Wednesday, 2018-10-10

*** itlinux has joined #openstack-keystone00:03
*** lbragstad has joined #openstack-keystone00:16
*** ChanServ sets mode: +o lbragstad00:16
*** gyee has quit IRC00:20
*** Dinesh_Bhor has joined #openstack-keystone00:38
*** Dinesh_Bhor has quit IRC00:49
*** Dinesh_Bhor has joined #openstack-keystone00:52
*** jdennis has quit IRC01:37
*** openstackgerrit has quit IRC01:37
*** Dinesh_Bhor has quit IRC01:37
*** d0ugal has quit IRC01:37
*** tristanC has quit IRC01:37
*** mugsie has quit IRC01:37
*** jroll has quit IRC01:37
*** odyssey4me has quit IRC01:37
*** dmellado has quit IRC01:37
*** mvkr has quit IRC01:37
*** markvoelker has quit IRC01:37
*** jmlowe has quit IRC01:37
*** devx has quit IRC01:37
*** aning has quit IRC01:37
*** jhesketh has quit IRC01:37
*** csatari has quit IRC01:37
*** josecastroleon has quit IRC01:37
*** dave-mccowan has quit IRC01:37
*** vishakha has quit IRC01:37
*** gagehugo has quit IRC01:37
*** spsurya has quit IRC01:37
*** etp has quit IRC01:37
*** jmccrory has quit IRC01:37
*** errr has quit IRC01:37
*** trident has quit IRC01:37
*** glb has quit IRC01:37
*** masayukig[m] has quit IRC01:37
*** pas-ha has quit IRC01:37
*** mgagne has quit IRC01:37
*** knikolla has quit IRC01:37
*** dklyle has quit IRC01:37
*** kukacz has quit IRC01:37
*** BlackDex has quit IRC01:37
*** szaher has quit IRC01:37
*** gmann has quit IRC01:37
*** belmoreira has quit IRC01:37
*** wxy-xiyuan has quit IRC01:37
*** zzzeek_ has quit IRC01:37
*** eglute has quit IRC01:37
*** jamielennox has quit IRC01:37
*** cloudnull has quit IRC01:37
*** nicolasbock has quit IRC01:37
*** sayalilunkad has quit IRC01:37
*** pooja_jadhav has quit IRC01:37
*** jistr has quit IRC01:37
*** hogepodge has quit IRC01:37
*** kmalloc has quit IRC01:37
*** lamt has quit IRC01:37
*** cmurphy has quit IRC01:37
*** lbragstad has quit IRC01:37
*** imacdonn has quit IRC01:37
*** adriant has quit IRC01:37
*** d34dh0r53 has quit IRC01:37
*** yankcrime has quit IRC01:37
*** _KaszpiR_ has quit IRC01:37
*** tonyb has quit IRC01:37
*** bnemec has quit IRC01:37
*** andreykurilin has quit IRC01:37
*** rm_work has quit IRC01:37
*** fungi has quit IRC01:37
*** samueldmq has quit IRC01:37
*** melwitt has quit IRC01:37
*** andymccr has quit IRC01:37
*** tobberydberg has quit IRC01:37
*** Neptu has quit IRC01:37
*** NikitaKonovalov has quit IRC01:37
*** chason has quit IRC01:37
*** hrybacki has quit IRC01:37
*** mnaser has quit IRC01:37
*** TheJulia has quit IRC01:37
*** rledisez has quit IRC01:37
*** ildikov has quit IRC01:37
*** mordred has quit IRC01:37
*** itlinux has quit IRC01:37
*** jaosorior has quit IRC01:37
*** xek has quit IRC01:37
*** dims has quit IRC01:37
*** kencjohnston has quit IRC01:37
*** DinaBelova has quit IRC01:37
*** larsks has quit IRC01:37
*** jrist has quit IRC01:37
*** jamiec_ has quit IRC01:37
*** rodrigods has quit IRC01:37
*** obre has quit IRC01:37
*** johnthetubaguy has quit IRC01:37
*** timburke has quit IRC01:37
*** spotz has quit IRC01:37
*** raginbajin has quit IRC01:37
*** dansmith has quit IRC01:37
*** zigo has quit IRC01:37
*** tobias-urdin has quit IRC01:37
*** niceplace has quit IRC01:37
*** breton has quit IRC01:37
*** rcernin has quit IRC01:37
*** ianw has quit IRC01:37
*** cwright has quit IRC01:37
*** jlvillal has quit IRC01:37
*** edmondsw has quit IRC01:37
*** mbuil has quit IRC01:37
*** aloga has quit IRC01:37
*** Krenair has quit IRC01:37
*** mattoliverau has quit IRC01:37
*** andreaf has quit IRC01:37
*** zioproto has quit IRC01:37
*** robcresswell has quit IRC01:37
*** hemna has quit IRC01:37
*** chrome0 has quit IRC01:37
*** charz has quit IRC01:37
*** ChanServ has quit IRC01:37
*** mattoliverau has joined #openstack-keystone01:43
*** andreaf has joined #openstack-keystone01:43
*** Krenair has joined #openstack-keystone01:43
*** aloga has joined #openstack-keystone01:43
*** mbuil has joined #openstack-keystone01:43
*** edmondsw has joined #openstack-keystone01:43
*** jlvillal has joined #openstack-keystone01:43
*** cwright has joined #openstack-keystone01:43
*** ianw has joined #openstack-keystone01:43
*** rcernin has joined #openstack-keystone01:43
*** odyssey4me has joined #openstack-keystone01:43
*** jroll has joined #openstack-keystone01:43
*** d0ugal has joined #openstack-keystone01:43
*** mugsie has joined #openstack-keystone01:43
*** Dinesh_Bhor has joined #openstack-keystone01:43
*** breton has joined #openstack-keystone01:43
*** niceplace has joined #openstack-keystone01:43
*** tobias-urdin has joined #openstack-keystone01:43
*** zigo has joined #openstack-keystone01:43
*** dansmith has joined #openstack-keystone01:43
*** raginbajin has joined #openstack-keystone01:43
*** spotz has joined #openstack-keystone01:43
*** timburke has joined #openstack-keystone01:43
*** johnthetubaguy has joined #openstack-keystone01:43
*** obre has joined #openstack-keystone01:43
*** rodrigods has joined #openstack-keystone01:43
*** jamiec_ has joined #openstack-keystone01:43
*** jrist has joined #openstack-keystone01:43
*** dklyle has joined #openstack-keystone01:44
*** kukacz has joined #openstack-keystone01:44
*** BlackDex has joined #openstack-keystone01:44
*** szaher has joined #openstack-keystone01:44
*** gmann has joined #openstack-keystone01:44
*** bnemec has joined #openstack-keystone01:44
*** andreykurilin has joined #openstack-keystone01:44
*** rm_work has joined #openstack-keystone01:44
*** fungi has joined #openstack-keystone01:44
*** samueldmq has joined #openstack-keystone01:44
*** melwitt has joined #openstack-keystone01:44
*** belmoreira has joined #openstack-keystone01:44
*** wxy-xiyuan has joined #openstack-keystone01:44
*** nicolasbock has joined #openstack-keystone01:44
*** zzzeek_ has joined #openstack-keystone01:44
*** eglute has joined #openstack-keystone01:44
*** jamielennox has joined #openstack-keystone01:44
*** cloudnull has joined #openstack-keystone01:44
*** sayalilunkad has joined #openstack-keystone01:44
*** jdennis has joined #openstack-keystone01:44
*** openstackgerrit has joined #openstack-keystone01:44
*** zioproto has joined #openstack-keystone01:45
*** charz has joined #openstack-keystone01:45
*** robcresswell has joined #openstack-keystone01:45
*** chrome0 has joined #openstack-keystone01:45
*** hemna has joined #openstack-keystone01:45
*** pooja_jadhav has joined #openstack-keystone01:45
*** jistr has joined #openstack-keystone01:45
*** hogepodge has joined #openstack-keystone01:45
*** lamt has joined #openstack-keystone01:45
*** kmalloc has joined #openstack-keystone01:45
*** cmurphy has joined #openstack-keystone01:45
*** csatari has joined #openstack-keystone01:45
*** dmellado has joined #openstack-keystone01:46
*** mvkr has joined #openstack-keystone01:46
*** markvoelker has joined #openstack-keystone01:46
*** jmlowe has joined #openstack-keystone01:46
*** devx has joined #openstack-keystone01:46
*** aning has joined #openstack-keystone01:46
*** jhesketh has joined #openstack-keystone01:46
*** hrybacki has joined #openstack-keystone01:46
*** chason has joined #openstack-keystone01:46
*** NikitaKonovalov has joined #openstack-keystone01:46
*** mnaser has joined #openstack-keystone01:46
*** TheJulia has joined #openstack-keystone01:46
*** rledisez has joined #openstack-keystone01:46
*** ildikov has joined #openstack-keystone01:46
*** mordred has joined #openstack-keystone01:46
*** andymccr has joined #openstack-keystone01:46
*** tobberydberg has joined #openstack-keystone01:46
*** Neptu has joined #openstack-keystone01:46
*** imacdonn has joined #openstack-keystone01:46
*** adriant has joined #openstack-keystone01:46
*** d34dh0r53 has joined #openstack-keystone01:46
*** yankcrime has joined #openstack-keystone01:46
*** tonyb has joined #openstack-keystone01:46
*** _KaszpiR_ has joined #openstack-keystone01:46
*** jaosorior has joined #openstack-keystone01:46
*** kencjohnston has joined #openstack-keystone01:46
*** DinaBelova has joined #openstack-keystone01:46
*** larsks has joined #openstack-keystone01:46
*** ChanServ has joined #openstack-keystone01:47
*** card.freenode.net sets mode: +o ChanServ01:47
*** lbragstad has joined #openstack-keystone01:48
*** tristanC has joined #openstack-keystone01:48
*** ChanServ sets mode: +o lbragstad01:49
*** mgagne has joined #openstack-keystone01:49
*** Guest10461 has joined #openstack-keystone01:49
*** trident has joined #openstack-keystone01:49
*** dave-mccowan has joined #openstack-keystone01:51
*** itlinux has joined #openstack-keystone01:54
*** sapd1 has joined #openstack-keystone02:11
*** lbragstad has quit IRC02:14
*** vishakha has joined #openstack-keystone02:25
*** dave-mccowan has quit IRC03:08
*** gagehugo_ has joined #openstack-keystone03:49
*** Dinesh_Bhor has quit IRC03:58
*** aojea has joined #openstack-keystone04:02
*** aojea has quit IRC04:07
*** spsurya has joined #openstack-keystone04:43
*** Dinesh_Bhor has joined #openstack-keystone04:54
*** shyam89 has joined #openstack-keystone05:11
*** jrist has quit IRC05:11
openstackgerritVishakha Agarwal proposed openstack/keystone master: Implement scope_type checking for role_assignments  https://review.openstack.org/60921005:26
openstackgerritVishakha Agarwal proposed openstack/keystone master: [WIP] Implement scope_type checking for role_assignments  https://review.openstack.org/60921005:32
