| *** markvoelker has quit IRC | 00:02 | |
| *** gyee has quit IRC | 00:14 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 00:21 | |
| *** jamesmcarthur has quit IRC | 00:23 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 00:23 | |
| *** lseki has quit IRC | 00:37 | |
| *** hongbin has joined #openstack-meeting-alt | 01:03 | |
| *** jamesmcarthur has quit IRC | 01:05 | |
| *** igordc has quit IRC | 01:08 | |
| *** macz has quit IRC | 01:36 | |
| *** markvoelker has joined #openstack-meeting-alt | 02:03 | |
| *** markvoelker has quit IRC | 02:08 | |
| *** apetrich has quit IRC | 02:11 | |
| *** rfolco has quit IRC | 02:28 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 02:38 | |
| *** persia has quit IRC | 02:50 | |
| *** persia has joined #openstack-meeting-alt | 02:56 | |
| *** jamesmcarthur has quit IRC | 02:57 | |
| *** radeks has quit IRC | 03:00 | |
| *** dave-mccowan has quit IRC | 03:00 | |
| *** baojg has quit IRC | 03:15 | |
| *** persia has quit IRC | 03:18 | |
| *** baojg has joined #openstack-meeting-alt | 03:23 | |
| *** persia has joined #openstack-meeting-alt | 03:24 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 03:56 | |
| *** jamesmcarthur has quit IRC | 03:56 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 03:57 | |
| *** hongbin has quit IRC | 04:01 | |
| *** hongbin has joined #openstack-meeting-alt | 04:08 | |
| *** hongbin has quit IRC | 04:10 | |
| *** baojg has quit IRC | 04:27 | |
| *** macz has joined #openstack-meeting-alt | 04:28 | |
| *** macz has quit IRC | 04:33 | |
| *** jamesmcarthur has quit IRC | 04:51 | |
| *** baojg has joined #openstack-meeting-alt | 04:54 | |
| *** radeks has joined #openstack-meeting-alt | 05:01 | |
| *** radeks has quit IRC | 05:03 | |
| *** radeks has joined #openstack-meeting-alt | 05:05 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 05:21 | |
| *** boxiang has joined #openstack-meeting-alt | 05:47 | |
| *** zhubx has quit IRC | 05:47 | |
| *** diablo_rojo has joined #openstack-meeting-alt | 06:04 | |
| *** jamesmcarthur has quit IRC | 06:10 | |
| *** jtomasek has joined #openstack-meeting-alt | 06:22 | |
| *** slaweq has joined #openstack-meeting-alt | 06:26 | |
| *** kopecmartin|off is now known as kopecmartin | 06:31 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 06:32 | |
| *** jamesmcarthur has quit IRC | 06:37 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 06:45 | |
| *** markvoelker has joined #openstack-meeting-alt | 06:47 | |
| *** markvoelker has quit IRC | 06:52 | |
| *** jbadiapa has quit IRC | 07:08 | |
| *** diablo_rojo has quit IRC | 07:10 | |
| *** jamesmcarthur has quit IRC | 07:17 | |
| *** diablo_rojo has joined #openstack-meeting-alt | 07:20 | |
| *** jbadiapa has joined #openstack-meeting-alt | 07:24 | |
| *** diablo_rojo has quit IRC | 07:27 | |
| *** ttsiouts has joined #openstack-meeting-alt | 07:29 | |
| *** apetrich has joined #openstack-meeting-alt | 07:40 | |
| *** ttsiouts has quit IRC | 07:42 | |
| *** ttsiouts has joined #openstack-meeting-alt | 07:43 | |
| *** slaweq has quit IRC | 07:43 | |
| *** priteau has joined #openstack-meeting-alt | 07:43 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 07:44 | |
| *** ttsiouts has quit IRC | 07:47 | |
| *** rcernin has quit IRC | 07:47 | |
| *** jamesmcarthur has quit IRC | 07:50 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 07:52 | |
| *** slaweq has joined #openstack-meeting-alt | 07:52 | |
| *** browny_ has joined #openstack-meeting-alt | 08:05 | |
| *** browny has quit IRC | 08:07 | |
| *** lpetrut has joined #openstack-meeting-alt | 08:07 | |
| *** lpetrut has quit IRC | 08:08 | |
| *** ttsiouts has joined #openstack-meeting-alt | 08:12 | |
| *** jamesmcarthur has quit IRC | 08:15 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 08:16 | |
| *** igordc has joined #openstack-meeting-alt | 08:20 | |
| *** igordc has quit IRC | 08:28 | |
| *** derekh has joined #openstack-meeting-alt | 08:33 | |
| *** bobmel has joined #openstack-meeting-alt | 08:38 | |
| *** e0ne has joined #openstack-meeting-alt | 08:41 | |
| *** slaweq has quit IRC | 08:52 | |
| *** masahito has joined #openstack-meeting-alt | 08:55 | |
| *** bertys has joined #openstack-meeting-alt | 08:58 | |
| priteau | #startmeeting blazar | 09:00 |
|---|---|---|
