| *** jmlowe has quit IRC | 00:40 | |
| *** germs has joined #openstack-keystone | 00:45 | |
| *** germs has quit IRC | 00:45 | |
| *** germs has joined #openstack-keystone | 00:45 | |
| *** jmlowe has joined #openstack-keystone | 00:45 | |
| *** germs has quit IRC | 00:50 | |
| *** r-daneel has joined #openstack-keystone | 00:52 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 00:54 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Unified limit update APIs Refactor https://review.openstack.org/559552 | 01:06 |
|---|---|---|
| *** gyee has quit IRC | 01:09 | |
| *** lifeless_ has quit IRC | 01:13 | |
| *** lifeless has joined #openstack-keystone | 01:13 | |
| *** lifeless_ has joined #openstack-keystone | 01:24 | |
| *** lifeless has quit IRC | 01:25 | |
| *** lifeless has joined #openstack-keystone | 01:40 | |
| *** lifeless_ has quit IRC | 01:41 | |
| *** markvoelker has joined #openstack-keystone | 01:47 | |
| *** lifeless has quit IRC | 01:54 | |
| *** lifeless has joined #openstack-keystone | 02:00 | |
| *** zxy has quit IRC | 02:03 | |
| *** ayoung has joined #openstack-keystone | 02:20 | |
| *** zxy has joined #openstack-keystone | 02:21 | |
| *** markvoelker has quit IRC | 02:21 | |
| *** fiddletwix has quit IRC | 02:26 | |
| *** boris_42_ has quit IRC | 02:38 | |
| *** germs has joined #openstack-keystone | 02:46 | |
| *** germs has quit IRC | 02:46 | |
| *** germs has joined #openstack-keystone | 02:46 | |
| *** germs has quit IRC | 02:50 | |
| *** germs has joined #openstack-keystone | 02:50 | |
| *** germs has quit IRC | 02:50 | |
| *** germs has joined #openstack-keystone | 02:50 | |
| larsks | Anybody around? I have a question about keystone + horizon + websso, and horizon's OPENSTACK_KEYSTONE_URL setting... | 02:55 |
| larsks | Tripleo sets OPENSTACK_KEYSTONE_URL to the internal api endpoint, but this seems odd because when trying to use sso it appears to redirect the browser to that url, which would suggest it should be using the public endpoint (on the theory that "internal" means "unavaiable outside of the openstack cluster itself") | 02:56 |
| *** germs has quit IRC | 03:00 | |
| *** annp has joined #openstack-keystone | 03:03 | |
| *** d0ugal_ has joined #openstack-keystone | 03:17 | |
| *** d0ugal has quit IRC | 03:17 | |
| *** markvoelker has joined #openstack-keystone | 03:18 | |
| *** david-lyle has joined #openstack-keystone | 03:30 | |
| *** dklyle has quit IRC | 03:32 | |
| *** markvoelker has quit IRC | 03:51 | |
| *** ykarel_ has joined #openstack-keystone | 04:08 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystone master: [WIP] Implement auth receipts spec https://review.openstack.org/572286 | 04:17 |
| *** dmellado has quit IRC | 04:23 | |
| *** stlbigdog has joined #openstack-keystone | 04:23 | |
| adriant | lbragstad, cmurphy, kmalloc: Receipt implementation is ready for cursory review. I've still marked it as [WIP] because I don't yet have unit tests for the provider logic, but the unit tests for MFA workflow and receipt consumption are there and passing. So the provider probably works as intended, but I will of course make dedicated tests for it to | 04:25 |
| adriant | match the similar tests the token provider has. | 04:25 |
| adriant | I've yet to actually test consuming a receipt myself in a working keystone test deployment, but I'll do that next week. I'll get my code working in devstack and see how that goes, but I don't expect issues. | 04:26 |
| *** stlbigdog has quit IRC | 04:31 | |
| *** germs has joined #openstack-keystone | 04:37 | |
| *** germs has quit IRC | 04:37 | |
| *** germs has joined #openstack-keystone | 04:37 | |
| *** germs has quit IRC | 04:41 | |
| *** markvoelker has joined #openstack-keystone | 04:48 | |
| *** links has joined #openstack-keystone | 04:55 | |
| openstackgerrit | Merged openstack/keystone master: Store JSON Home Resources off the composing router https://review.openstack.org/574735 | 05:09 |
| *** nicolasbock has joined #openstack-keystone | 05:14 | |
| *** nicolasbock has quit IRC | 05:18 | |
| *** pcaruana has quit IRC | 05:18 | |
| *** markvoelker has quit IRC | 05:21 | |
| *** ykarel__ has joined #openstack-keystone | 05:50 | |
| *** ykarel_ has quit IRC | 05:53 | |
| cmurphy | adriant: awesome! will try to have a look soon | 06:13 |
| *** Dinesh_Bhor has quit IRC | 06:32 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 06:34 | |
| *** aojea_ has joined #openstack-keystone | 06:36 | |
| *** pcaruana has joined #openstack-keystone | 06:44 | |
| *** martinus__ has joined #openstack-keystone | 06:51 | |
| *** ykarel_ has joined #openstack-keystone | 06:52 | |
| *** ykarel__ has quit IRC | 06:55 | |
