| *** jamesmcarthur has quit IRC | 00:14 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:18 | |
| *** jamesmcarthur has quit IRC | 00:20 | |
| *** ivve has quit IRC | 00:33 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:39 | |
| *** jamesmcarthur has quit IRC | 00:45 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:52 | |
| *** jamesmcarthur has quit IRC | 00:58 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:14 | |
| *** jamesmcarthur has quit IRC | 01:14 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:15 | |
| *** jamesmcarthur has quit IRC | 01:33 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:17 | |
| *** jamesmcarthur has quit IRC | 02:36 | |
| *** ileixe has quit IRC | 05:29 | |
| *** ileixe has joined #openstack-keystone | 05:32 | |
| *** Luzi has joined #openstack-keystone | 06:11 | |
| *** awalende has joined #openstack-keystone | 06:16 | |
| *** awalende has quit IRC | 06:20 | |
| *** ileixe has quit IRC | 06:51 | |
| *** ileixe has joined #openstack-keystone | 06:52 | |
| *** rcernin has quit IRC | 07:04 | |
| *** jamesmcarthur has joined #openstack-keystone | 07:39 | |
| *** tkajinam has quit IRC | 08:02 | |
| *** tesseract has joined #openstack-keystone | 08:15 | |
| *** jamesmcarthur has quit IRC | 08:21 | |
| *** jamesmcarthur has joined #openstack-keystone | 08:23 | |
| *** jamesmcarthur has quit IRC | 08:28 | |
| viks___ | Aws access/secret keys looks like below: | 08:28 |
|---|---|---|
| viks___ | ``` | 08:28 |
| viks___ | aws_access_key_id=AKIAIOSFODNN7EXAMPLE | 08:28 |
| viks___ | aws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY | 08:28 |
| viks___ | ``` | 08:28 |
| viks___ | But Openstack generated ec2 access/secret keys are like: | 08:28 |
| viks___ | ``` | 08:28 |
| viks___ | aws_access_key_id=25a85cd8618c43f09e7fd9222c1b1424 | 08:28 |
| viks___ | aws_secret_access_key=b41e5049be68439db01054cca6bbf5c0 | 08:28 |
| viks___ | ``` | 08:28 |
| viks___ | why it looks different format? Anyone has any idea? Is it possible to generate something similar to aws ec2 using keystone? | 08:28 |
| viks___ | for the above, do we need to create them explicitly as mentioned here -> https://docs.openstack.org/api-ref/identity/v3/?expanded=create-credential-detail#credentials ? | 08:37 |
| *** jamesmcarthur has joined #openstack-keystone | 08:38 | |
| *** ivve has joined #openstack-keystone | 08:46 | |
| *** jaosorior has joined #openstack-keystone | 08:48 | |
| *** jamesmcarthur has quit IRC | 09:07 | |
| *** jamesmcarthur has joined #openstack-keystone | 09:12 | |
| *** awalende has joined #openstack-keystone | 09:16 | |
| *** jamesmcarthur has quit IRC | 09:17 | |
| *** awalende has quit IRC | 09:18 | |
| *** awalende has joined #openstack-keystone | 09:26 | |
| *** awalende has quit IRC | 09:30 | |
| *** awalende has joined #openstack-keystone | 09:36 | |
| *** awalende has quit IRC | 09:37 | |
| *** jamesmcarthur has joined #openstack-keystone | 09:38 | |
| *** ileixe has quit IRC | 09:40 | |
| *** ileixe has joined #openstack-keystone | 09:41 | |
| *** jamesmcarthur has quit IRC | 09:42 | |
| *** ileixe has quit IRC | 10:10 | |
| *** pcaruana has joined #openstack-keystone | 10:10 | |
| *** ileixe has joined #openstack-keystone | 10:11 | |
| *** jamesmcarthur has joined #openstack-keystone | 10:12 | |
| *** jamesmcarthur has quit IRC | 10:17 | |
| *** rcernin has joined #openstack-keystone | 10:52 | |
| *** jamesmcarthur has joined #openstack-keystone | 10:59 | |
| *** jamesmcarthur has quit IRC | 11:04 | |
| *** awalende has joined #openstack-keystone | 11:14 | |
| *** awalende has quit IRC | 11:14 | |
| *** awalende has joined #openstack-keystone | 11:20 | |