| openstack | Meeting started Tue Sep 17 09:00:16 2019 UTC and is due to finish in 60 minutes. The chair is priteau. Information about MeetBot at http://wiki.debian.org/MeetBot. | 09:00 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 09:00 |
| *** openstack changes topic to " (Meeting topic: blazar)" | 09:00 | |
| openstack | The meeting name has been set to 'blazar' | 09:00 |
| priteau | #topic Roll call | 09:01 |
| *** openstack changes topic to "Roll call (Meeting topic: blazar)" | 09:02 | |
| bertys | o/ | 09:02 |
| priteau | Hi bertys, nice to see you | 09:02 |
| bertys | Hi | 09:02 |
| priteau | masahito: hi | 09:04 |
| masahito | o/ | 09:05 |
| priteau | I don't see tetsuro online | 09:06 |
| priteau | Here is the agenda for today: | 09:07 |
| priteau | Enabling Review-Priority flag in Gerrit | 09:07 |
| priteau | PTG and virtual PTG | 09:07 |
| priteau | Train release | 09:07 |
| priteau | Code review priorities | 09:07 |
| priteau | AOB | 09:07 |
| priteau | Anything else you would like to add? | 09:07 |
| priteau | #topic Enabling Review-Priority flag in Gerrit | 09:09 |
| priteau | Come on openstack bot | 09:09 |
| priteau | #topic Enabling Review-Priority flag in Gerrit | 09:09 |
| *** openstack changes topic to "Enabling Review-Priority flag in Gerrit (Meeting topic: blazar)" | 09:09 | |
| priteau | I am working on other OpenStack projects which have enabled an additional flag in Gerrit called Review-Priority | 09:10 |
| *** slaweq has joined #openstack-meeting-alt | 09:10 | |
| priteau | I think it would be useful for us to identify patches that need attention | 09:11 |
| priteau | It needs to be implemented in openstack/project-config | 09:12 |
| priteau | Example: https://review.opendev.org/#/c/295253/13/gerrit/acls/openstack/designate-dashboard.config | 09:12 |
| priteau | I would like to propose a similar change for Blazar repos, if you are happy to have it? | 09:13 |
| masahito | +1 for the change. | 09:14 |
| priteau | Thanks, I will prepare a patch then. | 09:15 |
| bertys | okay for me as well for all repos | 09:15 |
| priteau | Thanks | 09:16 |
| priteau | #action priteau will propose Review-Priority patches | 09:17 |
| priteau | #topic PTG and virtual PTG | 09:17 |
| *** openstack changes topic to "PTG and virtual PTG (Meeting topic: blazar)" | 09:17 | |
| priteau | Reminder that for the PTG we have a Project Onboarding session, and the possibility of having technical discussions scheduled on the fly in the shared space | 09:18 |
| priteau | We need to plan a virtual PTG as well to include everyone in the discussion. I would like to have it before the summit, would you be available during the week of the 28 of October? | 09:19 |
| masahito | On Tuesday? | 09:21 |
| priteau | Not necessarily, if another day is good for you. | 09:22 |
| priteau | There's also the possibility of including Chameleon folks in the discussion, but it may be difficult to schedule due to timezone differences | 09:22 |
| masahito | Got it. Mon-Thu works for me. | 09:23 |
| priteau | This is the timezones if we wanted to involve Chameleon people in the discussion: https://www.timeanddate.com/worldclock/meetingtime.html?day=28&month=10&year=2019&p1=248&p2=64&p3=195&iv=0 | 09:24 |
| priteau | This slot is in the middle of the night for them | 09:25 |
| priteau | There are some possibilities if some are happy to have a meeting quite early or late during the day. But I think the best approach would be for me to have two meetings, one with Chicago and one with the rest of the community (Japan, maybe NTT data too?) | 09:26 |
| priteau | I'll start an Etherpad to collect discussion ideas | 09:28 |
| masahito | yup | 09:28 |
| priteau | Do you know if NTT Data people will be Shanghai? | 09:30 |
| masahito | Sorry, I don't know.. | 09:31 |
| *** jamesmcarthur has quit IRC | 09:31 | |
| priteau | I'll ask them directly | 09:31 |
| priteau | Asmita has been quite active this cycle, it would be good to keep her involved. | 09:32 |
| *** jamesmcarthur has joined #openstack-meeting-alt | 09:32 | |
| priteau | #topic Train release | 09:33 |
| *** openstack changes topic to "Train release (Meeting topic: blazar)" | 09:33 | |
| priteau | python-blazarclient 2.2.1 was released last week: https://pypi.org/project/python-blazarclient/ | 09:34 |
