| *** Ben78 has joined #openstack-keystone | 00:13 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:11 | |
| *** jamesmcarthur has quit IRC | 01:14 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:21 | |
| *** bzhao__ has quit IRC | 02:12 | |
| *** jamesmcarthur has quit IRC | 02:22 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:23 | |
| *** Ben78 has quit IRC | 02:24 | |
| *** jamesmcarthur_ has joined #openstack-keystone | 02:27 | |
| *** jamesmcarthur_ has quit IRC | 02:27 | |
| *** jamesmcarthur has quit IRC | 02:28 | |
| *** markvoelker has joined #openstack-keystone | 02:41 | |
| *** bnemec has quit IRC | 05:09 | |
| *** Luzi has joined #openstack-keystone | 05:13 | |
| *** markvoelker has quit IRC | 05:14 | |
| *** bnemec has joined #openstack-keystone | 05:15 | |
| *** dancn has joined #openstack-keystone | 06:01 | |
| *** dancn has quit IRC | 06:22 | |
| *** dancn has joined #openstack-keystone | 06:27 | |
| *** pcaruana has joined #openstack-keystone | 06:56 | |
| *** awalende has joined #openstack-keystone | 07:04 | |
| *** shyam89 has joined #openstack-keystone | 07:07 | |
| *** tesseract has joined #openstack-keystone | 07:07 | |
| *** markvoelker has joined #openstack-keystone | 07:15 | |
| *** xek has joined #openstack-keystone | 07:16 | |
| *** Luzi has quit IRC | 07:18 | |
| *** markvoelker has quit IRC | 07:19 | |
| *** shyam89 has quit IRC | 07:45 | |
| *** shyam89 has joined #openstack-keystone | 07:45 | |
| *** shyam89 has quit IRC | 07:51 | |
| *** ivve has joined #openstack-keystone | 07:52 | |
| *** tkajinam has quit IRC | 08:14 | |
| *** shyam89 has joined #openstack-keystone | 08:41 | |
| *** freerunner has quit IRC | 08:43 | |
| *** frickler has quit IRC | 08:45 | |
| *** freerunner has joined #openstack-keystone | 08:45 | |
| *** frickler has joined #openstack-keystone | 08:46 | |
| *** rcernin has quit IRC | 09:04 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystoneauth master: Generate pdf documentation https://review.opendev.org/682272 | 09:16 |
|---|---|---|
| openstackgerrit | Vishakha Agarwal proposed openstack/keystonemiddleware master: Generate pdf documentation https://review.opendev.org/682271 | 09:22 |
| *** shyam89 has quit IRC | 09:26 | |
| *** shyam89 has joined #openstack-keystone | 09:40 | |
| *** openstackstatus has quit IRC | 10:12 | |
| *** openstack has joined #openstack-keystone | 10:13 | |
| *** ChanServ sets mode: +o openstack | 10:13 | |
| *** shyam89 has quit IRC | 10:23 | |
| *** pcaruana has quit IRC | 10:24 | |
| *** shyam89 has joined #openstack-keystone | 10:33 | |
| *** dancn has quit IRC | 10:36 | |
| *** markvoelker has joined #openstack-keystone | 10:40 | |
| *** pcaruana has joined #openstack-keystone | 10:48 | |
| *** shyam89 has quit IRC | 10:48 | |
| *** shyam89 has joined #openstack-keystone | 11:27 | |
| *** jamesmcarthur has joined #openstack-keystone | 11:39 | |
| *** jamesmcarthur has quit IRC | 11:49 | |
| *** dancn has joined #openstack-keystone | 11:56 | |
| *** jamesmcarthur has joined #openstack-keystone | 12:02 | |
| *** jamesmcarthur_ has joined #openstack-keystone | 12:03 | |
| *** jamesmcarthur has quit IRC | 12:07 | |
| *** awalende_ has joined #openstack-keystone | 12:09 | |
| *** awalende has quit IRC | 12:09 | |
| *** jamesmcarthur_ has quit IRC | 12:20 | |
| *** shyam89 has quit IRC | 12:37 | |
| *** jaosorior has quit IRC | 12:59 | |
| *** raildo has joined #openstack-keystone | 13:04 | |
| *** Ben78 has joined #openstack-keystone | 13:16 | |
| *** starborn has joined #openstack-keystone | 13:25 | |
| *** Ben78 has quit IRC | 13:55 | |
| *** awalende_ has quit IRC | 14:43 | |
| *** starborn has quit IRC | 14:46 | |
| *** pcaruana has quit IRC | 15:01 | |
| *** ivve has quit IRC | 15:30 | |
| cmurphy | team meeting in 20 minutes in #openstack-meeting-alt | 15:40 |
| *** gyee has joined #openstack-keystone | 15:44 | |
| cmurphy | meeting now in #openstack-meeting-alt | 16:00 |
| *** jaosorior has joined #openstack-keystone | 16:29 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: [WIP] Try to recreate 1843464 https://review.opendev.org/684397 | 16:35 |
| *** yoctozepto has quit IRC | 16:35 | |