*** shyam89 has quit IRC05:42
*** felipemonteiro has joined #openstack-keystone05:54
*** masayukig[m]1 has joined #openstack-keystone05:56
*** shyam89 has joined #openstack-keystone05:58
*** Dinesh_Bhor has quit IRC06:12
*** shyam89 has quit IRC06:12
*** aojea has joined #openstack-keystone06:15
kmalloc*sigh* something merged that caused all of the flask stuff to be in merge conflict06:16
kmalloci kindof want to do a revert because i don't want to chase an rebase here.06:17
openstackgerritMorgan Fainberg proposed openstack/keystone master: Revert "Enable foreign keys for unit test"  https://review.openstack.org/60926606:17
openstackgerritMorgan Fainberg proposed openstack/keystone master: Convert auth to flask native dispatching  https://review.openstack.org/60346106:24
openstackgerritMorgan Fainberg proposed openstack/keystone master: Auth flask conversion cleanup  https://review.openstack.org/60875606:24
openstackgerritMorgan Fainberg proposed openstack/keystone master: Convert /v3/users to flask native dispatching  https://review.openstack.org/60907106:24
openstackgerritMorgan Fainberg proposed openstack/keystone master: Convert projects API to Flask  https://review.openstack.org/60345106:24
openstackgerritMorgan Fainberg proposed openstack/keystone master: Remove skip for test_locked_out_user_sends_notification  https://review.openstack.org/60915906:24
*** shyam89 has joined #openstack-keystone06:26
*** Dinesh_Bhor has joined #openstack-keystone06:28
*** shyam89 has quit IRC06:31
*** shyam89 has joined #openstack-keystone06:31
*** aojea has quit IRC06:41
*** Emine has joined #openstack-keystone06:49
*** pcaruana has joined #openstack-keystone06:50
*** rcernin has quit IRC06:58
openstackgerritVishakha Agarwal proposed openstack/keystone master: Remove deprecated trust_flush  https://review.openstack.org/60927707:04
*** odyssey4me has quit IRC07:07
*** odyssey4me has joined #openstack-keystone07:08
*** mugsie has quit IRC07:08
*** mgagne has quit IRC07:09
*** mgagne has joined #openstack-keystone07:10
*** jroll has quit IRC07:10
*** aojea_ has joined #openstack-keystone07:12
*** jroll has joined #openstack-keystone07:12
*** aojea_ has quit IRC07:16
*** shyam89 has quit IRC07:17
*** shyam89 has joined #openstack-keystone07:17
*** mgagne has quit IRC07:34
*** shyam89 has quit IRC07:36
*** mgagne has joined #openstack-keystone07:36
*** hoonetorg has joined #openstack-keystone07:42
*** shyam89 has joined #openstack-keystone07:48
*** aojea_ has joined #openstack-keystone07:51
openstackgerritVishakha Agarwal proposed openstack/keystone master: Adding 'date' for trust_flush  https://review.openstack.org/60789707:51
*** aojea_ has quit IRC07:53
openstackgerritVishakha Agarwal proposed openstack/keystone master: Adding 'date' for trust_flush  https://review.openstack.org/60789707:53
*** aojea__ has joined #openstack-keystone07:53
*** shyam89 has quit IRC07:55
*** Dinesh_Bhor has quit IRC08:01
*** felipemonteiro has quit IRC08:11
*** aojea__ has quit IRC08:23
*** shyam89 has joined #openstack-keystone08:43
*** belmorei_ has joined #openstack-keystone08:57
*** belmoreira has quit IRC09:00
*** Dinesh_Bhor has joined #openstack-keystone09:12
*** aojea_ has joined #openstack-keystone09:17
*** aojea_ has quit IRC09:50
*** imacdonn has quit IRC09:52
*** imacdonn has joined #openstack-keystone09:52
*** mvkr has quit IRC10:01
*** shyam89 has quit IRC10:11
*** shyam89 has joined #openstack-keystone10:12
*** aojea_ has joined #openstack-keystone10:24
*** Dinesh_Bhor has quit IRC10:25
*** dave-mccowan has joined #openstack-keystone10:32
*** shyam89 has quit IRC10:34
*** mvkr has joined #openstack-keystone10:38
*** Dinesh_Bhor has joined #openstack-keystone10:42
*** belmorei_ has quit IRC10:46
*** belmoreira has joined #openstack-keystone10:47
*** aojea_ has quit IRC10:56
*** Dinesh_Bhor has quit IRC11:14
*** jrist has joined #openstack-keystone11:14
*** aojea_ has joined #openstack-keystone11:29
*** shyam89 has joined #openstack-keystone11:32
*** raildo has joined #openstack-keystone11:52
*** belmoreira has quit IRC12:05
*** aojea_ has quit IRC12:08
*** belmoreira has joined #openstack-keystone12:08
openstackgerritJuan Antonio Osorio Robles proposed openstack/oslo.policy master: Implement base for pluggable policy drivers  https://review.openstack.org/57780712:09
*** aojea_ has joined #openstack-keystone12:23
cmurphykmalloc: can you proof the second section in https://etherpad.openstack.org/p/keystone-outreachy-proposals for me (also the first if you're interested)12:26
*** aojea_ has quit IRC12:48
openstackgerritJuan Antonio Osorio Robles proposed openstack/oslo.policy master: Implement base for pluggable policy drivers  https://review.openstack.org/57780713:04
