20:02:02 #startmeeting horizon-keystone 20:02:03 Meeting started Thu Dec 15 20:02:02 2016 UTC and is due to finish in 60 minutes. The chair is stevemar. Information about MeetBot at http://wiki.debian.org/MeetBot. 20:02:04 Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 20:02:07 The meeting name has been set to 'horizon_keystone' 20:02:12 stevemar: I cutnpaste the line from eavesdrop to keep it consistent ;-) 20:02:23 r1chardj0n3s: that's what i did! 20:02:29 \o/ 20:02:37 #agenda https://etherpad.openstack.org/p/ocata-keystone-horizon 20:02:39 not really an agenda 20:02:43 #link https://etherpad.openstack.org/p/ocata-keystone-horizon 20:03:09 r1chardj0n3s: mind if i skip your thing til the end? 20:03:47 (silence means yes in my book!) 20:04:05 crinkle: you're around, lets talk about your stuff first 20:04:27 crinkle: i think you had the TODO to re-work https://review.openstack.org/#/c/389337/ 20:04:40 stevemar: yes, please do that thing 20:04:47 o/ 20:04:57 crinkle: are there any things we should look out for when reviewing it? 20:05:37 crinkle: looks like a lot of cut-n-paste of the project support 20:05:38 stevemar: well one thing is that it looks a little messy because i was trying to avoid duplicating code, so looking for feedback on how best to do that 20:05:51 (not saying thats a bad thing) 20:06:40 crinkle: is there any UI work needed in the horizon side? i think a drop down no? 20:07:01 stevemar: yes, i meant to work on that too but didn't get to it yet 20:07:10 crinkle: s'all good 20:07:23 no rel note, but it looks like doa doesn't do that 20:07:32 *throws shade at david-lyle* 20:07:49 we put it all in horizon 20:08:17 documentation is kinda minimal too: http://docs.openstack.org/developer/django_openstack_auth/ 20:08:22 the feature add in horizon is the only way it will be visible anyway 20:08:26 crinkle: looks good to me at a first glance 20:08:29 david-lyle: ah cool 20:08:49 * stevemar tosses a +1 to crinkle 20:09:00 heck stevemar most people don't even know that library exists 20:09:13 I will walk through the updated patch 20:09:33 thanks guys 20:09:36 the domain listing seems reasonable 20:09:49 backend.py I want to dig into more 20:10:02 yeah, utils change looks good 20:10:17 user.py looks like its just calling utils 20:10:36 i'll let david-lyle assess the backend.py bits 20:10:54 yup, it changing the logic around domain scoping changes that I want to be sure about 20:11:04 crinkle: you tried this out i assume? 20:11:08 you typically do 20:11:09 stevemar: yes 20:11:19 only federated or both? 20:11:31 crinkle: cool, did you have to modify horizon? 20:11:45 david-lyle: both 20:11:50 stevemar: yes it requires horizon changes 20:12:02 crinkle: great, just checking, thanks 20:12:26 crinkle: cool 20:12:40 sounds like that is moving along nicely, thanks colleen 20:12:57 * stevemar forgot to use topic, noob 20:12:58 np thanks for reviewing 20:13:04 #topic k2k 20:13:07 edtubill: yo 20:13:13 hey 20:13:20 so I have these two patches: https://review.openstack.org/#/c/408435/1 (horizon) https://review.openstack.org/#/c/408450/1 (django_openstack_auth) 20:13:27 They need tests... 20:13:50 i think you have" https://review.openstack.org/#/q/topic:bp/k2k-horizon 20:13:59 but it would be cool if david-lyle or stevemar would be able to see if the approach take (at a high level) is okay to do. 20:14:20 Those two patches are for that bp. 20:14:23 edtubill: do you need guidance working on how to create more tests? i remember having trouble with that for doa and lhcheng helped me out 20:15:20 Sure 20:15:37 david-lyle: do you have time to help edtubill out with the tests? 20:15:45 I should 20:15:55 edtubill: meet your new best friend 20:15:58 I'll review the patches this afternoon 20:16:02 cool :) 20:16:08 and we can look at adding tests 20:16:15 should we go over the patches here like we did with crinkle's? 20:16:15 please let me know if the approach should be taken a different way. 20:16:43 I put some comments in the commit message 20:16:50 we can start with the horizon one, https://review.openstack.org/#/c/408435/1 is much smaller :P 20:17:09 I also worry about crinkle and your d-o-a patches stomping on each other 20:17:27 I'm willing to rebase.. 