| *** masahito has quit IRC | 09:34 | |
| priteau | We managed to get floating IP update functionality inside, thanks for your reviews | 09:34 |
| *** masahito has joined #openstack-meeting-alt | 09:35 | |
| masahito | sorry, disconnected. | 09:35 |
| priteau | Now focus is on preparing the release of the main Blazar service | 09:35 |
| priteau | Yesterday while testing floating IP again I noticed a big regression | 09:36 |
| priteau | Thanksfully the fix was easy | 09:36 |
| priteau | https://review.opendev.org/#/c/682416/ | 09:36 |
| priteau | This would be Review-Priority +2 if we had the flag ;-) | 09:36 |
| priteau | Also added more floating IP docs, please review https://review.opendev.org/#/c/682411/ | 09:36 |
| bertys | Got it | 09:36 |
| priteau | In general if you are able to do some testing, now is the time | 09:37 |
| priteau | I'll try to merge the last patch from Asmita as an exception because it's been up for a long time, but then we'll be in freeze mode | 09:38 |
| priteau | RC1 during week of Sep 23 - Sep 27 and final RC (if needed) week of Oct 07 - Oct 11 | 09:38 |
| priteau | I'll try to add some floating IP tests to tempest, it's really needed as it would have caught the problem caused by the microversion patch | 09:39 |
| *** boxiang has quit IRC | 09:39 | |
| *** boxiang has joined #openstack-meeting-alt | 09:40 | |
| priteau | #topic Code review priorities | 09:41 |
| *** openstack changes topic to "Code review priorities (Meeting topic: blazar)" | 09:41 | |
| priteau | The two mentioned above: | 09:41 |
| priteau | https://review.opendev.org/#/c/682416/ | 09:41 |
| priteau | https://review.opendev.org/#/c/682411/ | 09:41 |
| priteau | And a trivial fix: https://review.opendev.org/#/c/682405/ | 09:42 |
| priteau | Oh, there's also an IPV6 Train goal, for which a patch was proposed but it doesn't pass Zuul checks | 09:42 |
| priteau | https://review.opendev.org/#/c/682361/ | 09:42 |
| priteau | I haven't looked into it yet. | 09:42 |
| priteau | Value for option os_auth_host from LocationInfo(location=<Locations.user: (4, True)>, detail='/etc/blazar/blazar.conf') is not valid: [::1] is not a valid host address | 09:45 |
| priteau | From the end of https://storage.bhs1.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_258/682361/1/check/blazar-devstack-dsvm-ipv6-only/258dffd/logs/devstacklog.txt.gz | 09:46 |
| priteau | If you are able to work on a fix, please do so | 09:47 |
| priteau | I also need to try the PDF docs build (another community goal) | 09:49 |
| priteau | #topic AOB | 09:50 |
| *** openstack changes topic to "AOB (Meeting topic: blazar)" | 09:50 | |
| priteau | Anything else to discuss? | 09:50 |
| masahito | Not about Blazar, but I noticed Tetsuro is nominated to Placement PTL | 09:51 |
| priteau | Indeed, congratulations to him. I hope he will still have some time for Blazar. | 09:51 |
| masahito | http://lists.openstack.org/pipermail/openstack-discuss/2019-September/009274.html | 09:53 |
| priteau | It's good news for us that Placement has an active leader, even better that it is someone very familiar with Blazar | 09:54 |
| priteau | If that's all for this week, we can end here. | 09:56 |
| priteau | Thanks a lot for joining, please remember to look at the high priority patches | 09:56 |
| bertys | thanks all | 09:57 |
| priteau | #endmeeting | 09:57 |
| *** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings/" | 09:57 | |
| openstack | Meeting ended Tue Sep 17 09:57:06 2019 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 09:57 |
| masahito | thanks | 09:57 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/blazar/2019/blazar.2019-09-17-09.00.html | 09:57 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/blazar/2019/blazar.2019-09-17-09.00.txt | 09:57 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/blazar/2019/blazar.2019-09-17-09.00.log.html | 09:57 |
| *** bertys has quit IRC | 09:57 | |
| *** tetsuro has joined #openstack-meeting-alt | 09:57 | |
| *** ttsiouts has quit IRC | 10:03 | |
| *** ttsiouts has joined #openstack-meeting-alt | 10:04 | |
| *** jamesmcarthur has quit IRC | 10:07 | |
| *** ttsiouts has quit IRC | 10:08 | |
| *** tetsuro has quit IRC | 10:20 | |
| *** tetsuro has joined #openstack-meeting-alt | 10:22 | |
| *** masahito has quit IRC | 10:26 | |