*** mvkr has quit IRC13:05
*** shyam89 has quit IRC13:08
*** shyam89 has joined #openstack-keystone13:08
*** shyam89 has quit IRC13:14
*** aojea_ has joined #openstack-keystone13:23
*** mchlumsky has joined #openstack-keystone13:34
*** lbragstad has joined #openstack-keystone13:38
*** ChanServ sets mode: +o lbragstad13:38
openstackgerritJuan Antonio Osorio Robles proposed openstack/oslo.policy master: Implement base for pluggable policy drivers  https://review.openstack.org/57780714:09
kmallocYeah reading14:30
*** aojea_ has quit IRC14:34
openstackgerritLance Bragstad proposed openstack/keystone master: Implement scaffolding for upgrade checks  https://review.openstack.org/60878514:34
*** aojea_ has joined #openstack-keystone14:34
*** mvkr has joined #openstack-keystone14:36
kmalloccmurphy: there is only one thing else, we already have a start of a test_client impl in keystone.tests.unit.core14:37
kmalloccmurphy: looks good otherwise!14:37
lbragstadnot sure what people want to do about testing upgrade checks until we have one to implement14:39
lbragstadleft a note in ^ but that should be ready for review and consumption14:39
cmurphykmalloc: edited14:40
*** aojea_ has quit IRC14:41
lbragstadalso - if anyone can think of an upgrade check we should perform i'll take a stab at implementing and testing it14:42
cmurphylbragstad: i would start with anything in https://blueprints.launchpad.net/keystone/+spec/removed-as-of-rocky14:44
cmurphydoes this notice about the token_auth middleware apply still? https://docs.openstack.org/releasenotes/keystone/rocky.html#prelude14:45
lbragstadthe auth_token middleware one is a good one...14:47
lbragstadbut a deployment would already need to be running stein (and have removed that already) in order to run keystone-status upgrade check, right?14:48
cmurphywait no the check would need to be run before the upgrade happens14:49
cmurphyif the check is to check if it's safe to upgrade to stein14:49
lbragstadoh - right?14:50
cmurphyand i guess removed-as-of-rocky wouldn't apply because we're already on rocky14:50
lbragstadif we were implementing this last release maybe?14:50
lbragstadalso..14:51
lbragstadthings like https://review.openstack.org/#/c/543060/ tread a fine line between being a doctor check and an upgrade check14:51
cmurphywhy would it be a doctor check?14:52
lbragstadwe have doctor checks that inspect config14:52
cmurphyi think it's an upgrade check because you need to check for driver=sql before you should be allowed to upgrade14:53
cmurphymaybe it's both14:53
lbragstadoh - yeah i suppose that's a case14:53
lbragstadi was thinking of things that would "prevent" keystone from starting and ignored configuration options don't really fall into that category14:54
lbragstadin the case where driver=sql, should we return a failure or a warning?15:02
* lbragstad wonders if we should be asking mriedem these questions15:03
cmurphyif driver=sql in rocky and they try to upgrade to stein then keystone won't start15:04
cmurphyso i would think failure15:04
lbragstadhmm15:06
lbragstadi set keystone.conf [token] driver=sql and restarted keystone just fine?15:07
lbragstadi'm on master, btw15:07
cmurphycan you get a token?15:07
lbragstadyup15:09
lbragstadso - i think it's because we removed that option15:10
cmurphyoh15:10
lbragstadand if we have driver=sql set in configuration, keystone doesn't really care15:10
lbragstadbut if you do something like provider=fern15:10
lbragstadkeystone will fail15:10
lbragstadi suppose we could add checks for removed configuration options and say "hey, you have a deprecated option in your config that we're not using"15:13
cmurphy++15:13
lbragstadi guess we have three ways to do that15:14
*** gyee has joined #openstack-keystone15:14
lbragstadas a doctor check, an upgrade check that results in a warning, or an upgrade check that results in a failure15:14
*** aojea_ has joined #openstack-keystone15:15
*** Emine has quit IRC15:19
*** jrist has quit IRC15:23
*** Emine has joined #openstack-keystone15:25
*** munimeha1 has joined #openstack-keystone15:39
*** mvkr has quit IRC15:40
*** Guest10461 is now known as dims15:44
*** aojea_ has quit IRC15:48
openstackgerritAndreas Jaeger proposed openstack/keystone master: Replace openSUSE experimental check with newer version  https://review.openstack.org/60946515:58
*** mvkr has joined #openstack-keystone16:02
kmalloco/16:05
openstackgerritJuan Antonio Osorio Robles proposed openstack/oslo.policy master: Implement base for pluggable policy drivers  https://review.openstack.org/57780716:33
kmalloclbragstad, gagehugo_, ayoung, cmurphy: rebased the flask chain16:38
lbragstadsweet - i am going to get to that today16:38
kmalloconce the outstanding patches land, we're down to the last bits of flask (conversion) and all our APIs are flask.16:38