20:17:34 me too 20:17:35 backend.py is heavily redone in both 20:17:58 but we can cross that 20:19:37 the horizon patch seems reasonable 20:19:41 ah i see the "support / current / available" section is like regions: https://review.openstack.org/#/c/408435/1/openstack_dashboard/context_processors.py 20:20:22 yes 20:20:46 I took inspiration from that yes :p 20:20:58 edtubill: use "depends-on" 20:21:14 my only concern is that context_processors is executed on every request, don't want to prematurely optimize, but minimizing logic in there is desirable 20:21:48 david-lyle: edtubill can you check a config option before executing that code? 20:22:31 I can add a flag or is there another place that I could potentially put that logic that doesn't run everytime? 20:23:16 I don't know that we have a k2k setting to check, and dynamically is better 20:23:23 let me look at it more closely 20:23:46 any way to check the token in context_processors? 20:23:46 I could also just look at the available_providers from the session variable and just skip the rest if its an empty list. 20:23:54 see if service_providers is empty or not 20:23:58 your reading a value from the session and then short-circuiting most of the logic if there aren't multiple keystones 20:24:08 token is on the session 20:24:15 david-lyle: rgr 20:24:32 david-lyle: maybe just "if not available_providers: break" 20:24:49 or actually "if available_providers" then go into your logic 20:24:54 skip it otherwise 20:24:56 but the provider list is already taken from the session in doa and put separately as a convenience 20:25:42 stevemar: yeah something like that 20:26:16 edtubill: commented 20:26:24 david-lyle: are you expecting tests for that patch? 20:26:30 cool thx 20:26:42 david-lyle: and a release note? 20:27:44 release note yes, testing that is difficult 20:28:07 edtubill: know how to create a release note, yes? 20:28:14 david-lyle: understood 20:28:24 not really.. 20:28:33 is there some doc I can read? 20:28:43 edtubill: http://docs.openstack.org/developer/keystone/developing.html#release-notes 20:29:02 edtubill: just run... $ tox -e venv -- reno new bp-k2k-horizon 20:29:03 we have one similar since lhcheng added it to both 20:29:24 ok 20:29:35 you'll see a new file show up in horizon/releasenotes/notes, edit that file 20:29:48 try to think of it from a consumer perspective 20:30:06 if you were to use it, what would you want to know, etc 20:30:17 now... https://review.openstack.org/#/c/408450/2 20:30:31 +386, yowza! 20:30:58 needs more code deletion 20:31:07 edtubill: are you trying to squeeze in a refactor? 20:31:30 yeah.. I didn't want to rewrite scoping code... 20:31:39 edtubill: thats totally fair 20:31:49 edtubill: can i ask that you break the patch up? 20:31:49 I can undo it if it makes it easier to review and do refactoring later. 20:31:53 sure. 20:32:15 one patch to do the split, some stuff from backend.py into base.py (that can land first) 20:32:28 as long as it's a pure refactor it should be easy to approve and need no tests 20:32:52 then it'll just be the k2k code to review 20:33:06 Sure, are you guys okay with the approach of making a new Auth plugin even though it doesn't really get used at Log in time? (although it might in the future) 20:33:21 The other plugins get used only at log in time. 20:34:35 i don't think there are any negative impacts there 20:34:53 yep 20:35:06 I don't have a reason against right now 20:35:24 edtubill: need a hand with breaking things up? 20:35:57 I think I remember how to break things up. 20:36:07 edtubill: ping me if you need a hand 20:36:13 okay will do. 20:36:43 alright, next topic 20:36:52 #topic v3 policy is terribad 20:36:59 Also a quick note, last time I used federation I get errors at viewing instances... am I the only one seeing this error? 