Tuesday, 2018-11-27

*** jesusaur has quit IRC00:02
*** tetsuro has joined #openstack-meeting-alt00:04
*** cloudrancher has quit IRC00:08
*** cloudrancher has joined #openstack-meeting-alt00:09
*** gouthamr has left #openstack-meeting-alt00:14
*** gouthamr has joined #openstack-meeting-alt00:14
*** slaweq has joined #openstack-meeting-alt00:16
*** jesusaur has joined #openstack-meeting-alt00:23
*** slaweq has quit IRC00:24
*** ijw has quit IRC00:28
*** ijw has joined #openstack-meeting-alt00:29
*** armstrong has quit IRC00:34
*** markstur has joined #openstack-meeting-alt01:12
*** slaweq has joined #openstack-meeting-alt01:16
*** markstur has quit IRC01:17
*** slaweq has quit IRC01:24
*** ijw has quit IRC01:47
*** ijw has joined #openstack-meeting-alt01:48
*** ijw has quit IRC01:52
*** hongbin has joined #openstack-meeting-alt01:55
*** slaweq has joined #openstack-meeting-alt02:13
*** slaweq has quit IRC02:24
*** cloudrancher has quit IRC02:38
*** cloudrancher has joined #openstack-meeting-alt02:39
*** yamahata has quit IRC02:41
*** iyamahat_ has quit IRC02:41
*** bhavikdbavishi has joined #openstack-meeting-alt02:55
*** ijw has joined #openstack-meeting-alt02:56
*** ijw has quit IRC03:01
*** slaweq has joined #openstack-meeting-alt03:16
*** slaweq has quit IRC03:24
*** sridharg has joined #openstack-meeting-alt03:33
*** ijw has joined #openstack-meeting-alt03:34
*** ijw has quit IRC03:39
*** diablo_rojo has quit IRC03:42
*** hongbin has quit IRC04:06
*** iyamahat has joined #openstack-meeting-alt04:09
*** slaweq has joined #openstack-meeting-alt04:11
*** slaweq has quit IRC04:24
*** yamahata has joined #openstack-meeting-alt04:27
*** janki has joined #openstack-meeting-alt04:49
*** ijw has joined #openstack-meeting-alt04:50
*** ijw has quit IRC04:55
*** ijw has joined #openstack-meeting-alt05:10
*** ijw has quit IRC05:14
*** markstur has joined #openstack-meeting-alt05:20
*** markstur has quit IRC05:24
*** ijw has joined #openstack-meeting-alt05:28
*** ijw has quit IRC05:33
*** ijw has joined #openstack-meeting-alt05:47
*** carthaca has joined #openstack-meeting-alt05:50
*** ijw has quit IRC05:51
*** ijw has joined #openstack-meeting-alt06:06
*** chhagarw has joined #openstack-meeting-alt06:10
*** ijw has quit IRC06:10
*** slaweq has joined #openstack-meeting-alt06:11
*** bhavikdbavishi has quit IRC06:16
*** slaweq has quit IRC06:24
*** ccamacho has quit IRC06:30
*** bhavikdbavishi has joined #openstack-meeting-alt06:35
*** dpawlik has joined #openstack-meeting-alt06:47
*** dpawlik has quit IRC06:54
*** rcernin has quit IRC06:58
*** markstur has joined #openstack-meeting-alt07:17
*** markstur has quit IRC07:22
*** dpawlik has joined #openstack-meeting-alt07:23
*** kopecmartin|off is now known as kopecmartin07:26
*** dpawlik has quit IRC07:38
*** slaweq has joined #openstack-meeting-alt07:42
*** dpawlik has joined #openstack-meeting-alt07:44
*** ccamacho has joined #openstack-meeting-alt07:56
*** tssurya has joined #openstack-meeting-alt08:13
*** chhagarw has quit IRC08:18
*** lpetrut has joined #openstack-meeting-alt08:21
*** jtomasek has joined #openstack-meeting-alt08:22
*** priteau has joined #openstack-meeting-alt08:23
*** ijw has joined #openstack-meeting-alt08:36
*** ijw has quit IRC08:41
*** irclogbot_1 has quit IRC08:44
*** irclogbot_1 has joined #openstack-meeting-alt08:47
*** tssurya has quit IRC08:49
*** irclogbot_1 has quit IRC08:53
*** ijw has joined #openstack-meeting-alt08:57
*** irclogbot_1 has joined #openstack-meeting-alt08:57
priteau#startmeeting blazar09:00
openstackMeeting started Tue Nov 27 09:00:38 2018 UTC and is due to finish in 60 minutes.  The chair is priteau. Information about MeetBot at http://wiki.debian.org/MeetBot.09:00
openstackUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.09:00
*** openstack changes topic to " (Meeting topic: blazar)"09:00
openstackThe meeting name has been set to 'blazar'09:00
priteau#topic Rollcall09:01
*** openstack changes topic to "Rollcall (Meeting topic: blazar)"09:01
*** masahito has joined #openstack-meeting-alt09:01
masahitoo/09:01
*** bertys has joined #openstack-meeting-alt09:01
*** tssurya has joined #openstack-meeting-alt09:01
*** ijw has quit IRC09:01
bertyso/09:01
priteauHi masahito and bertys09:01
priteautetsuro: Are you here too?09:02
tetsuroo/09:02
priteauWe decided that today we would do some code review09:03
priteauLet's do AOB first09:03
priteau#topic AOB09:03
*** openstack changes topic to "AOB (Meeting topic: blazar)"09:03
priteauAnything to discuss before we start discussing reviews, which might take the full hour?09:04
*** rossella_s has joined #openstack-meeting-alt09:04
priteauAs mentioned last week, we will cancel next week's meeting due to travel of masahito and tetsuro09:04
priteauIf nothing let's start with the reviews09:06
priteau#topic Code review09:06