| *** ykarel_ is now known as ykarel | 07:07 | |
| *** rcernin has quit IRC | 07:08 | |
| *** germs has joined #openstack-keystone | 07:08 | |
| *** germs has quit IRC | 07:08 | |
| *** germs has joined #openstack-keystone | 07:08 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:13 | |
| *** germs has quit IRC | 07:13 | |
| *** Dinesh_Bhor has quit IRC | 07:13 | |
| *** blake has joined #openstack-keystone | 07:16 | |
| *** tesseract has joined #openstack-keystone | 07:17 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:17 | |
| *** markvoelker has joined #openstack-keystone | 07:18 | |
| *** AlexeyAbashkin has quit IRC | 07:29 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:29 | |
| *** blake_ has joined #openstack-keystone | 07:29 | |
| *** blake has quit IRC | 07:32 | |
| *** blake_ has quit IRC | 07:34 | |
| *** blake has joined #openstack-keystone | 07:34 | |
| *** AlexeyAbashkin has quit IRC | 07:39 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:39 | |
| *** markvoelker has quit IRC | 07:50 | |
| *** aojea_ has quit IRC | 07:53 | |
| *** AlexeyAbashkin has quit IRC | 08:00 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 08:01 | |
| *** d0ugal_ has quit IRC | 08:04 | |
| *** d0ugal has joined #openstack-keystone | 08:04 | |
| *** d0ugal has quit IRC | 08:04 | |
| *** d0ugal has joined #openstack-keystone | 08:04 | |
| *** threestrands has quit IRC | 08:20 | |
| *** Dinesh_Bhor has quit IRC | 08:27 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 08:29 | |
| *** s10 has joined #openstack-keystone | 08:29 | |
| openstackgerrit | wangxiyuan proposed openstack/keystoneauth master: Add minimum verion for requirements https://review.openstack.org/575685 | 08:32 |
| *** AlexeyAbashkin has quit IRC | 08:45 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 08:45 | |
| *** ykarel is now known as ykarel|lunch | 08:47 | |
| *** markvoelker has joined #openstack-keystone | 08:48 | |
| openstackgerrit | wangxiyuan proposed openstack/keystoneauth master: Add minimum version for requirements https://review.openstack.org/575685 | 08:51 |
| *** lifeless has quit IRC | 08:57 | |
| *** blake has quit IRC | 08:59 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Remove a uesless function https://review.openstack.org/575694 | 09:02 |
| *** AlexeyAbashkin has quit IRC | 09:03 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 09:03 | |
| *** germs has joined #openstack-keystone | 09:09 | |
| *** germs has quit IRC | 09:09 | |
| *** germs has joined #openstack-keystone | 09:09 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Remove get_catalog usage from contrib https://review.openstack.org/575696 | 09:10 |
| *** lifeless has joined #openstack-keystone | 09:10 | |
| *** AlexeyAbashkin has quit IRC | 09:12 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 09:13 | |
| *** germs has quit IRC | 09:14 | |
| *** markvoelker has quit IRC | 09:22 | |
| *** AlexeyAbashkin has quit IRC | 09:22 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 09:22 | |
| *** ykarel|lunch is now known as ykarel | 09:25 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Remove get_catalog from manage layer https://review.openstack.org/575704 | 09:30 |
| *** liuzz_ has quit IRC | 09:33 | |
| *** Dinesh_Bhor has quit IRC | 09:34 | |
| *** sapd_ has joined #openstack-keystone | 09:35 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 09:38 | |
| *** lifeless has quit IRC | 09:38 | |
| *** lifeless has joined #openstack-keystone | 09:45 | |
| *** Dinesh_Bhor has quit IRC | 09:47 | |
| *** rcernin has joined #openstack-keystone | 10:06 | |
| *** cristicalin has joined #openstack-keystone | 10:17 | |
| *** markvoelker has joined #openstack-keystone | 10:18 | |
| *** lifeless_ has joined #openstack-keystone | 10:22 | |
| *** lifeless has quit IRC | 10:23 | |
| *** AlexeyAbashkin has quit IRC | 10:24 | |
| *** cristicalin has quit IRC | 10:25 | |
| *** lifeless_ has quit IRC | 10:39 | |
| *** lifeless has joined #openstack-keystone | 10:41 | |
| *** markvoelker has quit IRC | 10:51 | |
| *** lifeless_ has joined #openstack-keystone | 10:55 | |
| *** lifeless has quit IRC | 10:56 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 10:57 | |
| *** raildo has joined #openstack-keystone | 10:59 | |
| *** lifeless has joined #openstack-keystone | 11:00 | |
| *** lifeless_ has quit IRC | 11:01 | |
| *** lifeless has quit IRC | 11:05 | |
| *** germs has joined #openstack-keystone | 11:10 | |
| *** germs has quit IRC | 11:10 | |
| *** germs has joined #openstack-keystone | 11:10 | |
| *** lifeless has joined #openstack-keystone | 11:10 | |
| *** germs has quit IRC | 11:14 | |