cmurphyty kmalloc16:38
kmalloctoday i should have the middleware converted, and then strip out all the old legacy code.16:39
lbragstadand then... we party16:39
kmallocwe're close.16:39
kmallocso close.16:39
lbragstadsweet sweet victory16:40
*** aojea_ has joined #openstack-keystone16:40
* cmurphy preps the champagne16:42
lbragstadcmurphy did you happen to catch that conversation in dev?16:49
cmurphyyeah kinda16:51
lbragstadok16:51
cmurphyso checks for usage of parameters that were removed and replaced by something else16:51
cmurphywould be good candidates16:52
cmurphyis the gist?16:52
lbragstadyeah - the FFU case makes that pretty clear16:52
lbragstadbut if that is the case, i'm not sure maintaining a big list of removed things is useful if we already take care of that in release notes?16:52
cmurphyi don't think member_role_{id,name} was replaced, right? just dropped because v216:52
cmurphyyeah probably not that useful16:53
lbragstadcorrect16:53
lbragstadi guess we don't have to merge the upgradecheck stuff immediately...16:53
lbragstadi was just hoping to have a better testing example than noops16:54
kmallochm16:58
kmalloclbragstad, cmurphy: is it worth moving away from KSM in keystone and implementing all the logic in a flask-native way?16:59
kmallocwe put a lot of effort into making authcontextmiddleware KSM with some additional keystone-specific "get token" logic16:59
cmurphykmalloc: that sounds like a giant pita17:00
kmallocthat said, if we keep AuthContext - we will forever maintain a dep on webob17:00
kmallocsince we subclass ksm17:00
kmallocit's not "really" just KSM.17:00
kmallocif it was, that would be one thing.17:00
lbragstadi think having KSM deployed with keystone makes keystone more like other services (and less of a snowflake)17:01
kmallocexcept we aren't *really* using KSM.17:01
kmallocwe have reimplemented almost all of KSM (except header processing) since tokens aren't retrieved via REST17:02
kmallocotherwise you have the issue of "X-Auth-Token" need X-Auth-Token to be processed to validate X-Auth-Token17:02
kmalloc:P17:02
kmallocit might be worth seeing if we can narrow down to where we use KSM and have a mechanism to plug in a "get token" function17:03
kmallocinstead of needing to re-implement process_requst, fetch_token, and all the extra bits.17:04
kmallocfor now i'll move json body and the other middlewares and leave ACM as is... but i really dislike how much we're re-implementing17:04
gyeekmalloc, lbragstad, we ran into a strange problem with keystone in rocky. Looks like the LBCHK method no longer supported. Do you guy recall getting rid of that one?17:04
kmallocLBCHK?17:05
gyeewe use LBCHK for HA configuration17:05
kmallocwhat is LBCHK17:05
gyeeload balancing check17:05
kmallocok, let me rephrase. where does it come from?17:05
kmallocis this the /healthcheck app?17:05
lbragstadwe supported that natively in keystone?17:05
gyeeyes17:05
kmallocit's located at /healthcheck17:06
kmallocbaked into keystone's app loading17:06
gyeeso curl -X LBCHK http://<keystone>:5000 used to work fine17:06
gyeenow its returning 40517:06
kmallochttps://github.com/openstack/keystone/blob/86cc778774bc6a561911be05075b4e3cdf6ef2b0/keystone/server/flask/application.py#L195-L19817:07
gyeewe are running rocky right now17:07
kmallocuhm17:07
lbragstadapparenly this wasn't tested?17:07
gyeedo we ever test HA?17:07
kmallocuhm17:07
kmallocLBCHK is not standard http17:08
kmallocthat isn't a method17:08
lbragstadi've never seen LBCHK before actually17:08
kmallocwe do not support methods outside of RFC17:08
kmalloc#117:08
kmalloc#2, who thought that was a good idea?17:08
kmalloc#3, you can curl /healthcheck17:08
kmallocand get the data17:09
kmalloc(standard GET)17:09
kmallocand see the old adage: If it isn't tested, it is broken17:09
gyeek, let me change it to /healthcheck instead17:10
kmallocyeah that should work.17:10
gyeeunfortunately I can't seem to dig up any history on that one17:10
gyeethanks guys!17:10
lbragstadif you find that history - please share it :)17:10
kmallocit's an old hack from the healthcheck middleware (nee app)17:10
kmallocbasically if you use PASTE healthcheck middleware gets the request early17:10
kmallocand can support custom HTTP methods.17:11
lbragstadmmm17:11
kmallocflask, we implement none of those.17:11
kmalloci could implement it but... ugh17:11
kmalloci didn't even realize someone used a custom HTTP method17:11
kmallocthat sounds like such a terrible idea.17:11
lbragstadyeah - me either17:11
* lbragstad finds calories 17:11
kmalloccmurphy: ok, so i'll do non-AuthContext middlewares and see if i can isolate the ACM overrides to be less "we need to implement all of KSM" and split apart the other bits to be more flask-native.17:12