*** openstack changes topic to "Code review (Meeting topic: blazar)"09:06
priteauIn openstack/blazar, the two main patch series are resource-availability-api (resource allocation blueprint) and placement09:07
masahitosorry, I have to leave few mins. please start tetsuro's patches.09:08
priteauOtherwise we have various small fixes.09:08
priteautetsuro has only one pending patch now, it's https://review.openstack.org/#/c/584744/09:08
tetsuroI saw your comments, priteau. Will submit another patch set.09:09
priteauI reviewed it yesterday, I think maybe a code path were we need to delete the inventory was missed, but I am not sure09:09
tetsuroYour point is fair.09:09
tetsuroGood catch. Thanks.09:09
priteauOK. While masahito is away, let's look at smaller patches.09:11
masahitoI'm back :-)09:11
priteauAh great.09:11
priteauWe're looking at https://review.openstack.org/#/q/status:open+project:openstack/blazar+branch:master+topic:bp/resource-availability-api09:11
priteauI reviewed it yesterday and, while the code approach is good, I have concerns about the format of the API response09:12
masahitogot it.09:12
masahitoThe sample response is this: http://logs.openstack.org/72/584272/8/check/build-openstack-api-ref/69d2e28/html/v1/index.html?expanded=list-allocations-detail#list-allocations09:13
priteauTo summarize, the response looks like this: http://logs.openstack.org/72/584272/8/check/build-openstack-api-ref/69d2e28/html/v1/index.html?expanded=list-allocations-detail#list-allocations09:13
priteauI am thinking it would make more sense for it to look like this: http://paste.openstack.org/show/736064/09:14
priteauWhat changed: inverted "allocations" <-> "reservations", and changed the main "id" to "host_id"09:15
priteauWith my proposed API response format, when you look at the "reservations" list, the "id" fields are actually reservation IDs, so I think it makes more sense09:16
priteauA more minor comment is that in the "Get Allocations" case (http://logs.openstack.org/72/584272/8/check/build-openstack-api-ref/69d2e28/html/v1/index.html?expanded=list-allocations-detail,get-allocations-detail#get-allocations), we do a GET /reservations (plural), but get back an object saying "reservation" (singular)09:17
masahitoAnd your suggest is changing the URI to /v1/oshost/allocations, right?09:17
priteauYes, change the endpoint name as well09:18
priteauWhat do you think?09:18
masahitoMake sense to me.09:19
priteauAny though on the naming of the host ID field? Could be host_id or computehost_id. I don't know if we have any existing reference in the API already.09:20
masahitoAh, AFAIK you have proposed another allocation API for USER API at Denver PTG?09:20
*** ccamacho has quit IRC09:20
priteauAre you talking about the https://blueprints.launchpad.net/blazar/+spec/query-reservation-candidates blueprint?09:21
masahitoTo match the host APIs, what about just "host" for the key?09:21
priteau"host" could work as well.09:22
priteauIn the host API we never mention the "compute" part, so we shouldn't use "compute" actually.09:23
masahitoNo,  this blueprint https://blueprints.launchpad.net/blazar/+spec/reservation-consumers-api09:23
priteaureservation-consumers would be under the lease API endpoint09:24
masahitoThis bp uses consumers not allocation. Never mind, it was my fault.09:24
priteauI need to spec it. I don't think it is related though.09:25
priteauIf you're happy with the proposed change of API response, would you be OK updating your patches? The rest of the code looks good so I can approve quickly.09:26
masahitoOf course.09:26
priteautetsuro, bertys: any comment about this?09:27
masahitopriteau: Now that I'm thinking about it, 'host' or 'host_id' is not better because it can't be applied to network resource.09:28
priteauRight. It's under /os-hosts though. But we can make it abstract enough so that the same client code can be used to parse the results.09:29
priteauresource_id?09:29
masahitoGreat idea!09:29
*** ccamacho has joined #openstack-meeting-alt09:30
priteauWith API documentation explaining that in this case, resource_id == host ID09:30
masahitoIt really make sense.09:30
priteauOK, I think we are in aggreement.09:31
priteau*agreement*09:31
masahito1. change the endpoint to allocations, 2. follow the response body to http://paste.openstack.org/show/736064/ except 'host_id', and 3. use resource_id instead of host_id in the body.09:33
priteauThere's also the issue of "allocations" vs "allocation" in the "Get allocations on a host." case. I am unsure what is the best approach for this.09:35
priteauMaybe it's the endpoint that should be v1/os-hosts/{host_id}/allocation?09:36
masahitoIt looks like there is only one allocation on the host.09:36
masahitoAnother idea is removing 'resource_id' key from the response because host_id is already in the URI.09:37
masahitolike this http://paste.openstack.org/show/736065/09:39
