| *** jamesmcarthur has joined #openstack-keystone | 01:13 | |
| *** wxy-xiyuan has joined #openstack-keystone | 02:09 | |
| *** dklyle has quit IRC | 02:33 | |
| *** dklyle has joined #openstack-keystone | 02:48 | |
| *** jamesmcarthur has quit IRC | 02:58 | |
| *** jamesmcarthur has joined #openstack-keystone | 03:01 | |
| *** jamesmcarthur has quit IRC | 03:01 | |
| *** jamesmcarthur has joined #openstack-keystone | 03:01 | |
| *** dklyle has quit IRC | 03:20 | |
| *** markvoelker has joined #openstack-keystone | 03:54 | |
| openstackgerrit | zhufl proposed openstack/keystone master: Add missing ws between words in log messages https://review.opendev.org/683843 | 03:56 |
|---|---|---|
| *** markvoelker has quit IRC | 03:58 | |
| openstackgerrit | Merged openstack/keystone master: Make policy deprecation reasons less verbose https://review.opendev.org/674940 | 04:25 |
| *** dave-mccowan has quit IRC | 04:48 | |
| *** jamesmcarthur has quit IRC | 04:52 | |
| *** jamesmcarthur has joined #openstack-keystone | 04:53 | |
| *** Luzi has joined #openstack-keystone | 05:00 | |
| *** jamesmcarthur has quit IRC | 05:09 | |
| *** jamesmcarthur has joined #openstack-keystone | 05:09 | |
| *** jamesmcarthur has quit IRC | 05:13 | |
| *** jaosorior has joined #openstack-keystone | 05:43 | |
| *** jamesmcarthur has joined #openstack-keystone | 05:44 | |
| *** jamesmcarthur has quit IRC | 05:51 | |
| *** dancn has joined #openstack-keystone | 06:03 | |
| *** jamesmcarthur has joined #openstack-keystone | 06:20 | |
| *** jamesmcarthur has quit IRC | 06:25 | |
| *** tesseract has joined #openstack-keystone | 07:00 | |
| *** rcernin has quit IRC | 07:04 | |
| *** ivve has joined #openstack-keystone | 07:10 | |
| *** jamesmcarthur has joined #openstack-keystone | 07:13 | |
| *** xek has joined #openstack-keystone | 07:17 | |
| *** jamesmcarthur has quit IRC | 07:19 | |
| *** dancn has quit IRC | 07:26 | |
| *** dancn has joined #openstack-keystone | 07:29 | |
| *** pcaruana has joined #openstack-keystone | 07:41 | |
| *** f0o has quit IRC | 07:54 | |
| *** f0o has joined #openstack-keystone | 08:05 | |
| *** jamesmcarthur has joined #openstack-keystone | 08:15 | |
| *** jamesmcarthur has quit IRC | 08:20 | |
| *** dancn has quit IRC | 08:32 | |
| *** dancn has joined #openstack-keystone | 08:38 | |
| *** rcernin has joined #openstack-keystone | 08:45 | |
| *** markvoelker has joined #openstack-keystone | 08:57 | |
| *** markvoelker has quit IRC | 09:02 | |
| *** jamesmcarthur has joined #openstack-keystone | 09:16 | |
| *** jamesmcarthur has quit IRC | 09:21 | |
| *** awalende has joined #openstack-keystone | 09:39 | |
| *** dancn has quit IRC | 09:57 | |
| *** jamesmcarthur has joined #openstack-keystone | 10:17 | |
| *** jamesmcarthur has quit IRC | 10:23 | |
| *** jaosorior has quit IRC | 10:58 | |
| openstackgerrit | Merged openstack/keystone master: Allow system/domain scope for assignment tree list https://review.opendev.org/682762 | 11:05 |
| *** dave-mccowan has joined #openstack-keystone | 11:07 | |
| *** dancn has joined #openstack-keystone | 11:14 | |
| *** raildo has joined #openstack-keystone | 11:18 | |
| *** jamesmcarthur has joined #openstack-keystone | 11:19 | |
| *** dave-mccowan has quit IRC | 11:21 | |
| *** dave-mccowan has joined #openstack-keystone | 11:23 | |
| *** jamesmcarthur has quit IRC | 11:24 | |
| *** rcernin has quit IRC | 11:49 | |
| *** markvoelker has joined #openstack-keystone | 12:03 | |
| *** jamesmcarthur has joined #openstack-keystone | 12:20 | |
| *** jamesmcarthur has quit IRC | 12:25 | |
| lbragstad_ | o/ | 12:28 |
| *** rcernin has joined #openstack-keystone | 12:33 | |
| *** lbragstad_ is now known as lbragstad | 12:39 | |
| *** jamesmcarthur has joined #openstack-keystone | 12:45 | |
| *** mloza has joined #openstack-keystone | 13:02 | |
| *** jaosorior has joined #openstack-keystone | 13:11 | |
| *** Luzi has quit IRC | 13:14 | |
| *** beekneemech is now known as bnemec | 13:24 | |
| *** dklyle has joined #openstack-keystone | 13:44 | |
| *** jamesmcarthur has quit IRC | 13:44 | |
| *** rcernin has quit IRC | 13:45 | |
| *** dklyle has quit IRC | 13:50 | |