| *** awalende has quit IRC | 11:21 | |
| *** raildo has joined #openstack-keystone | 11:47 | |
| *** tellesnobrega has quit IRC | 11:50 | |
| *** jamesmcarthur has joined #openstack-keystone | 12:00 | |
| *** jamesmcarthur has quit IRC | 12:05 | |
| *** rcernin has quit IRC | 12:31 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:02 | |
| *** jamesmcarthur has quit IRC | 13:08 | |
| *** jamesmcarthur_ has joined #openstack-keystone | 13:08 | |
| *** sapd1 has quit IRC | 13:16 | |
| *** jamesmcarthur_ has quit IRC | 13:33 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:50 | |
| *** yan0s has joined #openstack-keystone | 13:52 | |
| *** awalende has joined #openstack-keystone | 13:55 | |
| *** awalende has quit IRC | 14:26 | |
| *** beekneemech is now known as bnemec | 14:29 | |
| *** jamesmcarthur has quit IRC | 14:53 | |
| *** Luzi has quit IRC | 14:59 | |
| *** tesseract has quit IRC | 15:01 | |
| *** tesseract has joined #openstack-keystone | 15:01 | |
| *** jamesmcarthur has joined #openstack-keystone | 15:05 | |
| *** jamesmcarthur has quit IRC | 15:08 | |
| *** jamesmcarthur has joined #openstack-keystone | 15:08 | |
| *** spatel has joined #openstack-keystone | 15:19 | |
| spatel | cmurphy: morning | 15:20 |
| spatel | my keystone successfully integrated with LDAP (as you suggested) | 15:21 |
| spatel | LDAP for identitet and SQL for assignments | 15:21 |
| *** dklyle has quit IRC | 15:57 | |
| *** dklyle has joined #openstack-keystone | 15:58 | |
| *** gyee has joined #openstack-keystone | 16:02 | |
| *** jmlowe has joined #openstack-keystone | 16:06 | |
| *** jamesmcarthur_ has joined #openstack-keystone | 16:20 | |
| *** jamesmcarthur has quit IRC | 16:23 | |
| *** jamesmcarthur has joined #openstack-keystone | 16:53 | |
| *** jamesmcarthur_ has quit IRC | 16:56 | |
| *** jamesmcarthur has quit IRC | 17:01 | |
| *** jamesmcarthur has joined #openstack-keystone | 17:01 | |
| *** jamesmcarthur has quit IRC | 17:01 | |
| *** yan0s has quit IRC | 17:02 | |
| *** jmlowe has quit IRC | 17:04 | |
| *** jamesmcarthur has joined #openstack-keystone | 17:32 | |
| *** mvkr has quit IRC | 18:32 | |
| cmurphy | spatel: great! | 18:40 |
| spatel | cmurphy: thinking to put it on my blog so people don't need to struggle, because i haven't see any blog using latest openstack code so its confusing with current code.. | 18:42 |
| cmurphy | ++ | 18:42 |
| spatel | cmurphy: now i need to figure out how to hide password in teraform :) | 18:45 |
| spatel | is it possible i can ask keystone to give me token and i put that token in teraform file ? | 18:45 |
| cmurphy | spatel: the token is just as sensitive as a password, and it expires so you would have to update your terraform file | 18:47 |
| cmurphy | spatel: you could use application credentials instead https://docs.openstack.org/keystone/latest/user/application_credentials.html | 18:47 |
| spatel | very interesting... | 18:48 |
| spatel | let me explore.. | 18:48 |
| *** tesseract has quit IRC | 18:52 | |
| *** renich has joined #openstack-keystone | 20:06 | |
| renich | Good day | 20:06 |
| renich | I just upgraded to Train and it is not clear to me how to upgrade. I understand that there are some roles that should be made immutable, but I don't get it. How do I make them so? | 20:06 |
| renich | https://paste.centos.org/view/a5070919 | 20:06 |
| renich | That's what the check says | 20:06 |
| *** jmlowe has joined #openstack-keystone | 20:16 | |
| renich | I am trying to look for a specific instruction on how to upgrade the roles to be immutable but can't find it. They only command referenced is `keystone-manage bootstrap --immutable-roles` | 20:18 |