*** derekh has joined #openstack-meeting-alt09:40
priteauIt's a tricky one. The way you've originally proposed it, it looks similar to the lease and host APIs.09:40
masahitothat's true...09:41
priteauI guess it could be considered as one allocation of a hosts to many reservations.09:42
priteaubertys: tetsuro: any thoughts on this API?09:44
priteauIf you're happy to change the endpoint to v1/os-hosts/{host_id}/allocation (since it would return a single allocation dictionary), let's do that09:46
priteauOnly 15 minutes left in the meeting so we should discuss other patches.09:46
priteauList of Blazar master patches that can be merged: https://review.openstack.org/#/q/project:openstack/blazar+is:open+label:verified+branch:master+is:mergeable09:47
priteauEasy one: https://review.openstack.org/#/c/620136/09:48
priteauNoticed it yesterday in logs, we've moved the option in config but not updated the DevStack plugin09:48
masahitoThank. LGTM. If others doesn't have objections, I merge it.09:49
priteautetsuro: Is this something that you are implementing already? https://review.openstack.org/#/c/578641/09:51
priteaumasahito: There's a +2 from bertys already, go ahead.09:51
tetsuroNo I've not yet started this spec.09:51
priteautetsuro: Is the spec still compatible with your approach, i.e. would you give it a +1?09:52
priteauI haven't looked at it in a long time09:52
tetsuroI'll give it a +109:52
tetsurothis is compatible with what I'm doing now.09:53
priteauOK, great. I will give it another look as well09:53
priteauMutable config patch: https://review.openstack.org/#/c/585847/09:54
priteauI tested it yesterday and found issues, but now realize that the issues already exist without the patch09:54
priteaublazar-manager doesn't like receiving SIGHUP. Maybe an eventlet issue?09:55
priteauI will open a Launchpad bug.09:55
priteauAnother easy patch, just to clear the queue: https://review.openstack.org/#/c/619464/09:56
masahitoI guess RPCServer in blazar.utils.service should need to have SIGHUP signal handler.09:56
priteauOK, thanks for the pointer. We will need to look into it. In the meantime I think we can merge the mutable config patch.10:00
priteauWe're running out of time. I think most patches now have a -1 with action to update them, so we made good progress.10:00
masahitopriteau: I'll update the floating ip spec in this week. please review it.10:01
priteauThanks masahito10:01
priteauNo meeting next week, then code review again the week after (December 11)10:01
priteauThanks everyone!10:01
priteauHave a good trip10:01
priteau#endmeeting10:01
*** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings/"10:01
openstackMeeting ended Tue Nov 27 10:01:57 2018 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)10:02
openstackMinutes:        http://eavesdrop.openstack.org/meetings/blazar/2018/blazar.2018-11-27-09.00.html10:02
openstackMinutes (text): http://eavesdrop.openstack.org/meetings/blazar/2018/blazar.2018-11-27-09.00.txt10:02
openstackLog:            http://eavesdrop.openstack.org/meetings/blazar/2018/blazar.2018-11-27-09.00.log.html10:02
masahitothanks, bye10:02
*** bertys has quit IRC10:04
*** masahito has quit IRC10:13
*** bhavikdbavishi has quit IRC10:22
*** erlon has joined #openstack-meeting-alt10:26
*** jlvillal has joined #openstack-meeting-alt10:58
*** markstur has joined #openstack-meeting-alt11:07
*** markstur has quit IRC11:11
*** bhavikdbavishi has joined #openstack-meeting-alt11:19
*** dosaboy has quit IRC11:24
*** dosaboy has joined #openstack-meeting-alt11:31
*** sambetts_ is now known as sambetts|afk11:32
*** raildo has joined #openstack-meeting-alt11:37
*** armstrong has joined #openstack-meeting-alt11:43
*** rfolco is now known as rfolco_doctor11:45
*** chhagarw has joined #openstack-meeting-alt11:54
*** bhavikdbavishi has quit IRC11:54
*** janki has quit IRC11:59
*** ccamacho has quit IRC12:12
*** tetsuro has quit IRC12:13
*** yamamoto has quit IRC12:16
*** yamamoto has joined #openstack-meeting-alt12:16
*** ccamacho has joined #openstack-meeting-alt12:41
*** erlon has quit IRC12:48
*** vishalmanchanda has joined #openstack-meeting-alt12:48
*** erlon has joined #openstack-meeting-alt12:59
*** ccamacho has quit IRC13:04
*** ccamacho has joined #openstack-meeting-alt13:04
*** jhesketh_ has joined #openstack-meeting-alt13:44
*** carthaca has left #openstack-meeting-alt13:49
*** jhesketh has quit IRC13:50
*** armstrong has quit IRC13:53
*** pbourke has quit IRC14:07
*** cloudrancher has quit IRC14:15
*** cloudrancher has joined #openstack-meeting-alt14:15
*** dustins has joined #openstack-meeting-alt14:20
*** chhagarw has quit IRC14:27
*** hongbin has joined #openstack-meeting-alt14:41
*** chhagarw has joined #openstack-meeting-alt14:51
*** rfolco_doctor is now known as rfolco14:53
*** dpawlik has quit IRC15:04
*** ianychoi_ is now known as ianychoi15:06
*** chhagarw has quit IRC15:07
*** lpetrut has quit IRC15:18
*** lewo has joined #openstack-meeting-alt15:27
*** bhavikdbavishi has joined #openstack-meeting-alt15:31
*** wxy| has joined #openstack-meeting-alt15:36
*** pbourke has joined #openstack-meeting-alt15:37
*** jcoufal has joined #openstack-meeting-alt15:47
*** ayoung has joined #openstack-meeting-alt15:48
*** jgrosso has joined #openstack-meeting-alt15:49
*** dpawlik has joined #openstack-meeting-alt15:50
*** dtrainor__ is now known as dtrainor15:52
*** jcoufal has quit IRC15:52
*** gagehugo has joined #openstack-meeting-alt15:53
*** ttsiouts has joined #openstack-meeting-alt15:58
lbragstad#startmeeting keystone16:00