| *** lifeless_ has joined #openstack-keystone | 11:15 | |
| *** lifeless has quit IRC | 11:15 | |
| *** annp has quit IRC | 11:16 | |
| *** AlexeyAbashkin has quit IRC | 11:27 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 11:28 | |
| openstackgerrit | Merged openstack/keystone-specs master: Update links in README https://review.openstack.org/574637 | 11:36 |
| *** yikun has quit IRC | 11:43 | |
| *** markvoelker has joined #openstack-keystone | 11:48 | |
| openstackgerrit | Merged openstack/keystone master: Ensure default roles created during bootstrap https://review.openstack.org/572243 | 11:50 |
| *** edmondsw has joined #openstack-keystone | 12:01 | |
| *** markvoelker has quit IRC | 12:03 | |
| *** markvoelker has joined #openstack-keystone | 12:03 | |
| hrybacki | woo openstackgerrit++ | 12:28 |
| *** cristicalin has joined #openstack-keystone | 12:31 | |
| *** cristicalin has quit IRC | 12:33 | |
| openstackgerrit | David Rabel proposed openstack/keystone master: Fix typo in docs https://review.openstack.org/574266 | 12:38 |
| *** AlexeyAbashkin has quit IRC | 12:38 | |
| *** ykarel has quit IRC | 12:39 | |
| *** ykarel has joined #openstack-keystone | 12:39 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 12:40 | |
| openstackgerrit | David Rabel proposed openstack/keystone master: Clarify complicated sentence in docs https://review.openstack.org/574266 | 12:43 |
| *** lifeless_ has quit IRC | 12:46 | |
| *** AlexeyAbashkin has quit IRC | 12:50 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 12:50 | |
| *** rcernin has quit IRC | 13:02 | |
| knikolla | o/ | 13:03 |
| knikolla | larsks: hi there | 13:05 |
| larsks | knikolla: Howdy! | 13:05 |
| larsks | Do I have some questions for you. | 13:06 |
| knikolla | yup, I was reading back the irc logs | 13:06 |
| knikolla | larsks: are you around the office today? | 13:06 |
| larsks | I could be. Are you going to be there? | 13:07 |
| knikolla | yep. i'm usually there everyday | 13:07 |
| larsks | Awesome. I will come on in. Probably I'll arrive a little after 10-ish. | 13:07 |
| knikolla | Cool. I have a meeting 11-1, but except that I should be free. | 13:08 |
| *** germs has joined #openstack-keystone | 13:11 | |
| *** germs has quit IRC | 13:11 | |
| *** germs has joined #openstack-keystone | 13:11 | |
| *** germs has quit IRC | 13:15 | |
| *** dave-mcc_ has joined #openstack-keystone | 13:16 | |
| *** jmlowe has quit IRC | 13:18 | |
| *** r-daneel has quit IRC | 13:20 | |
| *** links has quit IRC | 13:27 | |
| *** ykarel is now known as ykarel|away | 13:31 | |
| knikolla | po kaloj mire | 13:32 |
| knikolla | errr.. wrong window | 13:32 |
| * knikolla facepalm | 13:32 | |
| openstackgerrit | Merged openstack/python-keystoneclient master: fix a typo in docstring https://review.openstack.org/573108 | 13:36 |
| *** dave-mcc_ has quit IRC | 13:39 | |
| *** ykarel|away has quit IRC | 13:40 | |
| lbragstad | kmalloc: knikolla thaks for the ksc reviews! | 13:46 |
| lbragstad | thanks* | 13:46 |
| lbragstad | once https://review.openstack.org/#/c/559552/17 and https://review.openstack.org/#/c/569741/3 merge - we can start getting those client patches in | 13:46 |
| *** dansmith is now known as superdan | 13:47 | |
| *** lbragstad is now known as elbragstad | 13:48 | |
| *** r-daneel has joined #openstack-keystone | 13:50 | |
| *** jmlowe has joined #openstack-keystone | 13:57 | |
| *** AlexeyAbashkin has quit IRC | 14:06 | |
| *** r-daneel_ has joined #openstack-keystone | 14:07 | |
| *** r-daneel has quit IRC | 14:08 | |
| *** r-daneel_ is now known as r-daneel | 14:08 | |
| *** sapd_ has quit IRC | 14:10 | |
| *** sapd has quit IRC | 14:10 | |
| *** dave-mccowan has joined #openstack-keystone | 14:15 | |
| openstackgerrit | David Rabel proposed openstack/keystone master: Clarify complicated sentence in docs https://review.openstack.org/574266 | 14:22 |
| *** mvenesio has joined #openstack-keystone | 14:22 | |
| *** germs has joined #openstack-keystone | 14:23 | |
| *** germs has quit IRC | 14:23 | |
| *** germs has joined #openstack-keystone | 14:23 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 14:58 | |
| *** pcaruana has quit IRC | 15:01 | |
| *** r-daneel has quit IRC | 15:03 | |
| *** r-daneel has joined #openstack-keystone | 15:04 | |
| *** gyee has joined #openstack-keystone | 15:52 | |
| *** Guest54251 has quit IRC | 15:54 | |
| *** Guest54251 has joined #openstack-keystone | 15:54 | |
| *** Guest54251 is now known as awestin1 | 15:55 | |
| *** awestin1 has quit IRC | 15:55 | |
| *** awestin1 has joined #openstack-keystone | 15:55 | |
| *** awestin1 has quit IRC | 15:55 | |