| *** tetsuro has quit IRC | 10:27 | |
| *** tetsuro has joined #openstack-meeting-alt | 10:38 | |
| *** tetsuro has quit IRC | 10:38 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 10:40 | |
| *** carloss has joined #openstack-meeting-alt | 10:53 | |
| *** zhubx has joined #openstack-meeting-alt | 10:58 | |
| *** boxiang has quit IRC | 11:00 | |
| *** ttsiouts has joined #openstack-meeting-alt | 11:01 | |
| *** jamesmcarthur has quit IRC | 11:12 | |
| *** boxiang has joined #openstack-meeting-alt | 11:15 | |
| *** zhubx has quit IRC | 11:18 | |
| *** brault has joined #openstack-meeting-alt | 11:31 | |
| *** brault has quit IRC | 11:36 | |
| *** panda is now known as panda|ruck | 11:41 | |
| *** raildo has joined #openstack-meeting-alt | 11:59 | |
| *** rfolco has joined #openstack-meeting-alt | 12:04 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 12:10 | |
| *** jamesmcarthur has quit IRC | 12:10 | |
| *** jamesmcarthur_ has joined #openstack-meeting-alt | 12:10 | |
| *** markvoelker has joined #openstack-meeting-alt | 12:11 | |
| *** dave-mccowan has joined #openstack-meeting-alt | 12:25 | |
| *** jamesmcarthur_ has quit IRC | 12:26 | |
| *** openstack has joined #openstack-meeting-alt | 12:32 | |
| *** ChanServ sets mode: +o openstack | 12:32 | |
| *** macz has quit IRC | 12:36 | |
| *** bobmel has quit IRC | 12:52 | |
| *** bobmel has joined #openstack-meeting-alt | 12:53 | |
| *** bobmel has quit IRC | 12:55 | |
| *** jcoufal has joined #openstack-meeting-alt | 12:55 | |
| *** bobmel has joined #openstack-meeting-alt | 12:56 | |
| *** bobmel has quit IRC | 12:57 | |
| *** bobmel has joined #openstack-meeting-alt | 13:00 | |
| *** yamamoto has joined #openstack-meeting-alt | 13:20 | |
| *** belmoreira has joined #openstack-meeting-alt | 13:23 | |
| *** macz has joined #openstack-meeting-alt | 13:38 | |
| *** lseki has joined #openstack-meeting-alt | 13:41 | |
| *** macz has quit IRC | 13:43 | |
| *** jamesmcarthur has quit IRC | 13:47 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 14:17 | |
| *** jamesmcarthur has quit IRC | 14:22 | |
| *** lbragstad_ has joined #openstack-meeting-alt | 14:26 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 14:27 | |
| *** lbragstad has quit IRC | 14:28 | |
| *** jamesmcarthur has quit IRC | 14:32 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 14:38 | |
| *** jamesmcarthur has quit IRC | 14:43 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 14:48 | |
| *** ttsiouts has quit IRC | 14:55 | |
| *** ttsiouts has joined #openstack-meeting-alt | 14:55 | |
| *** ttsiouts has quit IRC | 14:59 | |
| *** gagehugo has joined #openstack-meeting-alt | 15:03 | |
| *** ttsiouts has joined #openstack-meeting-alt | 15:03 | |
| *** lbragstad_ is now known as lbragstad | 15:23 | |
| *** boxiang has quit IRC | 15:27 | |
| *** boxiang has joined #openstack-meeting-alt | 15:28 | |
| *** gyee has joined #openstack-meeting-alt | 15:32 | |
| *** carloss has quit IRC | 15:40 | |
| *** jcoufal has quit IRC | 15:42 | |
| *** jcoufal has joined #openstack-meeting-alt | 15:44 | |
| *** e0ne has quit IRC | 15:48 | |
| *** ttsiouts has quit IRC | 15:57 | |
| *** ttsiouts has joined #openstack-meeting-alt | 15:58 | |
| cmurphy | #startmeeting keystone | 16:00 |
| openstack | Meeting started Tue Sep 17 16:00:16 2019 UTC and is due to finish in 60 minutes. The chair is cmurphy. Information about MeetBot at http://wiki.debian.org/MeetBot. | 16:00 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 16:00 |
| *** openstack changes topic to " (Meeting topic: keystone)" | 16:00 | |
| openstack | The meeting name has been set to 'keystone' | 16:00 |
| cmurphy | #link https://etherpad.openstack.org/p/keystone-weekly-meeting agenda | 16:00 |
| lbragstad | o/ | 16:00 |
| bnemec | o/ | 16:02 |
| *** ttsiouts has quit IRC | 16:02 | |
| gagehugo | o/ | 16:02 |
| cmurphy | light attendance today | 16:03 |
| cmurphy | #topic announcements | 16:04 |
| *** openstack changes topic to "announcements (Meeting topic: keystone)" | 16:04 | |
| cmurphy | feature freeze was last week, i put procedural -2s on some unfinished spec implementations and in general no new features should be approved | 16:04 |
| cmurphy | soft string freeze also in effect, i always have a hard time remembering that one | 16:05 |