| cmurphy | woot thanks for the reviews y'all | 16:37 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: [WIP] Try to recreate 1843464 https://review.opendev.org/684397 | 16:37 |
| lbragstad | cmurphy np - thanks for cleaning all that up | 16:38 |
| *** yoctozepto has joined #openstack-keystone | 16:40 | |
| *** markvoelker has quit IRC | 16:40 | |
| *** tesseract has quit IRC | 16:46 | |
| *** jaosorior has quit IRC | 16:51 | |
| *** dancn has quit IRC | 16:57 | |
| *** markvoelker has joined #openstack-keystone | 16:59 | |
| *** efried has joined #openstack-keystone | 17:23 | |
| efried | o/ keystoners | 17:23 |
| efried | Would you be able to confirm the behavior of the auth_section ksa opt for me, please? | 17:24 |
| efried | afaict, it causes ksa to ignore the remainder of the auth opts from whatever group I'm in, and instead load them up from whatever group I named via auth_section | 17:24 |
| *** jamesmcarthur has joined #openstack-keystone | 17:25 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Allow domain users to access the limit API https://review.opendev.org/621023 | 17:30 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add tests for project users interacting with limits https://review.opendev.org/621024 | 17:30 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Remove limit policies from policy.v3cloudsample.json https://review.opendev.org/621025 | 17:30 |
| *** jamesmcarthur has quit IRC | 17:31 | |
| cmurphy | efried: that sounds correct based on my reading of https://opendev.org/openstack/keystoneauth/src/branch/master/keystoneauth1/loading/conf.py#L66-L94 | 17:33 |
| efried | cmurphy: Okay, that's what I was reading as well. Thanks for the confirmation. | 17:34 |
| *** jamesmcarthur has joined #openstack-keystone | 17:54 | |
| efried | cmurphy: so for example https://review.opendev.org/#/c/682565/10/devstack/lib/cyborg should mean that everything else is ignored and we configure auth based on the [keystone_authtoken] section in $CYBORG_CONF_FILE | 18:11 |
| efried | which btw looks like this https://zuul.opendev.org/t/openstack/build/9965f8f829e84d69b050aa56f03d1286/log/controller/logs/etc/cyborg/cyborg_conf.txt.gz -- so it shouldn't work because [nova] (and for that matter [placement]) shouldn't be auth'able with username 'cyborg' | 18:13 |
| efried | yet I have people telling me that at least the placement bit is actually working | 18:13 |
| cmurphy | efried: i'm pretty sure auth_section = keystone_authtoken is wrong although i see other people using it that way on http://codesearch.openstack.org/?q=auth_section&i=nope&files=&repos= if placement is working would it just be because it's using the admin credentials from [keystone_authtoken] which will work for everything? | 18:18 |
| kmalloc | it is never recommended to just use keystoneauthtoken's information for anything but keystonemiddleware | 18:18 |
| kmalloc | if someone is doing that, they're doing something very wrong | 18:19 |
| openstackgerrit | guang-yee proposed openstack/keystoneauth master: Generate pdf documentation https://review.opendev.org/682272 | 18:21 |
| openstackgerrit | Merged openstack/keystone master: DRY up credential policies https://review.opendev.org/682488 | 18:24 |
| openstackgerrit | Colleen Murphy proposed openstack/oslo.policy master: Modernize policy checker https://review.opendev.org/682783 | 18:26 |
| efried | cmurphy, kmalloc: I agree it seems way wrong | 18:27 |
| openstackgerrit | Merged openstack/keystone master: Add application_credential as a CADF type https://review.opendev.org/663410 | 18:27 |
| efried | I actually just reproduced this locally. | 18:27 |
| openstackgerrit | Merged openstack/keystone master: Fix relative links https://review.opendev.org/677534 | 18:33 |
| openstackgerrit | Merged openstack/keystone master: Clean up UserGroups target enforcement callback https://review.opendev.org/677778 | 18:33 |
| openstackgerrit | Merged openstack/keystone master: Use immutable roles in tests https://review.opendev.org/684128 | 18:33 |
| openstackgerrit | Merged openstack/keystone master: Add notifications for deleting app creds by user https://review.opendev.org/677780 | 18:33 |
| efried | So I have a nice default devstack. I'm running this code | 18:38 |