| renich | Any tips? I am kind of desperate here (in the middle of an upgrade) | 20:21 |
| renich | My theory is that I need to edit: keystone.policy.yaml but I don't really know how. | 20:22 |
| renich | How can I make roles immutable? | 20:38 |
| cmurphy | renich: thanks for pointing out that we're missing a bit of documentation :( to make roles immutable you need to update the "options" attribute of the role to have "immutable": true , documentation on resource options is here https://docs.openstack.org/keystone/latest/admin/resource-options.html it unfortunately doesn't mention "immutable" yet and the CLI doesn't cover it, it needs to be done with | 20:50 |
| cmurphy | curl :/ | 20:50 |
| renich | cmurphy: phew! Thanks! | 20:51 |
| renich | will try it | 20:51 |
| cmurphy | renich: it's also not fatal to leave it as-is, it's just letting you opt into safer behavior | 20:52 |
| cmurphy | so feel free to ignore it | 20:52 |
| renich | cmurphy: it's not fatal? hmm... then I have some other issue. Keystone isn't responding after upgrade then. As in `openstack user list` doesn't work after sourcing admin-openrc | 20:52 |
| cmurphy | renich: that's a different issue then | 20:53 |
| cmurphy | renich: what does "doesn't work" mean? i would check the keystone logs first | 20:53 |
| renich | look: RESP BODY: {"error":{"code":403,"message":"You are not authorized to perform the requested action: identity:list_users.","title":"Forbidden"}} | 20:55 |
| cmurphy | renich: do you have custom policy rules? as in do you have anything in /etc/keystone/keystone.{json,yaml} ? | 20:55 |
| renich | cmurphy: nothing that I know of. | 20:56 |
| renich | I just have keystone.policy.yaml | 20:56 |
| renich | And it's vanilla | 20:56 |
| cmurphy | renich: all policies are defined in-code now so unless you have a specific reason for overriding rules you should have no policy.yaml file | 20:57 |
| *** raildo has quit IRC | 20:57 | |
| renich | cmurphy: OK, I will remove it | 20:58 |
| renich | 2019-11-18 20:58:54.856 16006 WARNING keystone.server.flask.application [req-46d8514d-9911-412c-802d-4fd8c9dd96f7 6ac28ce8518e4695b99af55b887ae3d4 7547634d002648b182845a58dfd3a89e - default default] You are not authorized to perform the requested action: identity:list_users.: keystone.exception.ForbiddenAction: You are not authorized to perform the requested action: identity:list_users. | 20:59 |
| *** gagehugo94 has joined #openstack-keystone | 21:00 | |
| *** gagehugo94 has quit IRC | 21:01 | |
| renich | cmurphy: how would you do the immutable option setting with curl? never done the auth part using curl. I know I need to use something like: curl -X POST -d "@immutable.json" localhost:5000/v3/users/ | 21:01 |
| cmurphy | renich: you need to get your admin user working first | 21:02 |
| renich | ah, OK... damn. | 21:02 |
| cmurphy | don't worry about the immutable option until keystone is working | 21:02 |
| cmurphy | hmm if you have an old deployment you may not have implied roles set up, if you are using the new default policies then your old admin user might not have role:reader <-- lbragstad did we account for that at all? | 21:02 |
| renich | I was one release behind | 21:06 |
| lbragstad | cmurphy we might have assumed someone needs to run keystone-manage bootstrap | 21:08 |
| renich | what happens to my users if I run keystone-manage bootstrap? | 21:08 |
| lbragstad | renich keystone-manage bootstrap will detect conflicts if the entities it's trying to create already exist | 21:09 |
| renich | lbragstad: OK, but it will not delete the users, right? So I can safely run it? | 21:09 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: WIP - Change time faking for totp test https://review.opendev.org/684397 | 21:09 |