openstackMeeting started Tue Nov 27 16:00:29 2018 UTC and is due to finish in 60 minutes.  The chair is lbragstad. Information about MeetBot at http://wiki.debian.org/MeetBot.16:00
openstackUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.16:00
*** openstack changes topic to " (Meeting topic: keystone)"16:00
openstackThe meeting name has been set to 'keystone'16:00
lbragstad#link https://etherpad.openstack.org/p/keystone-weekly-meeting16:00
lbragstadagenda ^16:00
wxy|o/16:00
gagehugoo/16:01
lbragstadwe can give folks a couple minutes16:01
*** dansmith has quit IRC16:02
*** dansmith has joined #openstack-meeting-alt16:02
*** diablo_rojo has joined #openstack-meeting-alt16:02
knikollao/16:02
jdennisjdennis: o/16:02
lbragstadalright - let's go ahead and get started16:03
lbragstad#topic announcements16:03
*** openstack changes topic to "announcements (Meeting topic: keystone)"16:03
lbragstad#info we're just over a month away from milestone-216:04
lbragstadreminder that milestone-2 is going to mark specification freeze16:04
lbragstadand feature proposal freeze is only a couple weeks after that16:04
lbragstadthere are still several specifications up for review that we're planning on implementing this release16:04
lbragstadplease take a look if you have time16:04
*** cloudrancher has quit IRC16:04
lbragstad#link https://review.openstack.org/#/c/599491/16:05
lbragstad#link https://review.openstack.org/#/c/541903/16:05
*** cloudrancher has joined #openstack-meeting-alt16:05
lbragstadand a bunch of those ones for the edge/multi-region/federated use cases we talked about in Berlin16:05
lbragstadalso16:06
lbragstad#info keystoneclient-devstack-functional is failing16:06
lbragstadfrickler brought this to us this morning16:06
lbragstadit's been failing consistently for some time16:06
gagehugomysql password incorrect?16:06
*** munimeha1 has joined #openstack-meeting-alt16:07
lbragstad#link http://logs.openstack.org/39/605539/24/check/keystoneclient-devstack-functional/9fff540/job-output.txt.gz#_2018-11-27_04_39_26_93904116:07
lbragstadyeah - it's strange16:07
lbragstadI noticed other projects have similar scripts, nearly identical actually16:07
lbragstadbut they their functional jobs aren't failing16:07
lbragstadbut their*16:07
lbragstadso it might be something with zuul + how we set things up in keystone16:08
lbragstadanyway - wanted to plug it here in case it piqued anyone'16:08
lbragstadanyone's interest*16:08
lbragstad#topic Keystone as an IdP16:09
*** openstack changes topic to "Keystone as an IdP (Meeting topic: keystone)"16:09
lbragstadi'm not sure kmalloc is around16:09
lbragstadbut the plan is to go through all the bits for this in more detail, since it was discussed at length in Berlin16:09
lbragstadand there are more than a handful of new specs related to it16:10
lbragstadwe'll circle back if kmalloc hops on16:10
lbragstad#topic default roles and system-scope progress16:10
*** openstack changes topic to "default roles and system-scope progress (Meeting topic: keystone)"16:10
lbragstadthis is one of the bigger initiatives we're tackling this release16:10
lbragstadi apologize for all the IRC bot and bug spam recently16:10
lbragstadbut I broke everything out into smaller bug reports, hoping that it will help enable people to pick things up16:11
kmallocO/16:11
lbragstadso they don't feel pressured into committing to a whole pile of work16:11
lbragstadthey can just pick up a couple things here or there if they have time, but would still be a huge help16:11
*** markstur has joined #openstack-meeting-alt16:11
lbragstadultimately, i created bugs for all keystone policies/apis that aren't currently using the defaults roles work hrybacki did in rocky16:12
lbragstad#link https://bugs.launchpad.net/keystone/+bugs?field.tag=default-roles16:12
kmallochere.16:12
kmallocsorry16:12
lbragstadno worries - i'll wrap up my topic quick and hand the floor over16:12
ayoungworks for me16:13
kmallocno arch diagram that will be next week.16:13
lbragstadhere is what an example fix for the default role bugs looks like16:13
kmallocbut we can go over stuff otherwise.16:13
lbragstad#link https://review.openstack.org/#/c/620156/116:13