| efried | http://paste.openstack.org/show/779203/ | 18:38 |
| efried | against this conf | 18:38 |
| efried | http://paste.openstack.org/show/779204/ | 18:38 |
| efried | As you can see it's indeed ignoring the `bogus` stuff in the [placement] section | 18:38 |
| efried | When I change the username from 'nova' to 'placement' it still works. | 18:41 |
| efried | When I change the username to something bogus, I get 401 on POST /identity/v3/auth/tokens ("keystoneauth1.exceptions.http.Unauthorized: The request you have made requires authentication.") | 18:41 |
| efried | When I change the username to a different service, like 'neutron', I get 403 from placement itself ("Policy does not allow placement:resource_providers:list to be performed.") | 18:41 |
| efried | The latter two things are totally what I would expect | 18:41 |
| efried | The first thing is still a mystery. Why would placement accept nova creds? | 18:41 |
| efried | I guess nova is, like, an admin user or something? | 18:41 |
| efried | I don't even know how to figure that out. | 18:41 |
| lbragstad | probably | 18:41 |
| lbragstad | check the roles in keystone | 18:42 |
| lbragstad | ``openstack role assignments list --names | 18:42 |
| lbragstad | `` | 18:42 |
| *** jamesmcarthur has quit IRC | 18:42 | |
| efried | lbragstad: aha, this? | 18:43 |
| efried | | admin | nova@Default | | service@Default | | | False | | 18:43 |
| *** jamesmcarthur has joined #openstack-keystone | 18:44 | |
| lbragstad | efried yeah - https://pasted.tech/pastes/ffeac2cfbfcfe2a53210ab410c20f248484aee1d.raw | 18:45 |
| lbragstad | you should see the placement and nova users there, and you can see what roles they have | 18:45 |
| efried | okay, so in the cyborg case they must have cyborg set up as an admin user. | 18:46 |
| efried | thanks lbragstad, this is starting to unwind for me. | 18:46 |
| lbragstad | yeah - you should see that in keystone's role assignment API | 18:46 |
| lbragstad | so - if a service needs to access a particular API in another service then that service user needs the `admin` role, unfortunately | 18:47 |
| *** jamesmcarthur has quit IRC | 18:47 | |
| efried | lbragstad: uhm, I thought we could use the user's token to talk from service A to service B as long as that user has authority to do the needful against service B | 18:49 |
| efried | lbragstad: pretty sure we're counting on it in nova for e.g. glance images. | 18:49 |
| efried | nova has some places it talks to service B as user (e.g. glance), some as admin (e.g. ironic, placement), and some as both (neutron). | 18:50 |
| lbragstad | so the second case is where it's using the creds from nova.conf, yeah? | 18:50 |
| efried | that's kind of orthogonal atm anyway; I was just trying to figure out how https://review.opendev.org/#/c/682565/10/devstack/lib/cyborg@202 could have possibly been working ever. | 18:51 |
| lbragstad | if nova needs something from another service to make an informed decision, then it needs to call that API with its own token | 18:51 |
| efried | yes, the second (admin) case it's using admin creds from nova.conf | 18:51 |
| lbragstad | so - in that case the cyborg service is using the placement user to make requests? | 18:52 |
| lbragstad | because the keystone_authtoken section is setup with the placement user's credentials | 18:52 |
| lbragstad | right? | 18:52 |
| efried | lbragstad: well, it *thought* it was using the placement user to make placement requests. But it was actually using the cyborg user, because that's what was set up in [keystone_authtoken] and that line I linked above makes ksa ignore everything else and just use [keystone_authtoken] | 18:53 |
| efried | so the only thing I still need to confirm is that the cyborg user has the admin role. Which I imagine it probably does. | 18:53 |
| efried | because this is devstack, and I reckon they copied their setup from nova | 18:54 |
| lbragstad | openstack role assignment list --names --user cyborg | 18:54 |
| lbragstad | yeah - ^ that'll filter cyborg's assignments | 18:54 |
| * lbragstad thinks the current setup with services users leaves a lot to be desired | 18:55 | |
| efried | Yup, asked Sundar to look for that, still waiting (dude has like a full time job or something) | 18:55 |