| cmurphy | renich: yes it is safe to run | 21:09 |
| lbragstad | yes - it won't delete your users, it's only concerned with the admin user | 21:10 |
| cmurphy | it also looks like it does ensure_implied_roles so it will update existing roles | 21:10 |
| renich | cmurphy: OK. I will try running it to see if it fixes stuff... | 21:10 |
| renich | one question though, which password is it asking for? | 21:10 |
| renich | the admin's password? | 21:10 |
| lbragstad | renich yeah - it's asking for the admin password, but keep in mind that it will set the password | 21:10 |
| renich | OK | 21:11 |
| lbragstad | keystone-manage bootstrap doesn't use the password you supply it to authenticate in any way | 21:11 |
| lbragstad | so - if you have an existing admin user and you supply a new password, the admin user is going to have their password reset | 21:11 |
| lbragstad | (new password == something different than the original password) | 21:11 |
| renich | lbragstad: OK | 21:12 |
| renich | after running: keystone-manage bootstrap --bootstrap-password=somepass --immutable-roles; I get nothing | 21:16 |
| renich | is it useful if I show you values on the DB? | 21:16 |
| *** awalende has joined #openstack-keystone | 21:16 | |
| lbragstad | renich you should be able to query keystone through the API to view relationships between roles | 21:16 |
| renich | how? | 21:17 |
| lbragstad | renich `openstack implied role list` | 21:20 |
| lbragstad | here's an example of what's returned to me on my system http://paste.openstack.org/show/786297/ | 21:20 |
| *** awalende has quit IRC | 21:21 | |
| renich | lbragstad: 2019-11-18 21:26:14.423 30072 WARNING keystone.server.flask.application [req-d6df9810-2db1-495f-b760-32adb5e7ed86 6ac28ce8518e4695b99af55b887ae3d4 7547634d002648b182845a58dfd3a89e - default default] You are not authorized to perform the requested action: identity:list_role_inference_rules.: keystone.exception.ForbiddenAction: You are not authorized to perform the requested action: identity:list_role_inference_rules. | 21:26 |
| *** awalende has joined #openstack-keystone | 21:26 | |
| renich | root@controller1.zrh:/etc/keystone# ls | 21:26 |
| renich | credential-keys default_catalog.templates fernet-keys keystone.conf keystone.conf.dpkg-dist logging.conf old ssl sso_callback_template.html | 21:26 |
| renich | I have no policy.yaml and it keeps telling me I am not allowed to perform the action | 21:27 |
| renich | lbragstad: when I ran bootstrap (with all the settings), I get this: https://paste.centos.org/view/41d65b15 | 21:30 |
| *** awalende has quit IRC | 21:31 | |
| renich | Also, when running the upgrade check after the bootstrap, I get this: https://paste.centos.org/view/33cb24fa | 21:32 |
| renich | it changed. Before, admin was the one with the failure. Now, the roles are. | 21:33 |
| renich | Oh, I really hope we can figure this out. <gulp>... | 21:34 |
| lbragstad | which user are you using? | 21:36 |
| renich | lbragstad: admin | 21:36 |
| lbragstad | are you using a clouds.yaml file? | 21:36 |
| renich | lbragstad: no | 21:36 |
| *** awalende has joined #openstack-keystone | 21:36 | |
| lbragstad | can you get a system-scoped token instead? | 21:37 |
| renich | lbragstad: sure, tell me how. | 21:37 |
| lbragstad | http://paste.openstack.org/show/786299/ | 21:37 |
| lbragstad | that's the difference between using a project-scoped token to access the implied role api and using a system-scoped token | 21:38 |
| renich | root@controller1.zrh:/etc/keystone# cat /etc/openstack/clouds.yaml | 21:38 |
| renich | cat: /etc/openstack/clouds.yaml: No such file or directory | 21:38 |