| *** redrobot has quit IRC | 13:53 | |
| *** Guest30550 has joined #openstack-keystone | 14:05 | |
| *** Guest30550 is now known as redrobot | 14:08 | |
| *** dklyle has joined #openstack-keystone | 14:31 | |
| ivve | greetings! is /etc/keystone/credential-keys/ used if fernet is used? | 14:37 |
| ivve | keystone complains about key_repository not having proper permissions (it doesn't exist) | 14:38 |
| ivve | improper* | 14:38 |
| lbragstad | cmorpheus kmalloc we might need to sync on https://review.opendev.org/#/c/621023/12//COMMIT_MSG@15 | 14:38 |
| lbragstad | ivve fernet is an encryption strategy used in keystone, but we use it for tokens and credentials | 14:39 |
| ivve | ye but other methods can be used | 14:39 |
| ivve | and i guess my question is if fernet is utilizing the directory from the error message | 14:39 |
| lbragstad | what's the error message? | 14:40 |
| ivve | mostly because it appeared now for me in a stein upgrade and i've been using fernet for a great while now | 14:40 |
| ivve | Either [None] key_repository does not exist or Keystone does not have sufficient permission to access it: /etc/keystone/credential-keys/ | 14:40 |
| ivve | i skimmed through the code and well its just a check | 14:40 |
| ivve | im using kolla so the keystone containers (keystone & keystone_fernet) doesn't create that directory if using fernet keys | 14:41 |
| ivve | or tokens.. | 14:41 |
| lbragstad | the /etc/keystone/credentials-keys directory is only used if you're using the /v3/credentials API | 14:41 |
| lbragstad | all fernet keys for token encryption should live in /etc/keystone/fernet-keys by default | 14:42 |
| ivve | exactly | 14:42 |
| ivve | so they are where they should be | 14:42 |
| ivve | so what is credential-keys used for? :) | 14:42 |
| lbragstad | credential-keys are used to encrypt credential secrets at rest | 14:43 |
| ivve | aaaaah | 14:43 |
| lbragstad | http://specs.openstack.org/openstack/keystone-specs/specs/keystone/newton/credential-encryption.html | 14:43 |
| ivve | i see | 14:43 |
| lbragstad | specifically the /v3/credentials API | 14:43 |
| ivve | so im guessing kolla or kolla-ansible bug | 14:44 |
| lbragstad | unfortunately, the naming "credentials" is confusing with passwords and whatnot | 14:44 |
| ivve | since they don't create the directory | 14:44 |
| lbragstad | they technically don't need it - but yeah | 14:44 |
| ivve | yeah i guess thats what caught me | 14:44 |
| ivve | well the check in the .py does spit an error if the dir doesn't exist and also with at least xx0 permissions | 14:44 |
| ivve | im guessiong even 600 is lowest possible | 14:45 |
| ivve | its just annoying and the loglevel is warning as you say, probably not needed | 14:46 |
| ivve | well thanks for clearing that up lbragstad o7 | 14:47 |
| lbragstad | ivve yep! | 14:48 |
| *** jamesmcarthur has joined #openstack-keystone | 14:54 | |
| *** awalende has quit IRC | 14:58 | |
| *** pcaruana has quit IRC | 15:05 | |
| *** timburke_ is now known as timburke | 15:15 | |
| openstackgerrit | Merged openstack/oslo.policy master: Fix reference cycle caused by deprecated sample override https://review.opendev.org/682150 | 15:19 |
| *** jamesmcarthur has quit IRC | 15:30 | |
| cmorpheus | lbragstad: o/ | 15:34 |
| *** cmorpheus is now known as cmurphy | 15:34 | |
| lbragstad | mornin' cmurphy | 15:34 |
| gagehugo | o/ | 15:35 |
| *** dklyle has quit IRC | 15:36 | |
| *** dklyle has joined #openstack-keystone | 15:36 | |
| cmurphy | lbragstad: do you have an example of the check string that that didn't work for limits? | 15:37 |
| cmurphy | i feel like strategic use of "and not" could help here | 15:38 |
| lbragstad | well - i think the check string was fine | 15:39 |
| lbragstad | i think i was using "identity:get_limit" | 15:39 |
| lbragstad | but the problem was that i was trying to use that check string for project *and* domain limits | 15:39 |
| lbragstad | and depending on the request - either a project or domain is going to be the target | 15:40 |
| lbragstad | and iirc oslo.policy didn't know to check for project as the target versus domain as the target | 15:40 |