| cmurphy | requirements freeze also in effect so don't approve changes to requirements.txt | 16:05 |
| bnemec | I'm not sure how many strings are still getting translated outside of horizon at this point. | 16:06 |
| cmurphy | bnemec: interesting, i guess i haven't seen any translation bot proposals in a long time | 16:06 |
| cmurphy | lastly wanted to put out a call again for ptg topics, i haven't done any arrangements since last week so the schedule is still open to expand if there are topics to discuss | 16:08 |
| cmurphy | #link https://etherpad.openstack.org/p/keystone-shanghai-ptg keystone virtual ptg | 16:08 |
| cmurphy | #topic RC1 | 16:09 |
| *** openstack changes topic to "RC1 (Meeting topic: keystone)" | 16:09 | |
| cmurphy | we targeted all the policy migrations for feature freeze and we mostly completed everything we had bug reports for but lbragstad pointed out that some slipped through the cracks | 16:10 |
| cmurphy | i think it's not unreasonable to get those in before the stable branch is cut next week | 16:11 |
| cmurphy | thoughts? | 16:11 |
| lbragstad | i think that sounds good - it'll be tight | 16:11 |
| lbragstad | i think it boils down to four APIs | 16:11 |
| cmurphy | i think the gate is less congested than last week at least | 16:11 |
| lbragstad | 1. project tags (done) 2. project endpoints (relatively simple) 3. limits (underway but needs help) and 4. role assignments for project subtrees | 16:12 |
| bnemec | Check queue is long right now. :-/ | 16:13 |
| lbragstad | i think we can address those four areas - we will no longer have rule:admin_required used anywhere | 16:13 |
| lbragstad | we can also completely remove the policy.v3cloudsample.json file along with the related testing we have for it | 16:14 |
| cmurphy | lbragstad: what help do you need with limits? | 16:14 |
| lbragstad | so - i was digging into a big yesterday | 16:14 |
| lbragstad | i think it just needs to be consolidated into a single check string | 16:14 |
| *** yamamoto has quit IRC | 16:14 | |
| lbragstad | i'm not sure why i decided to write it into three check strings | 16:14 |
| lbragstad | outside of that - i think 95% of the testing for that patch is done, it just needs a little cleanup in the APi | 16:15 |
| lbragstad | cmurphy i think you had a couple comments on additional test cases that would be good to add | 16:15 |
| lbragstad | so - 1. consolidate check strings and policies 2. add the missing tests 3. squash series into a single commit (including removing the limit policies from policy.v3cloudsample.json) | 16:17 |
| cmurphy | sounds good | 16:17 |
| cmurphy | i can take a look at the role assignments one | 16:17 |
| cmurphy | i feel like i conquered the grants api last week | 16:17 |
| lbragstad | ++ | 16:17 |
| lbragstad | all i did was grep the code base for base.RULE_ADMIN_REQUIRED | 16:18 |
| cmurphy | gagehugo: any chance you have time for project endpoints? | 16:18 |
| lbragstad | which returns a bunch of stuff because most hits are false positives since they're deprecated | 16:18 |
| cmurphy | lbragstad: i had a comment on the project tags one, domain admins can't create/update tags for projects in their domain? | 16:19 |
| lbragstad | project-endpoints are strictly system admin, member, and reader, so it should be straight forward | 16:19 |
| lbragstad | cmurphy they cannot | 16:19 |
| cmurphy | lbragstad: why? | 16:19 |
| lbragstad | we had a design discussion during the specification that project tags are "admin-only" | 16:20 |
| lbragstad | e.g., a deployment could use them for billing codes or service memberships | 16:20 |
| lbragstad | (even though we don't recommend that) | 16:20 |
| cmurphy | huh okay | 16:20 |
| lbragstad | and giving a domain admin the ability to modify those would allow them to bump their memberships | 16:20 |
| lbragstad | http://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/project-tags.html#security-impact | 16:21 |
| cmurphy | "Typically, only the project admin should be able to create/edit the tags for a project" | 16:22 |
| lbragstad | ^ technically - that means it shouldn't be visible to anyone but system users, but it was implemented in a way that allows domain and project users to query for tag information | 16:22 |