| lbragstad | that's fine... you can put that file there or keep it in your local directly | 21:38 |
| lbragstad | directory* | 21:38 |
| renich | ah, OK. You want me to set that up | 21:38 |
| lbragstad | or you can just specify things on the command line when you make that call | 21:39 |
| lbragstad | you don't have to use clouds.yaml | 21:39 |
| lbragstad | it's just my preference | 21:39 |
| renich | oh, OK | 21:39 |
| lbragstad | here's the documentation if you want to read up on it - https://docs.openstack.org/os-client-config/latest/user/configuration.html | 21:39 |
| lbragstad | are you using an rc file then? | 21:39 |
| renich | lbragstad: thanks. | 21:39 |
| renich | Yes, I am | 21:39 |
| renich | lbragstad: thank you for the clouds.yaml tip. It's useful. | 21:40 |
| lbragstad | ok - if you crack it open, do you see OS_PROJECT_NAME or OS_PROJECT_ID? | 21:40 |
| *** awalende has quit IRC | 21:40 | |
| renich | OS_PROJECT_NAME | 21:41 |
| lbragstad | ok - you're getting a project-scoped token then | 21:41 |
| lbragstad | you can test this by doing an `openstack token issue` | 21:41 |
| renich | works | 21:41 |
| renich | project_id and user_id | 21:41 |
| lbragstad | yeah - so that's a project-scoped token, you'll need a system-scoped token to access the implied roles API | 21:42 |
| renich | OK. How do I get it? | 21:42 |
| lbragstad | you'll need to create or copy a new rc file that removes the OS_PROJECT_NAME parameter and replaces it with OS_SYSTEM_SCOPE | 21:43 |
| renich | OK | 21:43 |
| lbragstad | i think i set OS_SYSTEM_SCOPE = all | 21:43 |
| renich | done and sources | 21:44 |
| lbragstad | when you source your system rc file, make sure you unset OS_PROJECT_NAME from your env | 21:44 |
| renich | sourced* | 21:44 |
| renich | and user list works! | 21:44 |
| lbragstad | if you do `openstack token issue` you should get a token back but it will have a slightly different structure than the project-scoped one you just created a few minutes ago | 21:45 |
| lbragstad | instead of a project field, you'll see system | 21:45 |
| renich | Yes. I do. | 21:45 |
| lbragstad | https://docs.openstack.org/keystone/latest/contributor/services.html#authorization-scopes describes the concept behind system-scope, domain-scope, and project-scope | 21:46 |
| *** awalende has joined #openstack-keystone | 21:46 | |
| lbragstad | renich additionally, you should be able to list implied roles, too | 21:46 |
| lbragstad | `openstack implied role list` | 21:46 |
| renich | http://paste.openstack.org/show/786300/ | 21:47 |
| lbragstad | looks like it worked | 21:47 |
| renich | yes, but how will my other users access it now? (if you can't use OS_PROJECT_NAME) | 21:48 |
| lbragstad | if you have other users that need access to the user API then they should probably have system role assignemnts | 21:49 |
| lbragstad | assignments* | 21:49 |
| lbragstad | (and they'll have their own rc files or clouds.yaml profiles) | 21:49 |
| renich | lbragstad: I don't quite follow. Do I need to create system role assignments for them? | 21:51 |
| lbragstad | if they need access to system-specific resources, you'll need to grant them authorization on the system | 21:51 |
| lbragstad | yeah - you'll do that by creating system-role assignments | 21:51 |
| renich | OK, I'll need to read-on then. | 21:52 |
| renich | Basically, we only have swift. | 21:52 |
| renich | And they require access to their object storage. | 21:52 |
| lbragstad | `openstack role add --user alice --system all admin` | 21:52 |
| lbragstad | that doc that i linked earlier explains most of this better than i can | 21:52 |
| renich | lbragstad: thanks! You saved my life. I'll have to read-on so I can re-create this | 21:53 |