| *** awestin1 has joined #openstack-keystone | 15:55 | |
| *** ykarel|away has joined #openstack-keystone | 16:05 | |
| *** dave-mccowan has quit IRC | 16:06 | |
| *** ayoung has quit IRC | 16:18 | |
| *** jmlowe has quit IRC | 16:23 | |
| *** s10 has quit IRC | 16:24 | |
| *** ayoung has joined #openstack-keystone | 16:25 | |
| *** sonuk_ has joined #openstack-keystone | 16:27 | |
| *** sonuk has quit IRC | 16:30 | |
| *** jmlowe has joined #openstack-keystone | 16:32 | |
| *** r-daneel has quit IRC | 16:33 | |
| *** r-daneel has joined #openstack-keystone | 16:33 | |
| *** ykarel|away has quit IRC | 16:43 | |
| *** spilla has joined #openstack-keystone | 16:49 | |
| *** sonuk has joined #openstack-keystone | 16:49 | |
| *** sonuk_ has quit IRC | 16:52 | |
| hrybacki | lbragstad[m]: when you were porting keystone RuleDefaults->DocumentedRuleDefaults, did you come up with any debugging tricks? I'm porting Barbican atm and the tracebacks provide no insight: https://paste.fedoraproject.org/paste/fwp8~9AqxkV9mextJx97qw | 16:58 |
| elbragstad | looks like a package error | 16:58 |
| hrybacki | elbragstad: ? lemme show you the diff | 16:59 |
| hrybacki | https://paste.fedoraproject.org/paste/dofFQtmjKYriMb358LPeSA | 17:00 |
| hrybacki | lbragstad[m]: note that I've seen this before -- I thought it was related to syntax of the DocumentedRuleDefault but this should be fine | 17:01 |
| hrybacki | seen it before* while updating other rules in barbican | 17:01 |
| *** tesseract has quit IRC | 17:01 | |
| elbragstad | hrybacki: do you have anything posted to gerrit yet? | 17:02 |
| *** sonuk_ has joined #openstack-keystone | 17:03 | |
| hrybacki | lbragstad[m]: https://review.openstack.org/575218 -- note that I'm presently working in orders.py | 17:04 |
| elbragstad | and you're getting that error running the tests? | 17:05 |
| hrybacki | aye, after I update the next rule `order:get` | 17:05 |
| hrybacki | that latest patchset is passing | 17:06 |
| *** sonuk has quit IRC | 17:07 | |
| elbragstad | hrybacki: http://paste.openstack.org/show/723561/ | 17:13 |
| elbragstad | ^ fixes it for me | 17:13 |
| elbragstad | i think it's because you're passing description as an empty string | 17:13 |
| elbragstad | and when you use the DocumentedRuleDefault class, that specific attribute is required | 17:14 |
| kmalloc | elbragstad: hrm, i was going to move limits to flask next, but if we're actively iterating i'll pass on it to a different subsystem | 17:14 |
| hrybacki | Ahhhh! Thanks lbragstad[m] | 17:14 |
| elbragstad | hrybacki: https://github.com/openstack/oslo.policy/blob/master/oslo_policy/policy.py#L1073 | 17:14 |
| elbragstad | hrybacki: it's odd that error isn't more apparent in the trace though | 17:14 |
| hrybacki | I'll look into making that exception more apparent | 17:14 |
| elbragstad | i'm not sure why | 17:14 |
| elbragstad | kmalloc: yeah - that makes sense, we can hold off on flakifying limits | 17:15 |
| elbragstad | those reviews for unified limits are pretty squared away in my opinion though | 17:15 |
| kmalloc | right | 17:15 |
| elbragstad | if you did want to start with that api, you probably could after those merge | 17:16 |
| elbragstad | (they contain most of the changes we wanted to make to that API) | 17:16 |
| kmalloc | fair enough i can work some magic :) | 17:16 |
| kmalloc | i need to score those, i was almost done reviewing when i had a phone call | 17:16 |
| elbragstad | the unified limit patches? | 17:16 |
| kmalloc | yeah | 17:16 |
| elbragstad | oh - awesome | 17:16 |
| kmalloc | :) | 17:17 |
| elbragstad | thanks for taking a look | 17:17 |
| kmalloc | :P | 17:17 |
| elbragstad | if we merge those we can hopefully do a release of ksc next week and rev the requirement in osc for CLI support | 17:17 |
| kmalloc | yah that would be good. | 17:17 |
| kmalloc | i am so looking forward to osc moving to sdk | 17:17 |
| kmalloc | ftr. | 17:17 |
| elbragstad | that'd actually make testing all of wxy's stuff alot easier | 17:17 |
| openstackgerrit | Merged openstack/keystone master: Clarify complicated sentence in docs https://review.openstack.org/574266 | 17:19 |
| kmalloc | elbragstad: we need to fix the limits db table | 17:19 |
| kmalloc | elbragstad: it's using the UUID as PK | 17:20 |
| kmalloc | that is a _must_ fix this cycle. | 17:20 |
| * kmalloc grumps. | 17:20 | |
| kmalloc | I need to write a linting check that fails if someone does that. | 17:20 |
| kmalloc | i'm getting tired of arguing the same point. it's bad for the DB to use UUIDs as the PK. | 17:20 |
| kmalloc | the PK needs to be autoinc int, uuid is the user-facing resource. | 17:21 |
| kmalloc | id./ | 17:21 |