| cmurphy | that seems like the opposite of what you said | 16:22 |
| lbragstad | oh | 16:22 |
| cmurphy | gagehugo: can you clarify ^ | 16:22 |
| lbragstad | i glossed over project and assumed system | 16:22 |
| gagehugo | sorry stepped away | 16:23 |
| lbragstad | policy.v3cloudsample.json only appears to let project users view tags, not edit them https://opendev.org/openstack/keystone/src/branch/master/etc/policy.v3cloudsample.json#L16-L17 | 16:24 |
| lbragstad | i guess that's what i was going off of ^ | 16:24 |
| lbragstad | but maybe i misinterpreted it | 16:25 |
| cmurphy | i think that policy is in contradiction with the default policy base.RULE_ADMIN_OR_TARGET_PROJECT | 16:26 |
| gagehugo | tags are an attribute of a project, so a project's users should be able to view them the same as other attributes | 16:26 |
| cmurphy | what about modifying them? | 16:26 |
| gagehugo | yeah that sample for get/list should be RULE_ADMIN_OR_TARGET_PROJECT | 16:26 |
| cmurphy | the change in https://review.opendev.org/#/c/682503/3/keystone/common/policies/project.py would have only system admins allowed to modify | 16:26 |
| cmurphy | but the spec makes it seem like project admins should be able to | 16:26 |
| gagehugo | well "admin" of the project can change them already without hitting the /tags url | 16:27 |
| cmurphy | ? | 16:27 |
| lbragstad | because they're using old/deprecated policies? | 16:27 |
| cmurphy | oh | 16:27 |
| gagehugo | I mean they can do an update on the project itself | 16:27 |
| gagehugo | but only that one, not "all" projects | 16:28 |
| lbragstad | but - that's in tandem with old and deprecated policies? | 16:28 |
| cmurphy | in a world where 968696 is closed a project admin shouldn't be able to do a PATCH /v3/projects | 16:28 |
| cmurphy | i don't think? | 16:29 |
| lbragstad | yeah - update_project is rule:admin_required | 16:29 |
| lbragstad | er - that's the deprecated value) | 16:29 |
| lbragstad | then we fixed it to be SYSTEM_ADMIN_OR_DOMAIN_ADMIN | 16:29 |
| lbragstad | project users have no authorization on the PATCH /v3/project/{project_id} api | 16:29 |
| lbragstad | in the new world | 16:30 |
| gagehugo | yes | 16:30 |
| lbragstad | and in the old world of policy, only "project administrators" can update projects (because it's misinterpreted as a cloud admin) | 16:30 |
| gagehugo | yes, any projects | 16:31 |
| cmurphy | so my new-world reading of http://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/project-tags.html#security-impact is that project admins can update project tags (but not projects themselves) and implicitly domain admins and system admins should as well | 16:31 |
| lbragstad | so - i guess we either need to update project tag functionality to all domain and project users to modify tags, or we need to update the specification to be inline with the implementation | 16:32 |
| lbragstad | cmurphy i agree with that view | 16:32 |
| lbragstad | if we want the implementation to match the spec | 16:32 |
| gagehugo | a project admin can update the project tags of projects that they have "admin" on, not all projects | 16:32 |
| lbragstad | gagehugo i don't see how the code allows that | 16:33 |
| gagehugo | PATCH /v3/projects/{project_id} | 16:33 |
| lbragstad | the deprecated policies for project tags use base.RULE_ADMIN_OR_TARGET_PROJECT for only list_project_tags and get_project_tag | 16:33 |
| lbragstad | oh - but that's because of bug 968696 | 16:34 |
| openstack | bug 968696 in OpenStack Identity (keystone) ""admin"-ness not properly scoped" [High,In progress] https://launchpad.net/bugs/968696 - Assigned to Colleen Murphy (krinkle) | 16:34 |
| cmurphy | gagehugo: we're talking about once the deprecated policies are removed and the default policies don't allow that | 16:34 |
| gagehugo | I mean PATCH /v3/projects/{project_id}, not PUT /v3/projects/{project_id}/tags | 16:34 |
| gagehugo | a "project admin" cannot use PUT /v3/projects/{project_id}/tags on just any project anymore though | 16:35 |
| cmurphy | yes the default policies minus deprecations do not allow a user with role:admin on a project to do PATCH /v3/projects/{project_id} | 16:35 |
| gagehugo | oh ok | 16:35 |
| lbragstad | we fixed that in stein i believe | 16:35 |
| gagehugo | I misunderstood | 16:35 |