gyeehey man, I inherited that shit :-)17:12
kmalloccmurphy: if i can do that, i'll implement a "get_token_func" argument for ksm and we can remove a lot of the extra cruft.17:13
kmallocgyee: heh17:13
cmurphykmalloc: ok17:13
kmallocgyee: can you implement a test for us (upstream): check that /healthcheck is working as expected?17:13
kmallocgyee: so we don't accidently regress on that.17:14
*** aojea_ has quit IRC17:14
kmallocgyee: should be a simple restful testcase.17:14
gyeekmalloc, in devstack?17:15
gyeeor just a simple functional test?17:16
openstackgerritMorgan Fainberg proposed openstack/keystone master: Convert S3 and EC2 auth to flask native dispatching  https://review.openstack.org/60950017:16
kmallocgyee: in unit testds17:16
kmallockeystone's*17:16
gyeekmalloc, k, let me work on it17:17
kmalloclbragstad, cmurphy: ^ converting EC2 and S3 to Flask = no more contrib directory :)17:17
gyeemeanwhile, let me update haproxy config to use healthcheck instead17:17
cmurphykmalloc: ooh17:17
kmalloccmurphy: fixing a minor issue wiuth that patch now.17:20
kmallocbut it's almost ready too.17:20
kmalloc(running unit tests locally)17:21
openstackgerritMorgan Fainberg proposed openstack/keystone master: Convert S3 and EC2 auth to flask native dispatching  https://review.openstack.org/60950017:23
kmalloccmurphy: ^ there we go.17:23
* cmurphy considers making coffee before reviewing flask patches17:23
kmalloccmurphy: also note, the skipped notification test is unskipped here: https://review.openstack.org/#/c/609159/217:24
kmalloccmurphy: yes. I support coffee for those patches.17:24
kmalloccmurphy: but just think, we are ... well super close to being done with the refactor of doom.17:25
kmallocDOOM I SAY, DOOM.17:25
cmurphyhttps://youtu.be/s2jvANh2aEc?t=317:26
*** Emine has quit IRC17:29
kmalloccmurphy: YES17:30
kmalloccmurphy: https://www.youtube.com/watch?v=DMSHvgaUWc817:31
cmurphy:)17:31
*** aojea has joined #openstack-keystone17:32
*** mvkr has quit IRC17:33
*** pcaruana has quit IRC17:55
kmallocLOL our json body middleware is doing a lot of extra work it shouldn't be doing :P17:55
kmalloc*eyeroll*17:56
kmallocor well, long since useless/unused work17:56
gyeekmalloc, lbragstad, finally dig up the history on LBCHK. To make a long story short, a custom method was used at the time because the health check logs flooded keystone.log, making it unusable.18:07
gyeesince now we have GET /healthcheck as opposed to GET /, we can now easily create a filter to filter out those from keystone logs18:09
kmalloc++18:11
kmalloc:)18:11
*** pcaruana has joined #openstack-keystone18:12
*** itlinux has quit IRC18:13
*** raildo has quit IRC18:17
kmalloccmurphy, lbragstad: can you find if we use "openstack.params" ENV anywhere except as a bit of throwaway logic in keystone's JSON Body middleware...18:19
kmalloci think... we don't use it anywhere18:20
cmurphykmalloc: idk what that is18:20
lbragstadwas it a request env thing?18:20
kmalloclbragstad: yeah.18:20
kmalloclbragstad: as far as i can tell, we set values in it... and drop it on the floor18:21
lbragstadhttp://paste.openstack.org/show/731861/18:21
kmallocnever to be referenced again18:21
cmurphyhttp://codesearch.openstack.org/?q=openstack%5C.params&i=nope&files=&repos=18:21
kmallocyeah18:21
kmallocok18:21
kmalloci'm dropping that code on the floor18:21
kmallocit is beyond useless18:21
kmalloc:P18:21
kmalloc*eyeroll*18:21
lbragstadhttps://git.openstack.org/cgit/openstack/keystone/tree/keystone/middleware/core.py#n7318:22
kmallocyep18:22
kmallocand we don't reference it after that18:22
kmallocbasically we're filtering things out and storing the data again in environ['openstack.params']18:22
cmurphymaybe it's not strictly useful to us but useful to someone debugging request headers?18:22
kmallocfor funzies18:22
kmalloccmurphy: we filter "context" "self" and "_" stuff out, but nothing anywhere references it18:23
lbragstadhttps://review.openstack.org/#/c/508410/18:23
cmurphyor maybe one of the monitoring projects used to use it18:23
kmalloclbragstad: ++18:23
cmurphylol18:23
kmallochehe18:23
lbragstadactually - that's just removing duplication18:24
cmurphyoh18:24
lbragstadand putting the definition of openstack.params in a single place18:24
lbragstadwhich is wsgi18:24
kmallocand like i said, we filter it and just leave it on the floor in memory forever18:24
kmalloc*shrug*18:24
cmurphymaybe jamielennox knows what it is then18:24
hrybackilbragstad: we found a weird bug is Pike/Queens (not appearing in rocky) that look related to https://bugs.launchpad.net/keystone/+bug/179111118:25
openstackLaunchpad bug 1791111 in OpenStack Identity (keystone) "allow change password upon first use as user" [Undecided,New]18:25