| kmalloc | elbragstad: how do we fix this with "no downtime" upgrades... new pivot table, right? | 17:22 |
| kmalloc | elbragstad: can we change the "ID" value to "limit_id" on the api | 17:22 |
| kmalloc | while we're making changes? | 17:22 |
| *** sonuk has joined #openstack-keystone | 17:22 | |
| kmalloc | and registered_limit_id | 17:22 |
| *** germs has quit IRC | 17:24 | |
| *** germs has joined #openstack-keystone | 17:24 | |
| *** germs has quit IRC | 17:24 | |
| *** germs has joined #openstack-keystone | 17:24 | |
| *** germs has quit IRC | 17:24 | |
| *** sonuk_ has quit IRC | 17:24 | |
| *** sonuk_ has joined #openstack-keystone | 17:25 | |
| openstackgerrit | Merged openstack/oslo.limit master: fix tox python3 overrides https://review.openstack.org/573954 | 17:27 |
| kmalloc | elbragstad: -1 on the unified limit, i just want to translate the current "ID" emitted on the wire to "limit_id" and "registered_limit_id" | 17:28 |
| kmalloc | respectively | 17:28 |
| kmalloc | not "id" in the ref. | 17:28 |
| *** sonuk has quit IRC | 17:28 | |
| kmalloc | so i can go through and fix the db table(s) to use autoinc int as the "id" | 17:29 |
| kmalloc | behind the scenes for PK purposes and FK purposes. | 17:29 |
| kmalloc | before we have too much data in the table(s). | 17:29 |
| kmalloc | elbragstad: also is it safe to assume we will do a drop/recreate of the table or do i need to jump through hoops for migrating data ? | 17:30 |
| kmalloc | elbragstad: also +2 as soon as we adjust what is emitted on the wire for the ID. | 17:30 |
| *** dave-mccowan has joined #openstack-keystone | 17:33 | |
| elbragstad | ahh | 17:35 |
| elbragstad | so - id will be autoinc | 17:35 |
| elbragstad | and limit_id/registered_limit_id will be uuid | 17:35 |
| elbragstad | makes sense | 17:36 |
| elbragstad | is that something we want to track with a bug? | 17:36 |
| mnaser | i've been wrestling this for close to an hour | 17:41 |
| mnaser | keystonemiddleware keeps making v2.0 requests that obviously 404 | 17:42 |
| mnaser | https://docs.openstack.org/keystone/queens/admin/identity-auth-token-middleware.html doesn't exactly give me what i need (and im guessing the fact no domain info is here = why it uses v2.0) | 17:42 |
| elbragstad | mnaser: hmm - that's strange, i would have expected the auth_uri ending in /v3 to be enough | 17:45 |
| *** pcichy has quit IRC | 17:46 | |
| cmurphy | might be the missing domain problem? | 17:46 |
| mnaser | well | 17:46 |
| mnaser | as i speak | 17:46 |
| mnaser | i find this https://docs.openstack.org/keystonemiddleware/queens/api/keystonemiddleware.auth_token.html#configuration | 17:46 |
| mnaser | thats the more appropriate config structure that worked | 17:46 |
| kmalloc | elbragstad: yeah i'll spin up the patch for it shortly | 17:48 |
| cmurphy | ah you already said you suspected the domain thing | 17:48 |
| elbragstad | we should probably update https://docs.openstack.org/keystone/queens/admin/identity-auth-token-middleware.html | 17:48 |
| kmalloc | elbragstad: just getting some more coffee and then i'll upgrade to a +2. | 17:48 |
| mnaser | yeah that should match, i can push up a patch when i have a second fixing this | 17:49 |
| kmalloc | mnaser: sounds good. | 17:49 |
| elbragstad | thanks mnaser | 17:49 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Remove a useless function https://review.openstack.org/575694 | 17:49 |
| cmurphy | we also have stuff like this all over ksm http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token/_auth.py#n14 i'm kind of surprised stuff works at all | 17:49 |
| kmalloc | cmurphy: well, ksa isn't dropping v2 support, but i guess new ksm can drop it now. | 17:50 |
| *** spilla has quit IRC | 17:50 | |
| * kmalloc adds a bug+task in trello for that | 17:50 | |
| *** spilla has joined #openstack-keystone | 17:51 | |
| *** boris_42_ has joined #openstack-keystone | 17:53 | |
| kmalloc | https://bugs.launchpad.net/keystonemiddleware/+bug/1777177 | 17:53 |
| openstack | Launchpad bug 1777177 in keystonemiddleware "eliminate v2 keystone support" [Medium,Triaged] | 17:53 |
| mnaser | jackpot on that bug # kmalloc | 17:54 |
| kmalloc | mnaser: right?! | 17:54 |
| kmalloc | mnaser: only thing better would be 1777771 | 17:55 |
| kmalloc | but bug #1777771 likely wont be us... because you know.. LP bug numbers :P | 17:55 |
| cmurphy | kmalloc: it's not so much that ksm "supports" v2, it's that from a cursory glance it looks like it only uses v2, e.g. here http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token/_auth.py#n75 | 17:55 |
| kmalloc | cmurphy: right, and removal of v2.0 support will solve that. | 17:56 |