| lbragstad | renich glad i could help - good luck | 21:53 |
| renich | lbragstad: thanks a lot. | 21:53 |
| lbragstad | no problem | 21:54 |
| *** awalende has quit IRC | 21:56 | |
| *** awalende has joined #openstack-keystone | 21:57 | |
| cmurphy | lbragstad: an upgrade to train shouldn't have broken renich's project-admin role assignments i'm pretty sure | 22:00 |
| cmurphy | renich: did you change anything in keystone.conf when you upgraded? do you have [oslo_policy]/enforce_scope set to anything? | 22:01 |
| renich | cmurphy: no. I tried with the oslo_policy force suggestion, but switched back | 22:01 |
| renich | cmurphy: http://paste.openstack.org/show/786301/ | 22:03 |
| renich | I see these messages as well: | 22:05 |
| renich | 2019-11-18 22:00:41.900 30072 WARNING keystone.common.rbac_enforcer.enforcer [req-2b8b614a-97c3-4198-8ba0-d34be7cbc31a 6ac28ce8518e4695b99af55b887ae3d4 - - default -] Deprecated policy rules found. Use oslopolicy-policy-generator and oslopolicy-policy-upgrade to detect and resolve deprecated policies in your configuration. | 22:05 |
| *** awalende has quit IRC | 22:07 | |
| *** awalende has joined #openstack-keystone | 22:07 | |
| cmurphy | renich: that message is meant to encourage you to switch to system scope but the deprecations are there because we don't want to break your old configuration, but it looks like somehow we did | 22:08 |
| *** awalende_ has joined #openstack-keystone | 22:08 | |
| renich | cmurphy: OK. I want to migrate if we are required to. I just need to figure it out now for my users. We only use swift and I can't seem to access it now. Reading into what lbragstad provided. | 22:09 |
| cmurphy | swift doesn't support system scope yet, that's part of why the old policies should still have worked. if you change back to project scope you should be able to access swift. | 22:11 |
| *** awalende has quit IRC | 22:12 | |
| renich | cmurphy: how can I do that? The only thing we did was change the openrc file | 22:13 |
| cmurphy | renich: the openrc file is setting environment variables, so either manually change the environment variables back or create a different openrc file with the old project scope settings and source it, or use a clouds.yaml file as lbragstad mentioned | 22:15 |
| renich | cmurphy: OK, I still have my old openrc file. The one that has OS_PROJECT_NAME | 22:17 |
| renich | cmurphy: but, when I try to use it, it tells me: You are not authorized to perform the requested action: identity:list_endpoints. (HTTP 403) (Request-ID: req-e425d327-9ba4-4552-8e43-2c4c008453d4) | 22:18 |
| renich | What I mean by "use it" is: source admin-openrc; openstack endpoint list | 22:18 |
| renich | Now, `openstack container list` gives me a whole different issue: openstack container list | 22:18 |
| renich | Unable to establish connection to http://os.zrh.cloudsigma.com:8080/v1/AUTH_7547634d002648b182845a58dfd3a89e: HTTPConnectionPool(host='os.zrh.cloudsigma.com', port=8080): Max retries exceeded with url: /v1/AUTH_7547634d002648b182845a58dfd3a89e?format=json (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f878ea60a58>: Failed to establish a new connection: [Errno 111] Connection refused',)) | 22:19 |
| renich | oh, swift might not be running... checking | 22:21 |
| cmurphy | renich: okay I guess when you said you couldn't access swift i assumed it was still a policy issue, connection refused is a whole different issue | 22:21 |
| renich | cmurphy: yeah, sorry for that, hehe. Checking the swift services | 22:21 |
| cmurphy | i don't know swift so can't help with that here | 22:21 |
| cmurphy | also need to run to the airport, best of luck | 22:21 |