| lbragstad | in the future - should project and domain users be able to modify tags to projects they're authorized on? | 16:36 |
| cmurphy | ie should they be allowed to PATCH /v3/projects/{project_id} | 16:36 |
| cmurphy | er | 16:36 |
| cmurphy | i meant should they be allowed to PUT /v3/projects/{project_id}/tags | 16:36 |
| lbragstad | ^ yes | 16:36 |
| lbragstad | should they be allowed to modify tags via the tags api directly | 16:36 |
| gagehugo | that was the point of adding a separate API iirc | 16:37 |
| lbragstad | because i wrote https://review.opendev.org/#/c/682503/ such that they can only view tags, not modify them | 16:37 |
| gagehugo | one of the points* | 16:37 |
| cmurphy | good point | 16:37 |
| cmurphy | lbragstad: so i think 682503 needs to be updated to allow project and domain admins to modify tags | 16:39 |
| lbragstad | ok | 16:39 |
| gagehugo | yeah | 16:39 |
| * lbragstad is digging for something quick | 16:40 | |
| lbragstad | do we have project tag documentation? | 16:40 |
| * gagehugo has slept many time since we last discussed tags | 16:40 | |
| gagehugo | times* | 16:40 |
| gagehugo | https://docs.openstack.org/api-ref/identity/v3/#project-tags ? | 16:40 |
| lbragstad | hmm | 16:41 |
| lbragstad | i swear you had a patch that added security concerns somewhere | 16:41 |
| gagehugo | I can look | 16:41 |
| lbragstad | e.g., it was essentially a warning to operators that they shouldn't use tags for important stuff like billing codes or accounting information | 16:41 |
| *** derekh has quit IRC | 16:41 | |
| lbragstad | because we didn't want to have them use them for that use case since it creates a conflict of interest for domain and project users | 16:42 |
| *** carloss has joined #openstack-meeting-alt | 16:42 | |
| gagehugo | yeah, I remember that discussion | 16:43 |
| lbragstad | i can't find that information in the spec or the api reference | 16:44 |
| lbragstad | i'm not sure where it went, but i thought we merged it | 16:44 |
| lbragstad | regardless, i think we have consensus? | 16:44 |
| cmurphy | i think so | 16:44 |
| gagehugo | how are server tags handled? | 16:44 |
| * lbragstad isn't sure | 16:45 | |
| gagehugo | think neutron has network tags too | 16:45 |
| gagehugo | I think we have consensus though | 16:46 |
| lbragstad | https://github.com/openstack/nova/blob/master/nova/policies/server_tags.py | 16:46 |
| lbragstad | admin or owner - so it looks like they grant write operations for tags to non-admins | 16:47 |
| *** diablo_rojo has joined #openstack-meeting-alt | 16:48 | |
| cmurphy | okay to close out this topic i had suggested in last week's newsletter that we use today's office hours to prioritize rc1 bugs, does that sounds like a good idea or should we do that asynchronously? | 16:50 |
| lbragstad | i can help | 16:51 |
| gagehugo | that sounds good | 16:51 |
| lbragstad | do you expect it to take a while | 16:51 |
| lbragstad | ? | 16:51 |
| *** rfolco is now known as rfolco|dentist | 16:51 | |
| cmurphy | i would timebox it at no more than an hour | 16:52 |
| cmurphy | would hope for less | 16:52 |
| lbragstad | ++ | 16:52 |
| *** brault has joined #openstack-meeting-alt | 16:52 | |
| cmurphy | #topic review requests | 16:53 |
| *** openstack changes topic to "review requests (Meeting topic: keystone)" | 16:53 | |
| cmurphy | lbragstad: you had some reviews ^ | 16:53 |
| lbragstad | i did | 16:53 |
| lbragstad | #link https://review.opendev.org/#/c/682266/ | 16:53 |
| lbragstad | ^ isn't ready yet, but i plan on ripping out the policy.v3cloudsample.json file asap (pending the other things we've discussed landing first) | 16:54 |
| lbragstad | #link https://review.opendev.org/#/q/I8f0f7a623a1741f461493d872849fae7ef3e8077 | 16:54 |
| cmurphy | will keep an eye on it | 16:54 |
| lbragstad | ^ those fix system-scope when using domain-specific backends, otherwise system-scope tokens completely fail | 16:54 |
| cmurphy | i approved the one on master, i don't think we can merge the stable backports until that one is merged | 16:54 |
| *** e0ne has joined #openstack-meeting-alt | 16:55 | |
| *** diablo_rojo has quit IRC | 16:55 | |
| gagehugo | looking | 16:55 |
| lbragstad | ++ | 16:55 |
| cmurphy | I'd like reviews on https://review.opendev.org/680788 actually i think it would be best to merge that asap before we get too deep into the rest of the policy fixes | 16:55 |