lbragstadit's mostly tests that showcase the behaviors for each scope16:13
ayoungthere are some subtlties on the implied roles one, I added a comment.  Lets us keep a place for those convos, so, I like the smaller bug reports16:13
lbragstad++16:13
lbragstadi also have other reports dedicated to system-scope gaps16:14
lbragstad#link https://bugs.launchpad.net/keystone/+bugs?field.tag=system-scope16:14
lbragstadideally - they go hand-in-hand16:14
lbragstadbut depending on the API, there isn't a dependency between those two bugs if they affect the same API16:15
lbragstadjust trying to make sure we track how much work it takes to fix all this16:15
lbragstaddoes anyone have comments, questions, or concerns about system-scope or default roles work?16:15
lbragstador wants to jump in and pick up one or two?16:16
lbragstad;)16:16
ayounglbragstad, we are ok with breaking people with these, right?16:16
lbragstadbreak people how?16:16
ayoungchanging roles for APIs will not match the old policies.16:17
lbragstadyeah - so we have tooling in oslo.policy to handle that for us16:17
lbragstadand make it graceful for operators16:17
ayoungHopefully in a "it not longer works" way as oppposed to "oops we let something else in" way16:17
lbragstadmy goal is to be explicit with the former16:18
kmallocas long as we support the model of: [override-new] > [override-old] > (DEFAULT NEW || DEFAULT OLD)16:18
kmallocwe should be 100% ok16:18
lbragstadso it's *really* clear what we support by default from an authorization perspective upstream16:18
kmallocand not letting random stuff fall through16:18
kmallocjust adding additional permissions that operators can opt into16:19
kmalloc(for transition)16:19
lbragstad#link https://review.openstack.org/#/c/614195/ should help with that16:19
kmallocand then it becomes Override NEw > Default New (eventually)16:19
lbragstadsame with #link https://review.openstack.org/#/c/613635/16:19
kmalloconce transition is done16:19
kmalloclong view.16:19
lbragstadwe'll also need #link https://review.openstack.org/#/c/611443/16:20
lbragstadkmalloc those cases might be addressed in https://review.openstack.org/#/c/614195/5/oslo_policy/tests/test_policy.py16:21
kmalloclbragstad: i'll check16:22
lbragstadthanks16:22
kmalloci want to be sure16:22
kmalloc:)16:22
lbragstadultimately, everything under keystone.tests.unit.protection.v3 should explicitly test each scope against each default role16:22
kmalloci need to leave as soon as the meeting is over btw.16:22
lbragstadok - that's about all i had for this16:23
lbragstadfeel free to ping me if you'd like to chip in on a couple of those bugs, or have questions16:23
lbragstadotherwise, i have fixes for several of them up (i need to update the branch)16:23
lbragstad#link https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:bug/178841516:23
lbragstadand they are all dependent on #link https://review.openstack.org/#/c/605539/16:24
lbragstadonce ^ merges, I'll rebase them16:24
lbragstadany other questions?16:24
kmalloc... "lance, where do users come from?" :P16:25
ayoungAre we going to go into this detail for the other services?16:25
lbragstadHTTP 40316:25
lbragstadayoung how do you mean?16:25
ayoungNova16:25
kmallocayoung: we will provide help as we did for in-code policy16:25
lbragstadlike helping them consume these changes?16:25
ayoungNeutron and so on.  Bug reports for the APIS?16:26
lbragstadi'll likely leave that to each project16:26
ayounga way to have the convos about what scope a given API should really have?16:26
kmallocthe plan is to support and make it a community goal16:26
kmallocsimilar to how we did policy-in-code16:26
lbragstadright16:26
ayoungYeah...and GLance will get around to it.16:26
kmallocglance needs help16:26
kmallocit is probably a place we need to explicitly step up16:26
lbragstadbefore we can do that we'll need to have it working in keystone first16:26
kmalloc=/16:26
kmallocbut i think the order is Keystone, Nova, Community Goal... and supporting glance16:27
lbragstadjokke and i had a conversation about how policy-in-code works16:27
lbragstadi think he's up to speed now16:27
kmallocglance will get there16:27
lbragstadhe told me a couple days ago that he's going to poke with the changes locally16:27
ayounghttps://review.openstack.org/#/c/501360/  Still -1.  I'll rework that16:27
kmallocthey might get policy-in-code and new defaults in short succession16:27
*** jcoufal has joined #openstack-meeting-alt16:28
*** apetrich has quit IRC16:28
ayoungCool.  This really needs to be in across the board to be usable16:28
kmallocthat is the plan.16:29
lbragstadi agree16:29
ayoungWe need a banana test in Tempest16:29
ayoungcreate a "banana" role and assign it.  It should not be able to do anything16:29
lbragstadgmann is working on the system-scope stuff from the tempest side16:29
