Re: [openstack-dev] [Cinder] A possible solution for HA Active-Active

2015-08-01 Thread Avishay Traeger
On Sat, Aug 1, 2015 at 2:51 AM, Monty Taylor mord...@inaugust.com wrote: I hear tell that there a bunch of ops people who are in love with consul At my company we love Consul. We found it to be very scalable and performant, gives us an easy-to-use k/v store, membership service, DNS, etc. We

Re: [openstack-dev] [Keystone][Fernet] HA SQL backend for Fernet keys

2015-08-01 Thread Clint Byrum
Meta: Bogdan, please do try to get your email client to reply with references to the thread, so it doesn't create a new thread. Excerpts from bdobrelia's message of 2015-08-01 09:27:17 -0700: I suggest to use pacemaker multistate clone resource to rotate and rsync fernet tokens from local

[openstack-dev] [Keystone] Attribute Mapping

2015-08-01 Thread David Chadwick
Hi Marek Thanks for the clear exposition. To answer your question Why are you interested in such a feature? is that it seemed to be the logical thing to do. A user is identified by a set of identity attributes (by the IdP) and these are mapped into permission by mapping

Re: [openstack-dev] [Keystone][Fernet] HA SQL backend for Fernet keys

2015-08-01 Thread bdobrelia
I suggest to use pacemaker multistate clone resource to rotate and rsync fernet tokens from local directories across cluster nodes. The resource prototype is described here https://etherpad.openstack.org/p/fernet_tokens_pacemaker Pros: Pacemaker will care about CAP/split-brain stuff for us, we

Re: [openstack-dev] how to debug neutron using eclipse pydev?

2015-08-01 Thread xueguanwen
I know that with Keystone we needed to run with standard threads, not eventlet greenthreads in order to get step by step debugging. I've been mostly working with RPD, and that has worked well for me. I used PyCHarm for a bout a year, but did not renew it, as it doesn't really buy me that

[openstack-dev] [Keystone] [Horizon] Federated Login

2015-08-01 Thread David Chadwick
Hi Everyone I have a student building a GUI for federated login with Horizon. The interface supports both a drop down list of configured IDPs, and also Type Ahead for massive federations with hundreds of IdPs. Screenshots are visible in InVision here https://invis.io/HQ3QN2123 All comments on

Re: [openstack-dev] [Ceilometer] Unable to get the neutron network related meters in ceilometer

2015-08-01 Thread Srikanth Vavilapalli
Thanks gord. I will enable store_events and see if neutron related meters/state events are appearing under ceilometer events-list Thanks Srikanth -Original Message- From: gord chung [mailto:g...@live.ca] Sent: Thursday, July 30, 2015 2:05 PM To: openstack-dev@lists.openstack.org

Re: [openstack-dev] [qa][tempest] kwargs of service clients for POST/PUT methods

2015-08-01 Thread Ken'ichi Ohmichi
Hi Jordan, Thanks for pointing this up:-) Your point is right for current nova situation. Nova API continues changing with small steps. The kwargs changes of tempest will help us to avoid a lot of changes in long-term. I also am happy if getting opinions from the others. Thanks for your help

Re: [openstack-dev] [glance] Additions and removals for the glance-drivers team

2015-08-01 Thread Flavio Percoco
On 09/07/15 20:37 +0200, Flavio Percoco wrote: Greetings, I'd like to propose Stuart Mclaren for the glance-drivers team. Stuart has a huge amount of knowledge about Glance's history, he knows the Glance codebase well and he also has experience in deploying and maintaning Glance production

Re: [openstack-dev] [Keystone][Fernet] HA SQL backend for Fernet keys

2015-08-01 Thread Clint Byrum
Excerpts from Boris Bobrov's message of 2015-08-01 14:18:21 -0700: On Saturday 01 August 2015 16:27:17 bdobre...@mirantis.com wrote: I suggest to use pacemaker multistate clone resource to rotate and rsync fernet tokens from local directories across cluster nodes. The resource prototype

Re: [openstack-dev] [Keystone][Fernet] HA SQL backend for Fernet keys

2015-08-01 Thread Matt Fischer
Agree that you guys are way over thinking this. You don't need to rotate keys at exactly the same time, we do it in within a one or two hours typically based on how our regions are setup. We do it with puppet, puppet runs on one keystone node at a time and drops the keys into place. The actual

Re: [openstack-dev] [Keystone][Fernet] HA SQL backend for Fernet keys

2015-08-01 Thread Boris Bobrov
On Sat, Aug 1, 2015 at 3:41 PM, Clint Byrum cl...@fewbar.com wrote: This too is overly complex and will cause failures. If you replace key 0, you will stop validating tokens that were encrypted with the old key 0. No. Key 0 is replaced after rotation. Also, come on, does

Re: [openstack-dev] [Keystone][Fernet] HA SQL backend for Fernet keys

2015-08-01 Thread Boris Bobrov
On Saturday 01 August 2015 16:27:17 bdobre...@mirantis.com wrote: I suggest to use pacemaker multistate clone resource to rotate and rsync fernet tokens from local directories across cluster nodes. The resource prototype is described here

Re: [openstack-dev] [Ironic] Let's talk about API versions

2015-08-01 Thread Lucas Alvares Gomes
Hi, It sounds like we all agree -- the client we ship should default to a fixed, older version. Anyone who wants newer functionality can pass a newer version to their client. Here's the current state of things: server: - stable/kilo: 1.6 - current: 1.11 client: - stable/kilo: 1.6 -