| timburke | yeah, "connection refused" definitely sounds like swift isn't running yet :-) | 22:22 |
| renich | swift-proxy is down | 22:23 |
| renich | it's not starting... | 22:23 |
| timburke | what do your swift logs say? | 22:23 |
| renich | http://paste.openstack.org/show/786304/ | 22:25 |
| *** pcaruana has quit IRC | 22:26 | |
| timburke | ah... so swift3 moved back into the swift repo as s3api -- you can either continue installing a swift3 package so your configs don't need to change, or switch your proxy-server config to point to s3api instead of swift3 | 22:26 |
| timburke | note that there may be some pipeline-ordering changes required, too, depending on where you're upgrading from | 22:27 |
| renich | timburke: I'll do the second | 22:27 |
| timburke | sounds good! there's a bunch of good fixes that have landed since it came back under swift | 22:28 |
| renich | Unauthorized (HTTP 401) (Request-ID: tx07c3f490192f48ffaaa3b-005dd31b5f) | 22:30 |
| renich | OK, swift-proxy starts now. But I still get unauthorized when trying to use project-scope | 22:30 |
| timburke | fwiw, there's an example snippet around https://docs.openstack.org/swift/latest/middleware.html#proxy-server-setting -- but it looks like you've already gotten that far :-) | 22:30 |
| timburke | what's the pipeline look like? | 22:30 |
| renich | timburke: pipeline = catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk ratelimit s3api s3token authtoken keystoneauth slo dlo container-quotas account-quotas versioned_writes proxy-logging proxy-server | 22:31 |
| timburke | bring authtoken ahead of s3api. maybe check the auth_uri for s3token in light of the note at https://docs.openstack.org/swift/latest/middleware.html#s3-token-middleware | 22:32 |
| renich | http://paste.openstack.org/show/786305/4 | 22:33 |
| renich | timburke: OK | 22:33 |
| * renich is chekcing the note | 22:34 | |
| renich | timburke: what about auth_url? | 22:36 |
| renich | should it include /v3 as well? | 22:36 |
| timburke | looks like account servers are also down? might be worth checking container and object, too. but those aren't causing the auth problem -- is that 35357 port right, or have things moved to 5000? | 22:36 |
| timburke | yep | 22:37 |
| timburke | should have /v3 | 22:37 |
| renich | timburke: let me check | 22:37 |
| renich | timburke: swift-account is up and running. It wasn't down. Will check the others | 22:38 |
| renich | timburke: I've moved to 5000 | 22:38 |
| timburke | funny. i wonder what was up with the "ERROR with Account server 10.0.252.26:6002/1 re: Trying to HEAD /v1/AUTH_7547634d002648b182845a58dfd3a89e: Connection refused" then... | 22:40 |
| *** mvkr has joined #openstack-keystone | 22:40 | |
| timburke | 5000 is good, the new standard config! worth checking that it's updated for both [filter:authtoken] and [filter:s3token] | 22:41 |
| renich | timburke: I am seeing this now in the logs with keystone (probably due to what is at [DEFAULT]): http://paste.openstack.org/show/786306/ | 22:42 |
| renich | timburke: OK | 22:42 |
| timburke | those log lines should be harmless | 22:43 |
| renich | timburke: OK | 22:43 |
| renich | ... wait, `openstack container list` works for the demo user, but not the admin user.... ??? | 22:43 |
| timburke | o.O | 22:44 |
| renich | hmmm... container create doesn't work... only container list... | 22:44 |
| renich | oh man :S | 22:44 |
| timburke | ... i _guess_ that's progress? | 22:44 |
| renich | yeah, hehe | 22:44 |
| timburke | let's see what we can do about that admin user! what roles have we got assigned for the project? | 22:45 |
| *** awalende_ has quit IRC | 22:46 | |
