel like this was on the list of things we wanted to improve with horizon a few releases back | 22:04 |
| gyee | but I don't remember ever seeing that functionality | 22:05 |
| lbragstad | cmurphy: _might_ know off the top of her head? | 22:05 |
| lbragstad | i remember she was working on some of that stuff during those joint team meetings between keystone and horizon | 22:05 |
| gyee | k, let me check with her as well | 22:06 |
| gyee | thanks man | 22:06 |
| lbragstad | gyee: no problem, let me know if you hit anything weird | 22:06 |
| lbragstad | #endmeeting | 22:06 |
| openstack | Meeting ended Tue May 29 22:06:32 2018 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 22:06 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/keystone_office_hours/2018/keystone_office_hours.2018-05-29-17.02.html | 22:06 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/keystone_office_hours/2018/keystone_office_hours.2018-05-29-17.02.txt | 22:06 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/keystone_office_hours/2018/keystone_office_hours.2018-05-29-17.02.log.html | 22:06 |
| *** lifeless has quit IRC | 22:07 | |
| ayoung | rm_work, you are singing my song | 22:10 |
| ayoung | gyee! Good to hear from you! | 22:10 |
| ayoung | rm_work, I would support allowing projects being created with a specific ID | 22:11 |
| rm_work | ayoung: so you generally agree with what I am asking for? | 22:11 |
| ayoung | that would give us 2 things | 22:11 |
| ayoung | 1 support for undeleting a project in order to clean up orphaned resourcews | 22:11 |
| ayoung | 2 a way to sync 2 keystones | 22:12 |
| ayoung | the question is what restrictions would we put around it | 22:12 |
| ayoung | I suggested it before, and dolphm thought it was too big an API change, but I still think it is the right thing | 22:12 |
| ayoung | rm_work, I wanted a lot of things over the years | 22:12 |
| rm_work | lol | 22:13 |
| ayoung | like the ability to pre-create Federated users in the databases, and to have their IDs hashed | 22:13 |
| cmurphy | lbragstad: gyee umm i'm not sure off the top of my head | 22:13 |
| cmurphy | it would be easy to test though | 22:13 |
| ayoung | so that the ID is predictable. again, for the multi-keystone case | 22:13 |
| ayoung | which is looking more and more to be the dominant use case | 22:13 |
| gyee | ayoung, yeah, still working on openstack stuff :-) | 22:14 |
| *** rcernin has joined #openstack-keystone | 22:18 | |
| rm_work | so maybe I don't need a meeting topic :) | 22:23 |
| *** lifeless has joined #openstack-keystone | 23:10 | |
| *** lifeless_ has joined #openstack-keystone | 23:23 | |
| *** lifeless has quit IRC | 23:25 | |
| *** cz2 has quit IRC | 23:33 | |
| *** cz2 has joined #openstack-keystone | 23:36 | |
| *** felipemonteiro has joined #openstack-keystone | 23:41 | |
| *** openstackstatus has joined #openstack-keystone | 23:43 | |
| *** ChanServ sets mode: +v openstackstatus | 23:43 | |
| *** felipemonteiro has quit IRC | 23:50 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!