* lbragstad is pretty sure jamielennox knows the answers to everything 18:25
cmurphylbragstad: fact18:25
lbragstadhrybacki related to the original bug or related to the fix?18:25
kmallochrybacki: yeah we fixed that at some point18:25
hrybackitl;dr, if `change_password_upon_first_use` is true, users cant even login (cli/horizon)18:25
kmallochrybacki: there was some ick around it.18:25
hrybackihmm18:26
kmallochrybacki: it had to do with enforcement on the APIs18:26
lbragstadwell - we used to have a policy for it18:26
kmallocyou needed to login to change a password (iirc)18:26
lbragstadfor v2.018:26
kmallocand in rocky we fixed some of it18:26
*** raildo has joined #openstack-keystone18:26
kmallocyou *cant* login to keystone if you need to change you password18:26
lbragstadwell - we removed it so that we could do the policy validation based on password logic18:27
kmallocbut horizon now, i think has a "change password" that doesn't require login18:27
kmallocchange password is explicitly non-enforced API18:27
kmallocfor that reason18:27
hrybackikmalloc: hmm18:27
cmurphyi don't think you can change your password without logging into horizon18:27
hrybackilemme look for that18:27
hrybackifix18:27
*** mvkr has joined #openstack-keystone18:28
lbragstadwe've had a lot of questions/bugs around this specific area for a while18:32
lbragstadi know it was brought up a few times in denver18:32
hrybackiyeah, we have Cu. asking for (the fix) in queens18:33
hrybackithat fix landed in Rocky?18:34
lbragstadwhich fix?18:36
lbragstadhttps://bugs.launchpad.net/keystone/+bug/1791111 still needs to be verified18:36
openstackLaunchpad bug 1791111 in OpenStack Identity (keystone) "allow change password upon first use as user" [Undecided,New]18:36
hrybackilbragstad: maybe i misread kmalloc comment above. Our bug (https://bugzilla.redhat.com/show_bug.cgi?id=1628541) found that we were unable to reset the pass even through horizon18:42
openstackbugzilla.redhat.com bug 1628541 in openstack-keystone "change_password_upon_first_use=true should allow a user to change his password upon first use" [High,New] - Assigned to hrybacki18:42
hrybackiTrying to find a delta between Queens and Rocky18:43
kmallocyou can NEVER login to keystone wiht a locked (change password on first use) password18:44
kmallochorizon would need to handle that case with an explicit "change password form" that doesn't require login18:44
kmallocwhich may/may not be implemented18:45
kmallockeystone wont allow a login (as it shouldn't)18:45
cmurphyhorizon doesn't have that18:45
kmallocthis is why the change_password API is unprotected (you must have the original password to change password)18:45
kmallochrybacki: ^ then the behavior is expected, no login with first password change required.18:45
cmurphywe should have told the horizon team that when we implemented it...18:46
hrybackiahh18:46
kmallochrybacki: marked the bug as invalid, commented on it18:49
kmallocand added horizon to the bug18:49
hrybackithanks kmalloc. fk i type slow w/ one hand18:49
hrybackiI'll rope in internal horizon team to raise vis18:50
lbragstadrecreating that locally18:50
lbragstadand using osc is going to fail, too18:50
lbragstadfor the same reason18:50
lbragstadsince osc is going to ask keystone for a token (possibly for discovery stuff) and that is going to fail with a 40118:51
* hrybacki nods18:51
lbragstadso... does this mean we really only support change password at first use when using the rest API directly?18:51
hrybackiit would seem so18:51
hrybackiPCIDSS compliance issue18:52
kmallocit would be a gap in horizon's support in this case.18:54
kmalloclbragstad: we can't ever allow someone to login with a real token issued (it conveys "authN" and may be used if something allows keystone tokens) if the password/user is locked18:55
lbragstadyeah... it just goes against how all the other token/discovery stuff works18:58
lbragstadin those cases the clients would need to know to skip getting a token and just build the request from scratch and put that on the wite18:59
lbragstadwire*18:59
*** pcaruana has quit IRC19:03
kmallocwell then...19:31
kmallocoslo_serialization is just too damn clever19:31
kmallocwas trying to figure out why a test suddenly started failing...19:31
kmallocbecause jsonutils.loads(b'"test"') works19:32
kmallocwhere json.loads() raises the expected error19:32
kmalloc*eyeroll*19:32
*** dave-mccowan has quit IRC19:34
gagehugo_reading scrollback19:40
*** dave-mccowan has joined #openstack-keystone19:45
openstackgerritHarry Rybacki proposed openstack/keystone master: Convert projects API to Flask  https://review.openstack.org/60345119:50