kmallocayoung: sorryk, but our new super-admin role is named banana16:30
*** lpetrut has joined #openstack-meeting-alt16:30
kmalloc /s16:30
ayounghttps://lh3.googleusercontent.com/-CjxR7w-1iHA/UvfAaZCCr6I/AAAAAAAAJtk/G-Knih6Ze7M/s400/We%2520Are%2520in%2520a%2520Book%2520Mo%2520Willems%25202.jpg16:31
ayoungYou guys don't know Elephant and Piggy.  yet.16:31
lbragstadanything else before we move on?16:31
lbragstad#topic Keystone as an IdP Proxy16:32
*** openstack changes topic to "Keystone as an IdP Proxy (Meeting topic: keystone)"16:32
lbragstadkmalloc you're up16:32
kmallocok16:32
kmallocquick note: I am working on an architecture diagrame16:32
knikollaawesome16:33
kmallocit should be done for the next meeting. but with holiday/travel/other things... it's a bit delayed16:33
lbragstadcc ildikov ^16:33
kmallocit will cover the forward looking goals I see for Keystone, specifically how it works as an IDP and an IDP Proxy16:33
ayoungWhy do we call it a Proxy?16:33
kmallocofficially that is the wrong term16:34
knikollabroker?16:34
kmalloci am trying to reword that to be Broker16:34
kmallocyes16:34
lbragstadbecause the idea was to shuffle identities between formats16:34
*** chhagarw has joined #openstack-meeting-alt16:34
ayoungAnd not just IdP?16:34
ayoungAh16:34
kmallocit's some rewiring in my head to keep saying Identity Broker16:34
lbragstadso if you have a google user16:34
kmallocwe will be a full featured IDP but also have the ability to broker from one form to another16:34
kmallocIDP[s] -> Keystone -> SP[s]16:35
ayoungTranslation from SAML to OIDC and so on?16:35
lbragstadyou can use keystone to convert whatever google gives you to prove your identity, to something else16:35
kmallocyes16:35
kmallocayoung: the SPs will consume whatever they consume, keystone will broker from one form to that form for the SP.16:35
kmallocor the *best* form for the SP in the case it supports many16:35
knikollaright now we already do that but with SAML ECP.16:35
ayoungAdapter16:35
knikollafor the k2k pieces.16:35
kmallocthe industry(ish) term is broker for this16:36
lbragstadwell - we do have a great track record for naming things16:36
ayounghttps://en.wikipedia.org/wiki/Adapter_pattern16:36
kmallocit is an adapter pattern16:36
ayoungBut...Broker is right16:36
kmallocyep.16:36
kmalloc100%16:36
ayoungbecause we are not making an Adapter, we are converting one to the other16:36
kmallocso, the core bits we need from today.16:36
kmalloc1) Auth will be split from CRUD (backlogged SPEC)16:37
kmallocthis is so our well-defined endpoints for auth are located at /auth/XXXX16:37
kmalloc /v3/auth will reamin16:37
kmallocremain*16:37
kmallocno one will be broken on that front16:37
ayoungBut...we are going to add additional auth attributes in addition to the original assertion.  Specifically, we add the Keystone role assignment data.  THey can ignore it, but they can consume it, too, right?16:37
kmallocthe goal is here 2 fold: let us iterate on crud independant of auth *and* auth can be exposed in isolation from crud for auth to the SPs16:38
kmallocayoung: correct. we will pass through but also allow for applying keystone permissions directly16:38
kmallocayoung: that is the "virtual organization" parts.16:38
ayoungCool.  This is going to explode on us, but, I think, in a good way16:39
kmallocthe second bit we need (2)16:39
kmallocis the principal object16:39
kmallocthis is to replace shadow users.16:39
kmallocand be fully featured16:39
lbragstadhopefully we can just extend shadow users16:40
kmallockeystone will maintain a single consistent user object that many AuthN sources can hook onto16:40
kmallocit is either "extend and fix shadow users" or "replace shadow users and drop shadow users"16:40
kmallocit looks to be about the same amount of work16:40
lbragstadyeah - i just hope its the first and not the second :)16:40
kmallocand i worry how deep / odd shadow users is due to where it left off16:40
kmallocKey bits: Users are principals16:41
kmallocGroups are groupings of principals16:41
kmallocapp creds are principals16:41
kmallocprojects are *most likely* a group of principals16:41
*** tpsilva has joined #openstack-meeting-alt16:41
ayoungapp creds contain a principal and a delegation16:41
kmallocayoung: ++16:41
lbragstadi think the next step in that work is to grok the current state of things16:42
kmallocthe key is normalizing the data structure and making sure we have a clear object that AuthN hooks into, a source of AuthN will be the SQL (password) backend or LDAP backend16:42
lbragstadand see if we can trace steps that rderose and dstanek were workings towards16:42
kmallocthese will not implement the entire identity driver anymore, they will be a source of Auth hooked onto the user principal16:42
*** apetrich has joined #openstack-meeting-alt16:42
kmallocany questions so far? I can keep moving on the rest of the bits needed16:43