| cmurphy | there's obviously some other logic that makes it do the right thing based on context | 17:56 |
| kmalloc | so it's not confusing | 17:56 |
| cmurphy | right | 17:56 |
| kmalloc | and it will eliminate the issue mnaser is having :) | 17:56 |
| kmalloc | because it doesn't work except the v3 way ^_^. | 17:56 |
| * kmalloc is happy v2.0 is dead. | 17:56 | |
| kmalloc | DEAD I SAY! | 17:56 |
| cmurphy | kmalloc: is there anything i should include about the flaskification progress in the update email? | 17:59 |
| kmalloc | hm | 17:59 |
| kmalloc | that is well underway? | 18:00 |
| kmalloc | and we'll be starting to move APIs to flask dispatching [handled by the flask framework] this next week | 18:00 |
| cmurphy | okie | 18:01 |
| *** fiddletwix has joined #openstack-keystone | 18:06 | |
| kmalloc | elbragstad: i am not looing forward to re-writing @protected =/ | 18:23 |
| kmalloc | elbragstad: because that is next on the list to do for flaskification | 18:23 |
| elbragstad | it's probably going to be a pain, but i am looking forward to the result | 18:23 |
| elbragstad | i can't wait to see that go away | 18:24 |
| kmalloc | so... i *think* the way I'm going to handle it is do an @decorator for *all* methods on a resource [automatic flask thing] that will throw a huge error if enforce isn't called | 18:24 |
| kmalloc | and allow for explicit excemptions | 18:24 |
| kmalloc | for unprotected APIs | 18:24 |
| kmalloc | also, this is somewhat hard to write tests for | 18:25 |
| kmalloc | thankfully with flask we get MOST coverage for free atm | 18:25 |
| kmalloc | ok, so ... today: 1) I'll fix limits so we can push that through. | 18:25 |
| kmalloc | 2) flaskification ick. | 18:25 |
| *** rmascena has joined #openstack-keystone | 18:27 | |
| elbragstad | that sounds good | 18:27 |
| *** raildo has quit IRC | 18:30 | |
| *** r-daneel_ has joined #openstack-keystone | 18:31 | |
| *** r-daneel has quit IRC | 18:32 | |
| *** r-daneel_ is now known as r-daneel | 18:32 | |
| gagehugo | elbragstad Is there a reason to keep the templated get_catalog? https://github.com/openstack/keystone/blob/master/keystone/catalog/backends/templated.py#L196 | 18:39 |
| gagehugo | looking at https://review.openstack.org/#/c/575704/ now | 18:40 |
| elbragstad | not that i know of? | 18:40 |
| elbragstad | if v2 was the only thing using it | 18:40 |
| elbragstad | then it's probably safe to remove, unless it was exposed via the API? | 18:40 |
| kmalloc | the templated catalog was used for some CMS systems | 18:41 |
| kmalloc | hence the move to yaml | 18:41 |
| kmalloc | with a deprecation cycle on the templated backend | 18:41 |
| kmalloc | elbragstad, gagehugo: https://review.openstack.org/#/c/483514/ | 18:41 |
| kmalloc | and the follow up | 18:41 |
| gagehugo | kmalloc that's it | 18:42 |
| kmalloc | i'd be inclined to just do the deprecation/new catalog | 18:42 |
| gagehugo | I vaguely remembered seeing something and couldn't remember | 18:42 |
| kmalloc | and not remove things from the old templated backend | 18:42 |
| kmalloc | i +2 all the work (tests included) on the filesystem catalog, but I don't feel safe +2ing the code as I wrote a huge chunk of it | 18:42 |
| kmalloc | we should also add a .watch/.inotify so changes to the filesystem catalog are loaded | 18:43 |
| kmalloc | (same mechanism as we have for policy.json loading) if it's not already there (I haven't looked inf a few days and don't remember) | 18:43 |
| *** brad[] has joined #openstack-keystone | 19:13 | |
| *** s10 has joined #openstack-keystone | 19:14 | |
| hrybacki | do we have anything near as verbose as https://wiki.openstack.org/wiki/Barbican/Policy for keystone? | 19:16 |
| hrybacki | expanding ^^ as I audit their API. Will be pretty good doc when complete | 19:16 |
| *** felipemonteiro has joined #openstack-keystone | 19:17 | |
| *** s10 has quit IRC | 19:21 | |
| *** s10 has joined #openstack-keystone | 19:21 | |
| *** s10 has quit IRC | 19:25 | |
| *** felipemonteiro has quit IRC | 19:30 | |
| kmalloc | elbragstad: i... i think our limit tests are not comprehensive | 19:32 |
| kmalloc | elbragstad: because i made changes to the api and nothing broke. | 19:32 |
| kmalloc | this worries me. | 19:32 |
| elbragstad | ? | 19:32 |
| kmalloc | i made the API translate to "registered_limit_id" and "limit_id" from id | 19:33 |
| kmalloc | and nothing broke. | 19:33 |
| kmalloc | that worries me. | 19:33 |
| elbragstad | can you post what you have/ | 19:33 |
| * kmalloc is digging in more to try and get this change to the proposed patch(es) | 19:33 | |
| elbragstad | i'm trying to wrap up the last osc patch | 19:33 |
| elbragstad | for project limits | 19:33 |