| cmurphy | so it was something like 'project_id:%(target.limit.project_id)s or domain_id:%(target.limit.domain.id)s or domain_id:%(target.limit.project.domain_id)s' ? | 15:45 |
| cmurphy | what if we build the target after checking the context for the scope in https://review.opendev.org/#/c/621023/12/keystone/api/limits.py ? | 15:48 |
| *** dave-mccowan has quit IRC | 15:49 | |
| lbragstad | so - with | 15:57 |
| lbragstad | 'project_id:%(target.limit.project_id)s or domain_id:%(target.limit.domain.id)s or domain_id:%(target.limit.project.domain_id)s' | 15:57 |
| lbragstad | if you call GET /v3/limits/$DOMAIN_ID with a domain-scoped token, then the project_id:%(target.limit.project_id)s portion of the check is going to be successful | 15:58 |
| lbragstad | sorry - GET /v3/limits/$DOMAIN_LIMIT_ID | 15:58 |
| cmurphy | but there should be no project in the limit object in the target? | 15:59 |
| lbragstad | right | 15:59 |
| lbragstad | it's true because both are None | 15:59 |
| cmurphy | oh hrm | 16:00 |
| cmurphy | i think the policy engine can check for None | 16:00 |
| lbragstad | oh? | 16:01 |
| lbragstad | so we do something like (project_id:%(target.limit.project_id)s and project_id:!None) | 16:01 |
| cmurphy | https://opendev.org/openstack/keystone/src/branch/master/keystone/common/policies/grant.py#L30 | 16:02 |
| cmurphy | so it might be more like (project_id:%(target.limit.project_id)s and not None:%(target.limit.project_id)s) | 16:02 |
| lbragstad | oh - nice! | 16:02 |
| lbragstad | it's going to be one real long policy.. but o well | 16:03 |
| lbragstad | if that works that'd be awesome | 16:03 |
| *** pcaruana has joined #openstack-keystone | 16:06 | |
| *** problem_v has joined #openstack-keystone | 16:41 | |
| *** dtruong has joined #openstack-keystone | 16:41 | |
| *** pcaruana has quit IRC | 16:46 | |
| *** dancn has quit IRC | 16:57 | |
| kmalloc | not 100% sure the "None" is in-fact translated like that | 17:10 |
| kmalloc | because there has historically been no way to look for non-existence | 17:10 |
| kmalloc | i've been advocating for non-existence which a None check would be good enough to handle | 17:10 |
| kmalloc | so... maybe you solved a concern I had | 17:11 |
| *** jmlowe has quit IRC | 17:19 | |
| *** jamesmcarthur has joined #openstack-keystone | 17:25 | |
| *** jamesmcarthur_ has joined #openstack-keystone | 17:28 | |
| *** jamesmcarthur has quit IRC | 17:32 | |
| *** jamesmcarthur_ has quit IRC | 17:34 | |
| *** jamesmcarthur has joined #openstack-keystone | 17:34 | |
| *** jamesmcarthur has quit IRC | 17:39 | |
| *** jamesmcarthur has joined #openstack-keystone | 17:39 | |
| *** jmlowe has joined #openstack-keystone | 17:44 | |
| *** jamesmcarthur has quit IRC | 17:59 | |
| *** Ben78 has joined #openstack-keystone | 18:29 | |
| *** jmlowe has quit IRC | 19:42 | |
| *** pcaruana has joined #openstack-keystone | 19:43 | |
| *** dave-mccowan has joined #openstack-keystone | 19:50 | |
| *** markvoelker has quit IRC | 20:07 | |
| *** jmlowe has joined #openstack-keystone | 20:10 | |
| *** pcaruana has quit IRC | 20:12 | |
| *** Ben78 has quit IRC | 20:12 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: WIP: use testresources for sharing across unit tests https://review.opendev.org/684127 | 20:20 |
| cmurphy | lbragstad: kmalloc ^ been banging my head against that for a while, i think stestr is working against us wrt testresources | 20:21 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Use immutable roles in tests https://review.opendev.org/684128 | 20:26 |
| *** xek has quit IRC | 21:05 | |
| *** tesseract has quit IRC | 21:23 | |
| *** rcernin has joined #openstack-keystone | 21:38 | |
| *** rcernin has quit IRC | 21:40 | |
| *** rcernin has joined #openstack-keystone | 21:40 | |
| *** raildo has quit IRC | 21:45 | |
| *** markvoelker has joined #openstack-keystone | 21:53 | |
| *** markvoelker has quit IRC | 21:58 | |
| *** adriant has quit IRC | 22:39 | |
| *** ivve has quit IRC | 22:40 | |
| *** tkajinam has joined #openstack-keystone | 23:01 | |
| *** adriant has joined #openstack-keystone | 23:12 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!