ayoungAre we going to support a basi-cauyth mechansim under /auth?16:43
ayoungbasic-auth16:44
kmallocayoung: the plan would be to be more fully featured on that front16:44
kmallocand implement as much as we can directly in python16:44
kmallocwe may offload to a web server/module16:44
lbragstadayoung  like #link https://en.wikipedia.org/wiki/Basic_access_authentication ?16:44
kmallocbut we should implement the functionality 100% in python where possible16:44
ayoungYeah, basic auth would have to be Python16:44
kmalloclbragstad: yeah, both basic and digest mode.16:45
ayoungand work based on a GET16:45
kmallocpart of that deal is there will be a UI added to keystone.16:45
kmallocwe are a standalone IDP, deployers need a way to interact with keystone16:45
kmallocin isolation of horizon etc16:45
kmallocwe will continue support for horizon (of course)16:46
ayoung"All My plans are coming together"16:46
kmallocBASIC AUTH, SAML, OIDC, Digest+Basic will work16:46
kmallocwe will also implement support for U2F/FIDO in the ui for Multi-factor Auth16:46
kmallocthe UI will be something akin to React based (may change the framework)16:47
kmallocthe goal is to strictly reference the API not be a layer inbetween with more python (e.g. django)16:47
*** markstur_ has joined #openstack-meeting-alt16:48
ayoungDo we have an HTML renderer for Flask?16:48
kmallocthere will be discussions about a V4 crud api along the way for supporting the UI because we may want to restructure how the API works for this (breaking changes, but mostly cruft cleanup/re-homing)16:48
kmallocayoung: flask easily supports it16:48
kmallocayoung: we already use it in a couple places, notably in 404 errors16:48
kmallocunrouted-404 errors16:49
kmallocand some other cases (ec2)16:49
kmallocthe V4 CRUD api will be discussed one the core bits of Keystone are worked through16:49
kmalloconce*16:50
kmallocthat would be in support of the UI. restructuring the API under flask is much faster if we decide to do this.16:50
kmalloca couple additional security bits will be needed16:50
ayoungExcellent16:50
kmallocJWT (for full OIDC support)16:50
kmallocyes i classify that as security16:50
*** markstur has quit IRC16:51
lbragstad<shameless-plug>The jwt stuff is up for review along with the specification</shameless-plug>16:51
kmalloci want to fully support the timestamp protocol as well for signing when things occur (creation/cadf/tokens) as well16:51
kmallocwe will need to look at the at-rest data storage in SQL and ensure we are being good at PII, and can support PCI-DSS/NIST recommendations as well as cover GDPR concerns16:52
lbragstadtime check - 7 minutes left16:52
kmallocthanks16:52
knikollathis, adjutant, and athenz makes me so happy.16:53
ayoungkmalloc, you do all your keystone development in containers, right?  Do you have a document contributors can follow?  Should we get that into keystone/doc/source?16:53
kmallocwe will finally need to add much much much better autoprovisioning16:53
kmallocayoung: i plan to get that codified into git (the dev docs)16:54
ayoung++16:54
kmallocand yes, i use containers for everything16:54
* lbragstad has ideas for that based on what penick was talking about 16:54
kmalloclbragstad: exactly16:54
ayoungI'll revisit.  Its been a year16:54
ayoungor more16:54
kmallocso, in Stein: I want these things to land16:54
kmalloc1) Auth support at /auth16:54
lbragstadfwiw - i was going to wait for recordings to get posted for posting by summary16:54
knikollawith the above things aligning with what i need to get done for the MOC, y'all get 60% of my time.16:55
lbragstadbut that's going to be a bit, so i'll just publish today and update later16:55
kmalloc2) principal work (shadow users rework)16:55
knikollaup from 20%16:55
kmalloc3) Federation support (brokering) changes16:55
kmalloc4) JWT16:55
kmalloc(no particular order)16:55
kmallocautoprovisioning becomes a #5 if we can16:56
kmallocv4 API, UI, Timestamp protocol, those will likely be post Stein16:56
kmallocwe will also need a LOT of cleanup on our internal SQL store.16:56
kmallocoh one last bit we need to clearly work out16:57
kmallocE-Tag/Cache-Control16:57
ayoungVideos are slow to land this summit.  Something is not working right in the process. Used to be up during the week of.16:57
kmallocwhich comes post UI16:57
kmallocso i see 3-4 specs in Stein.16:57
kmallocstill to do.16:58
kmallocJWT is almost done, so that is easy16:58
*** vishalmanchanda has quit IRC16:58
* kmalloc hands the mic back to lbragstad 16:58
knikollakmalloc: i can take on some of that during office hours. together with polishing the renewable app creds specs.16:58
kmalloccool.16:58
knikollaso let's sync up16:58
lbragstad#topic open discussion16:58
*** openstack changes topic to "open discussion (Meeting topic: keystone)"16:58
kmallocoh yeah refreshable app creds needed too16:58
