15:01:28 <d34dh0r53> #startmeeting keystone
15:01:28 <opendevmeet> Meeting started Tue Oct 25 15:01:28 2022 UTC and is due to finish in 60 minutes.  The chair is d34dh0r53. Information about MeetBot at http://wiki.debian.org/MeetBot.
15:01:28 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
15:01:28 <opendevmeet> The meeting name has been set to 'keystone'
15:01:42 <d34dh0r53> #topic Roll Call
15:01:44 <d34dh0r53> admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, knikolla, lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek
15:02:05 <knikolla[m]> o/
15:02:09 <hiromu> o/
15:02:14 <d34dh0r53> dmendiza[m], do you want to be on the roll call list?
15:02:54 <xek> o/
15:03:26 <d34dh0r53> o/ everyone :)
15:03:38 <d34dh0r53> hopefully everyone has recovered from the PTG
15:04:06 <d34dh0r53> let's get started
15:04:29 <d34dh0r53> #topic Review past meeting work items
15:04:33 <d34dh0r53> #link https://meetings.opendev.org/meetings/keystone/2022/keystone.2022-10-11-15.02.html
15:04:40 <dmendiza[m]> 🙋‍♂️
15:05:04 <d34dh0r53> We did some PTG planning, more on that later and we had one Action Item
15:05:14 <d34dh0r53> https://meetings.opendev.org/meetings/keystone/2022/keystone.2022-10-11-15.02.html
15:05:22 <d34dh0r53> oops, wrong paste
15:05:31 <d34dh0r53> dmendiza[m] will look at https://bugs.launchpad.net/keystone/+bug/1990987
15:05:52 <dmendiza[m]> did not get a chance to do that yet.  was busy with PTG last week
15:06:06 <d34dh0r53> dmendiza[m]: ack, can I re-assign that action item to you?
15:06:43 <dmendiza[m]> yep
15:06:50 <d34dh0r53> awesome, thank you!
15:06:56 <d34dh0r53> #action dmendiza[m] will look at https://bugs.launchpad.net/keystone/+bug/1990987
15:08:00 <d34dh0r53> next up we have d34dh0r53 look into user-defined attribute access control
15:08:13 <d34dh0r53> I did not get to this, will add again for this week
15:08:18 <d34dh0r53> #action d34dh0r53 look into user-defined attribute access control
15:08:33 <d34dh0r53> finally we have d34dh0r53 submit fix for Bug/1992183
15:09:00 <d34dh0r53> that review is up here
15:09:03 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone/+/861232
15:09:18 <d34dh0r53> thanks for the reviews so far
15:09:48 <d34dh0r53> that does it for the past meeting work items
15:10:17 <d34dh0r53> #topic Liaison Updates
15:10:30 <d34dh0r53> Anyone have anything?
15:11:21 <d34dh0r53> #help still looking for additional cross-project liaisons
15:11:21 * dmendiza[m] checks release patches
15:12:01 <dmendiza[m]> Ok, yeah
15:12:06 <dmendiza[m]> https://review.opendev.org/c/openstack/releases/+/862323
15:12:18 <dmendiza[m]> Release team wants to move Wallaby into EM
15:12:42 <dmendiza[m]> for us it just means no new releases will be made, but we will still be able to merge backports when necessary
15:13:09 <dmendiza[m]> d34dh0r53: I should be able to help with release things.
15:13:19 <dmendiza[m]> at least for the next couple of weeks.
15:13:20 <d34dh0r53> dmendiza[m]: excellent, thank you
15:13:39 <d34dh0r53> I'm fine with moving Wallaby to EM, any objections?
15:14:06 <dmendiza[m]> fine by me as well
15:14:46 <d34dh0r53> Ok, I'll +1 that patch unless I hear otherwise
15:15:54 <d34dh0r53> any other Liaison updates? I don't have anything from VMT
15:17:13 <d34dh0r53> next up on the agenda we have
15:17:31 <d34dh0r53> #topic specification OAuth 2.0 (h_asahina)
15:17:47 <d34dh0r53> #link https://review.opendev.org/q/topic:bp%252Foauth2-client-credentials-ext
15:18:11 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone-specs/+/843765
15:18:48 <hiromu> No update this week
15:19:01 <hiromu> but our team's arguing over what grant type should be used
15:19:08 <d34dh0r53> hiromu: ack
15:19:30 <hiromu> so, may be I'll change flows in the spec.
15:19:31 <knikolla[m]> I haven't had a chance yet to look at it in-depth.
15:19:59 <hiromu> it's ok :)
15:20:29 <hiromu> I'll remind you when we fix the contents of the spec.
15:20:42 <d34dh0r53> thank you hiromu
15:20:53 <hiromu> btw, this is just a reminder, please kindly review these docs patches and hopefully backport them to Zed.