| cmurphy | #link https://review.opendev.org/680788 | 16:55 |
| lbragstad | sounds good | 16:56 |
| cmurphy | #link https://review.opendev.org/682447 fixes CI for OSA | 16:56 |
| *** zhubx has joined #openstack-meeting-alt | 16:57 | |
| lbragstad | +2 on https://review.opendev.org/#/c/680788/3 | 16:57 |
| * gagehugo likes seeing the test times go from 50 min to 17 with the protection job | 16:57 | |
| lbragstad | ++ | 16:57 |
| cmurphy | lol | 16:57 |
| cmurphy | #topic open floor | 16:58 |
| *** openstack changes topic to "open floor (Meeting topic: keystone)" | 16:58 | |
| cmurphy | anything else for the next two minutes? | 16:58 |
| gagehugo | +2/+A on https://review.opendev.org/#/c/680788/3 | 16:59 |
| cmurphy | ty | 16:59 |
| cmurphy | thanks guys | 17:00 |
| *** boxiang has quit IRC | 17:00 | |
| cmurphy | #endmeeting | 17:00 |
| *** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings/" | 17:00 | |
| openstack | Meeting ended Tue Sep 17 17:00:08 2019 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 17:00 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/keystone/2019/keystone.2019-09-17-16.00.html | 17:00 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/keystone/2019/keystone.2019-09-17-16.00.txt | 17:00 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/keystone/2019/keystone.2019-09-17-16.00.log.html | 17:00 |
| *** e0ne has quit IRC | 17:00 | |
| *** e0ne has joined #openstack-meeting-alt | 17:01 | |
| *** e0ne has quit IRC | 17:05 | |
| *** kopecmartin is now known as kopecmartin|off | 17:06 | |
| *** brault has quit IRC | 17:10 | |
| *** e0ne has joined #openstack-meeting-alt | 17:13 | |
| *** e0ne has quit IRC | 17:17 | |
| *** priteau has quit IRC | 17:32 | |
| *** e0ne has joined #openstack-meeting-alt | 17:33 | |
| *** yamamoto has joined #openstack-meeting-alt | 17:40 | |
| *** e0ne has quit IRC | 17:43 | |
| *** yamamoto has quit IRC | 17:48 | |
| *** igordc has joined #openstack-meeting-alt | 18:16 | |
| *** brault has joined #openstack-meeting-alt | 18:42 | |
| *** e0ne has joined #openstack-meeting-alt | 18:59 | |
| *** gagehugo has left #openstack-meeting-alt | 18:59 | |
| *** brault has quit IRC | 19:16 | |
| *** brault has joined #openstack-meeting-alt | 19:26 | |
| *** brault has quit IRC | 19:32 | |
| *** e0ne has quit IRC | 19:38 | |
| *** jcoufal has quit IRC | 19:45 | |
| *** priteau has joined #openstack-meeting-alt | 19:46 | |
| *** e0ne has joined #openstack-meeting-alt | 19:50 | |
| *** radeks has quit IRC | 19:56 | |
| *** jtomasek has quit IRC | 20:11 | |
| *** priteau has quit IRC | 20:28 | |
| *** panda|ruck is now known as panda|ruck|off | 20:29 | |
| *** zhubx has quit IRC | 20:41 | |
| *** boxiang has joined #openstack-meeting-alt | 20:41 | |
| *** brault has joined #openstack-meeting-alt | 20:48 | |
| *** brault has quit IRC | 20:52 | |
| *** brault has joined #openstack-meeting-alt | 20:57 | |
| *** brault has quit IRC | 21:01 | |
| *** slaweq has quit IRC | 21:10 | |
| *** slaweq has joined #openstack-meeting-alt | 21:11 | |
| *** raildo has quit IRC | 21:12 | |
| *** slaweq has quit IRC | 21:16 | |
| *** e0ne has quit IRC | 21:19 | |
| *** rfolco|dentist is now known as rfolco | 21:23 | |
| *** e0ne has joined #openstack-meeting-alt | 21:28 | |
| *** e0ne has quit IRC | 21:28 | |
| *** slaweq has joined #openstack-meeting-alt | 21:32 | |
| *** markvoelker has quit IRC | 21:35 | |
| *** slaweq has quit IRC | 21:36 | |
| *** jamesmcarthur has quit IRC | 22:13 | |
| *** macz has joined #openstack-meeting-alt | 22:40 | |
| *** lseki has quit IRC | 22:45 | |
| *** macz has quit IRC | 22:47 | |
| *** zhubx has joined #openstack-meeting-alt | 23:09 | |
| *** boxiang has quit IRC | 23:10 | |
| *** slaweq has joined #openstack-meeting-alt | 23:11 | |
| *** slaweq has quit IRC | 23:15 | |
| *** markvoelker has joined #openstack-meeting-alt | 23:22 | |
| *** jamesmcarthur has joined #openstack-meeting-alt | 23:24 | |
| *** igordc has quit IRC | 23:39 | |
| *** rcernin has joined #openstack-meeting-alt | 23:44 | |
| *** yamamoto has joined #openstack-meeting-alt | 23:46 | |
| *** jamesmcarthur has quit IRC | 23:50 | |
| *** yamamoto has quit IRC | 23:51 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!