| kmalloc | yeah in a few, i'm adding some more asserts first | 19:33 |
| elbragstad | and i should be able to take a look | 19:34 |
| *** lifeless has joined #openstack-keystone | 19:34 | |
| kmalloc | i expect i just need to make it explode if 'id' ever leaks out past the driver. | 19:34 |
| *** mvenesio has quit IRC | 19:36 | |
| kmalloc | oh i see ugh, no it's always 'id' but we change that in the driver to be something sane, don't wel | 19:37 |
| kmalloc | ? | 19:37 |
| kmalloc | thats why it didn't break. | 19:37 |
| *** david-lyle is now known as dklyle | 19:37 | |
| kmalloc | yeah, "internal_id" | 19:37 |
| kmalloc | so. | 19:37 |
| kmalloc | elbragstad: no API change needed. | 19:38 |
| kmalloc | just a sql migration | 19:38 |
| elbragstad | nice | 19:38 |
| kmalloc | elbragstad: am i allowed to drop the table and recreate it? | 19:38 |
| kmalloc | under the no-downtime constraints | 19:38 |
| kmalloc | basically the FKs are wrong. | 19:38 |
| kmalloc | and it might be easier to just re-create the correct structure | 19:38 |
| elbragstad | you can write data into a second table i think | 19:39 |
| kmalloc | ugh | 19:39 |
| kmalloc | you know this "no downtime upgrade" is a nightmare to write code around | 19:39 |
| elbragstad | yeah - i know | 19:39 |
| kmalloc | i kindof want to just drop the tag and say "we don't do that" | 19:39 |
| kmalloc | i'm going to just drop any registered limits on the floor and just use the new table, it's EXPIRIMENTAL we said we might break you | 19:40 |
| kmalloc | this is a case of "we are breaking you" | 19:40 |
| kmalloc | "re-add the limits" | 19:40 |
| kmalloc | since ksc / osc never had code for this yet, i don't feel like that is wrong... please tell me if i need to be nicer to the data | 19:41 |
| elbragstad | can you just create a new table with the correct schema and port the data to it? | 19:42 |
| *** pcichy has joined #openstack-keystone | 19:43 | |
| kmalloc | hm. what are we doing with this data structure... | 19:44 |
| kmalloc | we FK on the resource_name? | 19:44 |
| kmalloc | this is so poorly normalized =/ | 19:45 |
| elbragstad | probably has something to do with registered limits and limits being in two different tables | 19:45 |
| kmalloc | right, but we're FKing to a non-indexed name column | 19:45 |
| kmalloc | https://www.irccloud.com/pastebin/74y8dUZZ/ | 19:46 |
| kmalloc | so, we have an unindexed string search for creation of limit | 19:46 |
| kmalloc | ss | 19:46 |
| kmalloc | if we have a bunch of registered_limits this is going to get ugly | 19:46 |
| kmalloc | or we need to index the resource_name columns [fine] | 19:47 |
| kmalloc | that feels like it should be tied to the registered limit, not the registered limit name | 19:48 |
| kmalloc | ok. so... | 19:48 |
| kmalloc | elbragstad: do you want me to just index the name field? | 19:49 |
| kmalloc | and.. whoa. | 19:49 |
| kmalloc | there is no unique constraint on registered_limit.resource_name | 19:49 |
| kmalloc | so your FK is potentially very wonky. | 19:50 |
| kmalloc | elbragstad: and we have issues with non-uniqeness in the sql structure | 19:51 |
| kmalloc | because the unique constraint of REGION_ID, SERVICE_ID, and RESOURCE_NAME will not be unique in this case: | 19:52 |
| kmalloc | (NULL, SERVICE_ONE, 'cool name') | 19:52 |
| *** r-daneel has quit IRC | 19:52 | |
| kmalloc | i can add an indefinite number of those records, because mysql does not consider NULL for uniqueness. | 19:52 |
| kmalloc | elbragstad: this is a lot of fixing that is needed. | 19:53 |
| kmalloc | and we do a ton of queries on unindexed columns. | 19:54 |
| elbragstad | hnmmm | 19:56 |
| elbragstad | alright - lemme finish this thing up quick and you'll have more of my attention | 19:56 |
| kmalloc | yeah | 19:57 |
| elbragstad | sorry - these osc unit tests broke my brain yesterday | 19:58 |
| elbragstad | it's like inception but with mocks | 19:58 |
| kmalloc | well, fwiw, i wouldn't land OSC/KSC changes until we fix the limits stuff | 19:59 |
| kmalloc | as it stands, i don't think we should expose this to a wider audience right now. | 19:59 |
| *** s10 has joined #openstack-keystone | 19:59 | |
| kmalloc | and yeah OSC is mock-hell in tests. | 19:59 |
| elbragstad | it could be just that i'm not accustomed to using them | 20:00 |
| elbragstad | we don't rely on mocks a whole lot in keystone, so going to a project that does is a change of pace | 20:01 |
| elbragstad | kmalloc: for the unified limit stuff | 20:01 |
| elbragstad | we should set aside some time with wxy to walk through stuff so we're all on the same page | 20:02 |
| elbragstad | as far as the improvements we want to make | 20:02 |
