| yasufum-o | hi tacker team. | 08:00 |
|---|---|---|
| takahashi-tsc | hi | 08:00 |
| manpreetk_ | hi | 08:00 |
| ueha | hi | 08:00 |
| yasufum-o | #startmeeting tacker | 08:01 |
| opendevmeet | Meeting started Tue Feb 28 08:01:42 2023 UTC and is due to finish in 60 minutes. The chair is yasufum-o. Information about MeetBot at http://wiki.debian.org/MeetBot. | 08:01 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 08:01 |
| opendevmeet | The meeting name has been set to 'tacker' | 08:01 |
| yasufum-o | #link https://etherpad.opendev.org/p/tacker-meeting | 08:02 |
| yasufum-o | Three topics on the etherpad. | 08:02 |
| yasufum-o | all of mine. | 08:02 |
| yasufum-o | For first one, it's under discussion, but might be going to move them under tacker because of historical reasons between tacker and these projs. | 08:04 |
| yasufum-o | And second one, no update today. | 08:04 |
| yasufum-o | Is there any comment, or move on to the last topic? | 08:04 |
| takahashi-tsc | I think OK | 08:04 |
| yasufum-o | good | 08:05 |
| yasufum-o | Let's move on to. | 08:06 |
| yasufum-o | I've uploaded my draft on | 08:06 |
| yasufum-o | #link https://etherpad.opendev.org/p/tacker-forum-feedback-for-etsi-nfv-usecases | 08:06 |
| yasufum-o | as I told to do so last meeting. | 08:07 |
| yasufum-o | For system's perspective, it's 751 chars while the limitation is 1000 chars for registering :) | 08:09 |
| yasufum-o | I'm not sure everyone already reviewed it, please give your comment on, or it's also OK to add your comment after the draft overview later. | 08:10 |
| ueha | Thank you. I think it's good. If there is any comment, I will write it on the etherpad. | 08:13 |
| yasufum-o | thanks | 08:14 |
| yuta-kazato | Thanks for updating. I will review and write additional comments if needed:) | 08:14 |
| yasufum-o | takahashi-tsc: By the way, thanks for your update | 08:14 |
| yasufum-o | for cross-community discussion. | 08:14 |
| takahashi-tsc | Sorry for the late... | 08:16 |
| yasufum-o | I think integration and testing must be one of the most interested topic among people will join our session. | 08:16 |
| yasufum-o | Thanks all for the comments. | 08:17 |
| yasufum-o | Although the deadline of the registration for forum is 21th Apr, not so soon, but I'd like to update the draft before the next meeting if it's required. | 08:19 |
| yasufum-o | So, all topics done for today. | 08:20 |
| yasufum-o | Is there any other topic should be shared for now? | 08:21 |
| ueha | Just sharing, the Zuul CI error that occurred for several days no longer occurs. | 08:22 |
| yasufum-o | thx | 08:23 |
| ueha | RC1 is soon, so let's promote reviewing and merging. :) that's all. | 08:23 |
| yuta-kazato | +1 | 08:25 |
| yasufum-o | ueha, takahashi-tcs: As you may notice, it's reamined just one patch on tacker-horizon. | 08:25 |
| yasufum-o | #link: https://review.opendev.org/c/openstack/tacker-horizon/+/867622 | 08:25 |
| manpreetk_ | yasufum-o: The author has placed -1 in workflow. | 08:26 |
| yasufum-o | Without any reason. | 08:26 |
| manpreetk_ | Hmm we can ask author to comment or share direction | 08:27 |
| yasufum-o | manpreetk: Do you know anything about it? | 08:27 |
| manpreetk_ | I ll ask the author to update it ASAP. | 08:27 |
| yasufum-o | I've already given +2 because it looks good to catchup such a dependency and the deadline of RC1 for tacker-horizon is the same as tacker. | 08:29 |
| yasufum-o | I think it might be OK to fix antelope tacker-horizon, but still better it's merged before. | 08:30 |
| yasufum-o | Thanks. | 08:30 |
| takahashi-tsc | I also think the patch itself is OK, but agree with manpreet, i.e. need to confirm with the author. | 08:30 |
| manpreetk_ | Yes will try to get the confirmation before RC1 deadline.Thanks!! | 08:31 |
| ueha | +1 | 08:31 |
| yasufum-o | Is there any other topic, or close this meeting? | 08:31 |
| yasufum-o | good | 08:33 |
| yasufum-o | I hope all patches for antelope will be merged before the end of RC1 week. | 08:34 |
| yasufum-o | Anyway, let's close this meeting. | 08:34 |
| yasufum-o | Thanks for joining, bye. | 08:35 |
| manpreetk_ | Thanks and Bye! | 08:35 |
| ueha | thanks, bye | 08:35 |
| yasufum-o | #endmeeting | 08:35 |
| opendevmeet | Meeting ended Tue Feb 28 08:35:22 2023 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 08:35 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/tacker/2023/tacker.2023-02-28-08.01.html | 08:35 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/tacker/2023/tacker.2023-02-28-08.01.txt | 08:35 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/tacker/2023/tacker.2023-02-28-08.01.log.html | 08:35 |
| yuta-kazato | bye | 08:37 |
| *** kopecmartin_ is now known as kopecmartin | 15:00 | |
| gmann | #startmeeting policy_popup | 17:02 |
| opendevmeet | Meeting started Tue Feb 28 17:02:29 2023 UTC and is due to finish in 60 minutes. The chair is gmann. Information about MeetBot at http://wiki.debian.org/MeetBot. | 17:02 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 17:02 |
| opendevmeet | The meeting name has been set to 'policy_popup' | 17:02 |
| gthiemonge | o/ | 17:03 |
| gmann | #link https://etherpad.opendev.org/p/rbac-goal-tracking#L154 | 17:03 |
| gmann | nothing on agenda but I will be around to answer/discuss if anything | 17:03 |
| gmann | gthiemonge: o/ | 17:03 |