| lbragstad | psh - work... | 18:55 |
| efried | lbragstad: Well, at least by default devstack doesn't give me any auth_sectionZ in my nova.conf, which is good. | 18:56 |
| lbragstad | it would be nice to completely transition service configs away from their own separate users... | 18:57 |
| efried | lbragstad: Cool, you've got two days, go. | 19:00 |
| lbragstad | heh - next release maybe | 19:01 |
| efried | :P but srsly, this might be where we're going to end up with sdk if we're lucky. | 19:01 |
| efried | "away from their own separate users" ==> clouds.yaml anyone? | 19:01 |
| lbragstad | how do you mean? | 19:01 |
| efried | maybe I'm thinking of the wrong thing. | 19:01 |
| lbragstad | so - right now, all services have their own users, right? | 19:02 |
| lbragstad | you need to set it all up when you install and whatnot | 19:02 |
| lbragstad | (create a `placement` user in keystone, give them a role assignment, put their creds in placement.conf, etc..) | 19:02 |
| efried | oh, and it's necessary that they have separate users? | 19:02 |
| lbragstad | no - it's not necessary, just how it was implemented | 19:03 |
| lbragstad | it would be nice to have a single "service" user | 19:03 |
| efried | "it" what, devstack? | 19:03 |
| lbragstad | yeah - devstack, osa, deployment tools, the installation guide | 19:03 |
| efried | I mean, is anything stopping you from just making a 'service' user and putting the same creds in all the confs? | 19:03 |
| efried | okay, gotcha, so it's possible, it's just not how we've been trained | 19:04 |
| lbragstad | you could.. but if that user is compromised, it'll be bad | 19:04 |
| efried | wait, so what are you suggesting then? | 19:04 |
| lbragstad | also - if some services only require minimal permissions and your "service" user has "admin" because placement and nova need it | 19:04 |
| lbragstad | now all services are using really powerful tokens | 19:04 |
| lbragstad | and that has authorization those services might not ever need or use (enlarged attack surface if one of those tokens are compromised) | 19:05 |
| lbragstad | what i think would be cool | 19:05 |
| lbragstad | is if we have a single service user, and then just generate application credentials for each service to use | 19:05 |
| lbragstad | each application credential can be scoped to specific roles, so you can limit the attack surface | 19:06 |
| lbragstad | but you get simplified auditing - because you're not chasing around a bunch of service users (e.g., nova, cinder, glance, placements, cyborg, etc...) | 19:06 |
| lbragstad | and - here's the cool part | 19:06 |
| lbragstad | if your deployment needs to rotate passwords you can do that gracefully with application credentials without incurring an outage (since rotating cyborgs password is going to cause a 401 if you don't update cyborg.conf before it needs to do something) | 19:07 |
| efried | I guess I'm not understanding the distinction between "service user" and "application credentials". | 19:10 |
| efried | Is a "credential" like a username/password pair? | 19:11 |
| lbragstad | yeah - kinda... it's a set of credentials that are specific for applications | 19:11 |
| lbragstad | kinda like an API key | 19:11 |
| lbragstad | https://docs.openstack.org/keystone/latest/user/application_credentials.html | 19:12 |
| lbragstad | users can create them | 19:12 |
| efried | So there would be a single "service user" named "service".... but you would get at it with different credentials, which would presumably be scoped per service. | 19:12 |
| lbragstad | yeah - pretty much | 19:12 |
| efried | meaning that at some level, you still have nova, cinder, glance, placement, cyborg. etc... | 19:12 |
| efried | I would think it would be more, not less, confusing if those names weren't present *somewhere* in the credential thingy. | 19:12 |
| lbragstad | yeah - you could give your credentials names (openstack application credential create nova --role admin) | 19:14 |
| efried | anyway, I'm way late to feed my face. Thanks for the help lbragstad, this was very informative and useful. | 19:15 |
| lbragstad | awesome - anytime efried | 19:16 |