| kmalloc | right. | 20:02 |
| elbragstad | between the three of us, i'm sure we could get a lot of it squared away | 20:02 |
| kmalloc | if you have a few moments this might justify high-bandwidth | 20:02 |
| *** lifeless has quit IRC | 20:02 | |
| kmalloc | so i can maek sure things are/aren't intended before consuming wxy's time | 20:03 |
| *** lifeless has joined #openstack-keystone | 20:03 | |
| kmalloc | if it's intended and we can fix it easily, i'll just propose fixes. | 20:03 |
| elbragstad | yeah | 20:04 |
| kmalloc | let me know when you have a few/done with OSC | 20:04 |
| elbragstad | ok - just about to wrap things up | 20:04 |
| kmalloc | i'll hangout and show you what i'm running into and we can make a plan from there (and how deep of enhancements we need) - and we can type results into irc | 20:05 |
| kmalloc | s/hangout/start a hangout/ | 20:05 |
| kmalloc | is it really only 1pm. it feels like it should be 6pm already (maybe being up at 4am does that) | 20:07 |
| elbragstad | i hear ya.. | 20:08 |
| kmalloc | switching computers so i can share screen more easily | 20:11 |
| elbragstad | just about done | 20:26 |
| kmalloc | kk | 20:26 |
| elbragstad | trying to hurry | 20:26 |
| kmalloc | LOL | 20:26 |
| *** r-daneel has joined #openstack-keystone | 20:27 | |
| *** zxy has quit IRC | 20:34 | |
| *** lifeless has quit IRC | 20:49 | |
| elbragstad | ok - omw | 20:49 |
| kmalloc | k | 20:50 |
| *** lifeless has joined #openstack-keystone | 20:50 | |
| elbragstad | linkL | 20:51 |
| elbragstad | ? | 20:51 |
| *** r-daneel has quit IRC | 20:54 | |
| *** r-daneel has joined #openstack-keystone | 20:54 | |
| *** rmascena has quit IRC | 20:54 | |
| openstackgerrit | Merged openstack/python-keystoneclient master: Remove PyPI downloads https://review.openstack.org/573279 | 21:08 |
| *** AlexeyAbashkin has quit IRC | 21:13 | |
| elbragstad | https://etherpad.openstack.org/p/keystone-weekly-meeting | 21:26 |
| *** edmondsw has quit IRC | 21:29 | |
| *** r-daneel has quit IRC | 21:39 | |
| *** spilla has quit IRC | 21:44 | |
| *** lifeless has quit IRC | 22:01 | |
| elbragstad | there must be a check somewhere that protects the case we thought we'd be able to hit http://paste.openstack.org/show/723566/ | 22:05 |
| elbragstad | kmalloc: ^ | 22:06 |
| kmalloc | might be that extra FK table_arge | 22:06 |
| *** felipemonteiro has joined #openstack-keystone | 22:07 | |
| kmalloc | but it's still super odd | 22:08 |
| elbragstad | sure - but it might just be internal cleanup? | 22:08 |
| kmalloc | right. might not have the broken issues | 22:09 |
| kmalloc | and we do need to index anything we search on anyway | 22:10 |
| kmalloc | regardless | 22:10 |
| elbragstad | true | 22:12 |
| *** martinus__ has quit IRC | 22:13 | |
| kmalloc | added tags to the etherpad | 22:13 |
| kmalloc | so it's clear what comes out of this. | 22:13 |
| elbragstad | sweet | 22:16 |
| *** dave-mccowan has quit IRC | 22:48 | |
| *** lifeless has joined #openstack-keystone | 22:49 | |
| *** edmondsw has joined #openstack-keystone | 22:50 | |
| *** edmondsw has quit IRC | 22:55 | |
| knikolla | double checking before i spend too much time debugging this | 23:02 |
| knikolla | does listing implied roles work from osc? | 23:02 |
| knikolla | I get AttributeError: 'RoleManager' object has no attribute 'list_inference_roles' | 23:03 |
| elbragstad | ? | 23:04 |
| elbragstad | that seems like a programming error? | 23:04 |
| knikolla | elbragstad: that, or something weird on my install. have a devstack handy to test? | 23:05 |
| knikolla | nevermind, it's a programmer error | 23:07 |
| knikolla | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/roles.py#L418 | 23:07 |
| knikolla | it's using RoleManager, which has the method called list_role_inferences | 23:07 |
| knikolla | but it's calling list_inference_roles (which is in InferenceRuleManager) | 23:08 |
| knikolla | https://github.com/openstack/python-openstackclient/blob/aa4cdf1dc8050cc91bdd3a871de3edf4ff67033d/openstackclient/identity/v3/implied_role.py#L128 | 23:08 |
| elbragstad | ahhh | 23:09 |
| knikolla | I'll have a patch for osc tonight | 23:09 |
| knikolla | I'm writing the docs for implied roles also | 23:10 |
| knikolla | so kinda have to have a functional osc to get output | 23:10 |
| elbragstad | that works | 23:10 |
| *** gyee has quit IRC | 23:24 | |
| elbragstad | and i'm done with osc for the day https://review.openstack.org/#/q/topic:bp/unified-limits+status:open+project:openstack/python-openstackclient | 23:40 |
| *** s10 has quit IRC | 23:59 | |
| *** s10 has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!