| renich | timburke: the default project? | 22:46 |
| *** rcernin has joined #openstack-keystone | 22:46 | |
| timburke | whatever you're using when getting the token. so, probably yeah, the default one? | 22:47 |
| timburke | also, what's [filter:keystoneauth] look like? in particular, is there overlap between the user's roles and what's configured for operator_roles and/or reseller_admin_role? | 22:47 |
| renich | timburke: let me show you | 22:48 |
| renich | http://paste.openstack.org/show/786308/ | 22:49 |
| renich | That's how keystoneauth looks like | 22:49 |
| renich | and the roles... | 22:49 |
| renich | `openstack role assignment list --project=default` shows nothing | 22:51 |
| renich | wait... | 22:51 |
| renich | http://paste.openstack.org/show/786309/ | 22:52 |
| renich | That's the role assignment list for ... oh... UUID-like strings... | 22:52 |
| timburke | there's a --names that should help | 22:53 |
| renich | OK, I checked the account, object and container servers in the second node. They were down. Now, they're up. container creation works for demo user | 22:53 |
| timburke | \o/ | 22:53 |
| timburke | admin user's still a no-go? | 22:53 |
| renich | timburke: and container creation works for admin as well! :D | 22:54 |
| timburke | whoo! | 22:54 |
| renich | timburke: man, thanks a lot. Sorry for my carelessness. :S | 22:54 |
| timburke | no no -- sorry for not having better upgrade docs... | 22:54 |
| renich | I really appreciate it timburke, cmurphy and lbragstad... sniff... sniff... | 22:54 |
| renich | timburke: in all fairness, I share responsibility for this. I had some misconfiguration going on. | 22:55 |
| renich | I really appreciate that you guys tuck with me until it worked. I was really scared, hehe. | 22:56 |
| timburke | i oughta look harder at when these things changed and make better use of the Upgrade Notes sections of the release notes. not sure it'd work to update them on the stable branch, though :-/ | 22:56 |
| timburke | i really really want people to still be able to access their data :-D | 22:57 |
| renich | timburke: yeah, me too! ;D | 22:57 |
| renich | I learned a few things, though. The clouds.yaml thing is awesome. Also, I wanna migrate to the system scope paradigm so we do not suffer so much when upgrading. | 22:58 |
| timburke | ...which gives me that much more reason to figure out how to use the system scope in swift ;-) | 22:58 |
| renich | timburke: hehehe, OK. | 22:59 |
| timburke | pretty sure it comes down to mapping it to reseller admin, but the devil's in the details i suppose | 23:00 |
| renich | Man, I am gonna go have a coffee or something. I kind of need it after this... phew! Thanks again! I'm gonna send you, guys, good vibes all week! | 23:00 |
| renich | support, the upgrade is done! | 23:00 |
| timburke | GL! maybe check that S3 API is working for you before celebrating ;-) | 23:00 |
| renich | OK, I will. | 23:01 |
| renich | hehehe | 23:01 |
| renich | it seems to work. | 23:01 |
| timburke | (if it doesn't, maybe we'll take this over to #openstack-swift so we're not bothering the keystone folks) | 23:01 |
| timburke | 👍 | 23:01 |
| *** spatel has quit IRC | 23:02 | |
| renich | yeah, sorry #openstack-keystone people. We took over the channel. :S | 23:03 |
| *** tkajinam has joined #openstack-keystone | 23:09 | |
| *** aloga_ has quit IRC | 23:10 | |
| *** jaosorior has quit IRC | 23:21 | |
| *** ivve has quit IRC | 23:26 | |
| *** aloga has joined #openstack-keystone | 23:40 | |
| *** jamesmcarthur has quit IRC | 23:46 | |
| *** jamesmcarthur has joined #openstack-keystone | 23:46 | |
| *** jamesmcarthur has quit IRC | 23:48 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!