20:37:06 o_O 20:37:11 I'll wait to ask this question later :p 20:37:17 probably gonna need more data than that :) 20:37:36 this topic relates to line 47 on https://etherpad.openstack.org/p/ocata-keystone-horizon 20:37:53 i have a feeling this will involve keystone fixing something 20:38:05 does anyone have any background on https://bugs.launchpad.net/oslo.policy/+bug/1547684 ? 20:38:07 Launchpad bug 1547684 in oslo.policy "Attribute error on Token object when using domain scoped token" [Undecided,New] 20:38:48 ayoung had a comment: that had https://review.openstack.org/#/c/165908/ merged, everything would be good 20:39:28 no further background from me beyond that error, I'm afraid 20:39:31 looks like policy is just terrible: https://launchpadlibrarian.net/242578504/policy_token.py 20:40:41 i can look into this, if no one else has any insight 20:41:13 removing token.is_admin_project:True seems to solve the issue 20:41:45 looking at: https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json 20:42:06 i love how you publish something that is unusable 20:42:10 we* 20:42:24 :-) 20:42:44 i think "token.is_admin_project:True" is just wrong 20:43:04 should it be "target.token.is_admin_project:True" ? 20:43:22 let me go talk to some people 20:43:27 next topic 20:43:41 #topic Visualisation of policy / role 20:43:45 r1chardj0n3s: ^ 20:43:48 ohai 20:43:53 r1chardj0n3s: did you rub the sleep out of your eyes yet? 20:44:26 so this came up earlier this week that some way of visualising policy and RBAC controls would be super helpful, especially in the face of ... rather opaque at times policy files :-) 20:44:50 I was wondering whether there'd been any prior art on this? 20:45:09 r1chardj0n3s: kinda like how network topologies are visualized? 20:45:22 visualize what aspect? 20:45:42 I guess so, kinda. Being able to say "hey, what exactly can this role do, based on policy?" 20:45:46 it also stinks that policy is file based 20:46:18 hmm 20:47:07 get the roles from the token, and try enforcing all entries in all policies? 20:47:36 yeah but targets come into play too 20:47:52 possibly just one role at a time, but yeah, some sensible way of dealing with targes too 20:47:52 r1chardj0n3s: you'd get back something like "identity:create_region" passes and another thing doesn't 20:48:00 yeah 20:48:26 yeah, its not easy, but it sounds do-able 20:48:37 without attaching to resources I'm not sure how useful it will be 20:48:45 was there some desire to see this from an operator? 20:48:54 or is this a tool for operators who are defining policy? 20:49:08 yeah, this is something coming from operators 20:49:20 what was the specific ask? 20:49:26 I don't have any more on the specifics, sorry 20:49:31 r1chardj0n3s: unfortunately, editing the policy won't be easy :) 20:49:48 I was mostly wondering whether anyone had done any sort of visualisation like this before 20:49:50 if only policy was centralized ... 20:50:03 * stevemar throws a fish at david-lyle 20:50:24 * david-lyle claps like a seal 20:50:28 lol 20:50:39 r1chardj0n3s: okay, get back a bit more data i guess? 20:50:44 sounds a bit hand-wavey right now 20:51:07 tough to know of prior art without undestanding the type of visualization 20:51:12 yep, given the answer to my question seems to be "no... we think" then I'll go back for more detail on what's actually desired 20:51:26 cool 20:51:35 sounds like we're all wrapped up for this week 20:51:41 #topic open discussion 20:51:48 cancel next week obvs 20:52:05 yep, and week after, probably 20:52:05 i mean, i like you people, but not that much 20:52:17 r1chardj0n3s: yes 20:52:35 coolo 20:52:36 any last qs? 20:53:12 thanks everyone! 20:53:15 narf 20:53:21 have a great weekend, do that last minute shopping 20:53:24 thanks stevemar 20:53:25 thanks 20:53:25 #endmeeting