*** blake has joined #openstack-keystone19:50
lbragstadkmalloc did you want to revert https://review.openstack.org/#/c/558193/ ?19:54
lbragstadi see your revert was abandon?19:55
*** pcaruana has joined #openstack-keystone19:55
cmurphyhe was grumpy about having to rebase19:55
gagehugo_hrybacki: that projects flask change is perfectly balanced19:56
lbragstadlol19:57
lbragstadwxy-xiyuan just catching up on the oslo.limit patches, let me know whenever you get a follow up to https://review.openstack.org/#/c/596520/ and i'll promptly review19:58
kmalloclbragstad: abandoned.20:02
kmallocnot needed20:02
lbragstadack - thanks20:02
*** pcaruana has quit IRC20:06
openstackgerritMorgan Fainberg proposed openstack/keystone master: Replace JSON Body middleware with flask-native func  https://review.openstack.org/60953520:14
kmalloccmurphy: ++ yes, i was worried it was going to be a huge rebase20:15
kmallocit was 3 lines.20:15
openstackgerritMorgan Fainberg proposed openstack/keystone master: Remove skip for test_locked_out_user_sends_notification  https://review.openstack.org/60915920:15
openstackgerritMorgan Fainberg proposed openstack/keystone master: Convert S3 and EC2 auth to flask native dispatching  https://review.openstack.org/60950020:15
openstackgerritMorgan Fainberg proposed openstack/keystone master: Replace JSON Body middleware with flask-native func  https://review.openstack.org/60953520:15
*** itlinux has joined #openstack-keystone20:46
*** Emine has joined #openstack-keystone21:00
*** Emine has quit IRC21:08
*** raildo has quit IRC21:14
openstackgerritMorgan Fainberg proposed openstack/keystone master: Cleanup keystone.server.flask.application  https://review.openstack.org/60954821:34
openstackgerritguang-yee proposed openstack/keystone master: add unit tests for healthcheck  https://review.openstack.org/60954921:34
*** jdennis has quit IRC21:36
*** blake has quit IRC21:37
*** jdennis has joined #openstack-keystone21:42
*** munimeha1 has quit IRC21:44
*** raildo has joined #openstack-keystone21:53
*** raildo has quit IRC21:54
openstackgerritguang-yee proposed openstack/keystone master: add unit tests for healthcheck  https://review.openstack.org/60954922:00
*** aojea has quit IRC22:08
*** rcernin has joined #openstack-keystone22:41
kmallocgyee: hehe, sorry one more -122:41
kmallocgyee: but... as you can see the new flask stuff makes things a lot easier ;)22:41
kmalloclbragstad: ok ok... i am having a weird issue22:42
kmalloclbragstad: i can't seem to make keystone work without the normalizing middleware.22:42
kmallocand it isn't because our URLs are weird.22:42
kmallocit... some side effect is happening when we do the webob specific mechanism for changing request.environ['PATH_INFO'] that doesn't work any other way.22:43
kmalloc... i'm baffled.22:43
kmallocreplicating the exact logic in a different manner doesn't seem to work, i get errors like "cannot find resource XXXX" where the only difference in the code base is the old middleware vs new way of doing the same exact thing22:43
gyeekmalloc, at this rate, there ain't any code left to write! :-D22:51
kmallocgyee thats the point!22:51
kmalloc:)22:51
gyeeseriously, I love the new paradigm. Very cool stuff.22:51
kmallocwrite only the "does this respond how i expect it to" code not all the other cruft22:51
gyeeall meat, no fat22:51
kmallocgyee: it's been ~10000 lines of code in the last few months to get here22:51
kmallocand i know way way way way way more about how all the crufty internals of keystone work now.22:52
gyeewow, good work22:52
kmallocgyee: https://review.openstack.org/#/q/topic:bug/1776504+(status:open+OR+status:merged)22:52
kmallocgyee: and https://review.openstack.org/#/q/topic:flaskification+(status:open+OR+status:merged)22:52
kmallocofficially had the first patch merge on 06/0422:53
kmallocand today is 10/10.22:53
gyeecode machine22:53
kmallocthe last of the outstanding patches posted convert the last of the major code in keystone to flask.22:53
kmalloci'm now fighting with something weird in the webob middleware(s)... that doesn't make sense.22:54
kmallocgyee: and we initially thought this project would be something an intern could do :P22:55
gyeeyou not kidding22:58
openstackgerritguang-yee proposed openstack/keystone master: add unit tests for healthcheck  https://review.openstack.org/60954923:02
*** aloga has quit IRC23:15
kmallocahahah amazing what you find when you remove all the application/webob processing :P23:22
kmallocthings like "render exception" cruft.23:22
*** aloga has joined #openstack-keystone23:27
kmallocwebob is all like https://www.youtube.com/watch?v=Sh8mNjeuyV423:29
*** mchlumsky has quit IRC23:46

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!