| gthiemonge | gmann: hey, I'm trying to fix the policies in Octavia, we still have some code from the previous specs | 17:04 |
| gthiemonge | so I have this change: | 17:05 |
| gthiemonge | https://review.opendev.org/c/openstack/octavia/+/875620 | 17:05 |
| gthiemonge | it switches the scope_types['system'] to scope_types['project'] | 17:05 |
| gthiemonge | and it makes the legacy admin an admin | 17:05 |
| gmann | +1 | 17:05 |
| gthiemonge | i wanted to check if the s/'system'/'project'/ is fine | 17:05 |
| gmann | yes, we need to make every policy rule to be scope to 'project' | 17:06 |
| gthiemonge | ack | 17:06 |
| gmann | in addition to that, introducing the project_reader role is important | 17:06 |
| gthiemonge | there's project-reader on line 67 | 17:07 |
| gthiemonge | I'll double check that | 17:07 |
| gmann | I see. | 17:08 |
| gmann | I will review your patch today in case anything missing but thanks for working on this | 17:08 |
| johnsom | I have a question here, isn't that "scope" setting just going to be ignored if scopes aren't enabled in the config? | 17:08 |
| gthiemonge | thanks gmann | 17:09 |
| johnsom | oslo.policy should just ignore it if enforce_scope is False right? | 17:10 |
| gmann | johnsom: yes, if enforce_scope is false then oslo policy does not check scope | 17:10 |
| gmann | yes | 17:10 |
| gmann | it will add warning but no error | 17:10 |
| johnsom | So shouldn't we just start removing all of that? | 17:10 |
| gmann | we can and that is long term plan but we need this to be configurable during transition period. so that operators have time to move things to new policy | 17:11 |
| gmann | but yes at the end enforce_scope flag should be removed. 1. make it default to True (like nova, glance did) 2. and then plan to remove at some point | 17:12 |
| johnsom | What? ??? | 17:12 |
| gmann | you asked about enforce_scope right? | 17:12 |
| johnsom | I thought you had previously said scope was not going to happen | 17:13 |
| gmann | every policy to be scoped to 'project' | 17:13 |
| gmann | means if anyone using system scope token we can fail early with 403 | 17:13 |
| johnsom | I thought the new change was scoped tokens are not going to ever be enabled, so scope is no longer a thing and will always be False | 17:13 |
| gmann | no. ok so things is system scope is no longer a things means every policy rule is default to project scope. this way if anyone using system scope token say (system admin) then it will reject early at API validation itself | 17:14 |
| gmann | all policy scope to project help us to give correct error message to operators instead of failing with system scope token in lower layer and confusing error message | 17:15 |
| gmann | #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#change-in-scope-implementation | 17:16 |
| johnsom | Sigh | 17:16 |
| gmann | johnsom: ^^ that paragraph explain about scope thing | 17:17 |
| johnsom | So, scope_types=[constants.RBAC_SCOPE_PROJECT] in the policy in code, those lines can go away right? Or do they have to stay and all just be set to PROJECT? | 17:17 |
| gmann | constants.RBAC_SCOPE_PROJECT is 'project' right? | 17:17 |
| johnsom | yes | 17:18 |
| gmann | so this will stay here. we do not need to remove it | 17:18 |
| gmann | so that system scope token usage can get 403 at early fail | 17:18 |
| gmann | you can just remove constant and just say scope_type=['project'] | 17:19 |
| gmann | but either way you like defined 'project' as constant or direct | 17:19 |
| johnsom | No, we use constants to save RAM. I was just asking why even specify that if all of the policies are going to be project only. | 17:20 |
| gmann | ok, it is juts to early fail system token with 403 | 17:21 |
| johnsom | https://github.com/openstack/oslo.policy/blob/master/oslo_policy/policy.py#L1254 | 17:21 |
| johnsom | Ah, it doesn't default to project | 17:21 |
| gmann | yeah it is None by default | 17:22 |
| gmann | one good example for its benefit is nova server operation. many of it need project_id and system scope token does not have project_id so if system scope token are used it might fail somewhere in DB or other lower layer and error might be confusing. to avoid that raising 403 for system scope token is helpful | 17:24 |
| johnsom | Oh I know the heck I went through to deal with system scoped tokens and no project ID | 17:25 |
| johnsom | Months of wasted time | 17:25 |
| gmann | yeah | 17:27 |
| gmann | johnsom: gthiemonge: anything else to discuss for today? | 17:29 |
| gmann | FYI, there is magnum policy change also in progress. I did not get chance to review it but that is in my list for today #link https://review.opendev.org/c/openstack/magnum/+/875625/2 | 17:30 |
| gthiemonge | gmann: no, that's it for me, thanks | 17:30 |
| johnsom | I don't have anything else. | 17:31 |
| gmann | ok thanks for joining. let's close for today | 17:31 |
| gmann | #endmeeting | 17:32 |
| opendevmeet | Meeting ended Tue Feb 28 17:32:08 2023 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 17:32 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/policy_popup/2023/policy_popup.2023-02-28-17.02.html | 17:32 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/policy_popup/2023/policy_popup.2023-02-28-17.02.txt | 17:32 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/policy_popup/2023/policy_popup.2023-02-28-17.02.log.html | 17:32 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!