| *** jamesmcarthur has joined #openstack-keystone | 19:39 | |
| openstackgerrit | guang-yee proposed openstack/keystonemiddleware master: Generate pdf documentation https://review.opendev.org/682271 | 19:51 |
| *** jamesmcarthur has quit IRC | 19:54 | |
| *** jamesmcarthur has joined #openstack-keystone | 19:55 | |
| *** mlavalle has joined #openstack-keystone | 20:07 | |
| mlavalle | lbragstad: hey... in the Rocky release, was Keystone ready to handle reader role with system scope? Assuming of course the policies are modified properly | 20:08 |
| mlavalle | I mean the Keystone API | 20:08 |
| lbragstad | you mean to ask if keystone honors system-scope and the reader role in stable/rocky? | 20:09 |
| *** Ben78 has joined #openstack-keystone | 20:09 | |
| mlavalle | yes | 20:09 |
| mlavalle | if I make a call to the keystone API with a system scope, will it undertsand? | 20:09 |
| lbragstad | it might... but we had to fix a bunch of stuff to get system-scope to work by default https://bit.ly/2lqQavK | 20:10 |
| lbragstad | we tracked everything as a bug report per API that needed fixed | 20:10 |
| lbragstad | fixes* | 20:10 |
| lbragstad | and those fixes started landing in stein | 20:10 |
| mlavalle | but that was done for what relase? | 20:10 |
| lbragstad | stein - keystone's stable/rocky branch included the changes necessary to ensure basic roles were availabe after install | 20:11 |
| lbragstad | after that came the patches that fixed keystone to start relying on those roles | 20:12 |
| mlavalle | and that was stein | 20:12 |
| lbragstad | yes - we fixed a little more than half of keystone entire API to honor system-scope and default roles | 20:12 |
| lbragstad | the rest was done in Train | 20:12 |
| mlavalle | do you hava a gerrit topic where I can see all the patches? | 20:13 |
| lbragstad | yeah - i should be able to find one that is close | 20:13 |
| lbragstad | https://review.opendev.org/#/q/status:merged+project:openstack/keystone+branch:master+topic:implement-default-roles contains some of them | 20:14 |
| lbragstad | granted - those patches are specific to changing default policies and getting keystone APIs to understand system-scope | 20:15 |
| openstackgerrit | guang-yee proposed openstack/keystoneauth master: Generate pdf documentation https://review.opendev.org/682272 | 20:25 |
| *** jamesmcarthur has quit IRC | 21:06 | |
| *** xek has quit IRC | 21:11 | |
| *** markvoelker has quit IRC | 21:52 | |
| *** raildo has quit IRC | 21:53 | |
| *** jamesmcarthur has joined #openstack-keystone | 22:06 | |
| *** rcernin has joined #openstack-keystone | 22:07 | |
| mlavalle | lbragstad: this is the set of Keystone calls that I need to enable with system reader in a Rocky release. Is there an easily identifiable set of patches that would help me to do that? | 22:11 |
| mlavalle | http://paste.openstack.org/show/779216/ | 22:11 |
| mlavalle | obvously https://review.opendev.org/#/c/626007 | 22:12 |
| mlavalle | if not, I will go doing git blame around the repo | 22:12 |
| *** jamesmcarthur has quit IRC | 22:13 | |
| mlavalle | so it seems identity:get_auth_catalog is wide open | 22:16 |
| *** aloga has quit IRC | 22:27 | |
| *** aloga has joined #openstack-keystone | 22:34 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Allow domain users to access the limit API https://review.opendev.org/621023 | 22:36 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add tests for project users interacting with limits https://review.opendev.org/621024 | 22:36 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Remove limit policies from policy.v3cloudsample.json https://review.opendev.org/621025 | 22:36 |
| *** tkajinam has joined #openstack-keystone | 22:51 | |
| mlavalle | lbragstad: it turns out that just adding the SYSTEM_READER rule to keystone/common/base.py, keystone/common/domain.py and keystone/common/policies/project.py I get the behavior I want \o/ | 23:18 |
| *** mlavalle has quit IRC | 23:33 | |
| *** jamesmcarthur has joined #openstack-keystone | 23:50 | |
| *** markvoelker has joined #openstack-keystone | 23:54 | |
| *** jamesmcarthur has quit IRC | 23:55 | |
| *** markvoelker has quit IRC | 23:58 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!