kmallochaha16:59
lbragstadone minute left if anyone has anything16:59
kmalloci am AFK for a few hours post meeting16:59
kmallocfyi (knikolla)16:59
kmallocnot IDP related16:59
kmallocwe should explore gabbi for functional tests16:59
kmalloccdent has done a good chunk of work on it.16:59
kmallocit's awesome.16:59
*** gyee has joined #openstack-meeting-alt16:59
kmallocgyee: you're off by an hour :P DST!16:59
lbragstadalright - let's wrap up16:59
lbragstadthanks for coming, all17:00
lbragstadreminder office hours in -keystone17:00
lbragstad#endmeeting17:00
*** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings/"17:00
openstackMeeting ended Tue Nov 27 17:00:22 2018 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)17:00
openstackMinutes:        http://eavesdrop.openstack.org/meetings/keystone/2018/keystone.2018-11-27-16.00.html17:00
openstackMinutes (text): http://eavesdrop.openstack.org/meetings/keystone/2018/keystone.2018-11-27-16.00.txt17:00
*** jdennis has left #openstack-meeting-alt17:00
openstackLog:            http://eavesdrop.openstack.org/meetings/keystone/2018/keystone.2018-11-27-16.00.log.html17:00
*** lpetrut has quit IRC17:01
*** gagehugo has left #openstack-meeting-alt17:02
*** wxy| has quit IRC17:04
*** ttsiouts has quit IRC17:06
*** ttsiouts has joined #openstack-meeting-alt17:07
*** lpetrut has joined #openstack-meeting-alt17:10
*** ttsiouts has quit IRC17:11
*** dpawlik has quit IRC17:13
*** dpawlik has joined #openstack-meeting-alt17:14
*** dpawlik has quit IRC17:18
*** diablo_rojo has quit IRC17:19
*** derekh has quit IRC17:23
*** dpawlik has joined #openstack-meeting-alt17:29
*** apetrich has quit IRC17:30
*** jcoufal has quit IRC17:31
*** dpawlik has quit IRC17:34
*** diablo_rojo has joined #openstack-meeting-alt17:35
*** apetrich has joined #openstack-meeting-alt17:50
*** ijw has joined #openstack-meeting-alt17:56
*** yamahata has quit IRC17:58
*** iyamahat has quit IRC17:58
*** ijw has quit IRC18:02
*** bnemec has quit IRC18:06
*** jcoufal has joined #openstack-meeting-alt18:06
*** bnemec has joined #openstack-meeting-alt18:06
*** bhavikdbavishi has quit IRC18:08
*** sridharg has quit IRC18:09
*** jtomasek has quit IRC18:12
*** kopecmartin is now known as kopecmartin|off18:16
*** iyamahat has joined #openstack-meeting-alt18:18
*** lpetrut has quit IRC18:33
*** jgrosso has quit IRC18:35
*** tsmith_ has joined #openstack-meeting-alt18:37
*** yamahata has joined #openstack-meeting-alt18:37
*** dpawlik has joined #openstack-meeting-alt18:37
*** tsmith2 has quit IRC18:40
*** tsmith_ is now known as tsmith218:40
*** dpawlik has quit IRC18:42
*** tssurya has quit IRC18:50
*** dpawlik has joined #openstack-meeting-alt18:53
*** Ablu has quit IRC18:54
*** dpawlik has quit IRC18:57
*** jlvillal has left #openstack-meeting-alt19:11
*** Ablu has joined #openstack-meeting-alt19:13
*** erlon has quit IRC19:17
*** chhagarw has quit IRC19:28
*** dpawlik has joined #openstack-meeting-alt19:38
*** cloudrancher has quit IRC19:39
*** cloudrancher has joined #openstack-meeting-alt19:40
*** cloudrancher has quit IRC19:40
*** cloudrancher has joined #openstack-meeting-alt19:41
*** ayoung has quit IRC19:51
*** Ablu has quit IRC19:56
*** cloudrancher has quit IRC20:00
*** cloudrancher has joined #openstack-meeting-alt20:01
*** Ablu has joined #openstack-meeting-alt20:04
*** dustins has quit IRC20:06
*** jcoufal has quit IRC20:09
*** jtomasek has joined #openstack-meeting-alt20:17
*** slaweq_ has joined #openstack-meeting-alt20:44
*** jtomasek has quit IRC20:45
*** rossella_s has quit IRC20:57
*** slaweq_ has quit IRC21:03
*** raildo has quit IRC21:14
*** jcoufal has joined #openstack-meeting-alt21:28
*** yamamoto has quit IRC21:29
*** tpsilva has quit IRC21:31
*** priteau has quit IRC21:47
*** dpawlik has quit IRC21:54
*** dpawlik has joined #openstack-meeting-alt21:55
*** dpawlik has quit IRC22:00
*** slaweq has quit IRC22:03
*** yamamoto has joined #openstack-meeting-alt22:07
*** yamamoto has quit IRC22:18
*** slaweq has joined #openstack-meeting-alt22:19
*** slaweq has quit IRC22:24
*** munimeha1 has quit IRC22:45
*** rossella_s has joined #openstack-meeting-alt22:45
*** iyamahat_ has joined #openstack-meeting-alt22:53
*** priteau has joined #openstack-meeting-alt22:54
*** jcoufal has quit IRC22:56
*** iyamahat has quit IRC22:56
*** radeks has quit IRC22:57
*** rcernin has joined #openstack-meeting-alt22:57
*** iyamahat_ has quit IRC22:58
*** iyamahat has joined #openstack-meeting-alt22:58
*** priteau has quit IRC22:58
*** rossella_s has quit IRC23:23
*** slaweq has joined #openstack-meeting-alt23:29
*** slaweq has quit IRC23:33
*** yamamoto has joined #openstack-meeting-alt23:34
*** jhesketh_ is now known as jhesketh23:51
*** iyamahat has quit IRC23:54
*** diablo_rojo has quit IRC23:57
*** hongbin has quit IRC23:59

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!