15:21:02 <hiromu> https://review.opendev.org/c/openstack/keystoneauth/+/838104
15:21:04 <hiromu> https://review.opendev.org/c/openstack/keystone/+/838108
15:21:42 <d34dh0r53> #action reviewathon review https://review.opendev.org/c/openstack/keystone-specs/+/843765
15:22:03 <d34dh0r53> #undo
15:22:03 <opendevmeet> Removing item from minutes: #action reviewathon review https://review.opendev.org/c/openstack/keystone-specs/+/843765
15:22:25 <d34dh0r53> #action reviewathon review https://review.opendev.org/c/openstack/keystoneauth/+/838104
15:22:34 <d34dh0r53> #action reviewathon review https://review.opendev.org/c/openstack/keystone/+/838108
15:22:49 <hiromu> great. thanks d34dh0r53
15:23:03 <d34dh0r53> np hiromu
15:23:28 <d34dh0r53> #topic specification Secure RBAC (dmendiza[m])
15:23:41 <d34dh0r53> #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_
15:25:33 <dmendiza[m]> Yeah, there were a few SRBAC sessions during PTG
15:25:46 <dmendiza[m]> I think the main goals for us this cycle are:
15:25:55 <dmendiza[m]> 1. Merge the "manager" role implementation
15:26:05 <dmendiza[m]> 2. Merge the "service" role spec
15:26:18 <dmendiza[m]> 3. Implement the "service" role after spec has landed
15:26:45 <dmendiza[m]> I'm  not sure if we're already defaulting to `enforce_scope=True` and `enforce_new_defaults=True` but I think we may be able to do that this cycle.
15:27:46 <d34dh0r53> ok
15:28:27 <d34dh0r53> I'd like to look at the manager role implementation during the reviewathon
15:28:52 <d34dh0r53> #action reviewathon review https://review.opendev.org/c/openstack/keystone/+/822601
15:28:52 <dmendiza[m]> +1
15:29:42 <d34dh0r53> it looks like gmann has updated the service role spec so we should look at that as well
15:30:02 <d34dh0r53> #action reviewathon review https://review.opendev.org/c/openstack/keystone-specs/+/818616
15:31:04 <d34dh0r53> So, speaking of the PTG
15:31:15 <d34dh0r53> #topic Open Discussion
15:31:23 <d34dh0r53> d34dh0r53: ptg review https://etherpad.opendev.org/p/antelope-ptg-keystone
15:31:59 <d34dh0r53> #link https://etherpad.opendev.org/p/antelope-ptg-keystone
15:32:26 <d34dh0r53> anything to add regarding the Secure RBAC community goal?
15:33:58 <d34dh0r53> ok, hiromu do you have any asks/updates on the Supporting external authz server by Keystone Middleware BP/Spec?
15:34:58 <d34dh0r53> ok
15:35:02 <hiromu> there's no update so far
15:35:07 <d34dh0r53> ok, thanks hiromu
15:35:29 <d34dh0r53> next up we have deprecate python-keystone client that dmendiza[m] and myself have action items on
15:36:09 <d34dh0r53> I know there was talk at one of the TC sessions about openstacksdk and the individual clients but I'm not sure if any consensus was reached
15:36:47 <d34dh0r53> knikolla[m]: were there any takeaways we should consider before doing this work?
15:37:01 <knikolla[m]> It's a slow road and we're well ahead of the rest of OpenStack on it, haha.
15:37:23 <d34dh0r53> haha, awesome
15:37:48 <knikolla[m]> We have removed CLI access from the keystoneclient, and that's the first target of that work. Full parity between CLI clients and OSC.
15:38:00 <knikolla[m]> I don't think we've targeted anything yet for moving entirely to SDK.
15:38:22 <d34dh0r53> I think a good goal for this cycle is to determine our feature gaps
15:38:24 <dmendiza[m]> One thing that's not clear to me is whether keystone-manage or keysotne-bootstrap or w/e else needs to also be part of OSC?
15:38:40 <knikolla[m]> I don't think so.
15:38:55 <knikolla[m]> They usually interact with the DB directly, rather than through the API.
15:39:18 <dmendiza[m]> Gotcha ... yeah, as I typed that I realized those are CLIs that are part of the server, not the client
15:40:36 <d34dh0r53> Ok dmendiza[m] and I will try to carve out a little time to start the gap analysis
15:41:04 <d34dh0r53> #action dmendiza[m] and d34dh0r53 make some time to start the gap analysis between CLI and OSC.
15:41:50 <d34dh0r53> next up, Ade Lee is working on a new OIDC gate.  He's using the plugin that you wrote knikolla[m], thanks again for pointing us to that
15:42:13 <d34dh0r53> I think it will be a big help
15:42:38 <d34dh0r53> any other topics for Open Discussion?
15:44:01 <d34dh0r53> #topic Bug Review
15:44:13 <d34dh0r53> Keystone Bugs
15:44:24 <d34dh0r53> #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0
15:44:42 <d34dh0r53> we have https://bugs.launchpad.net/keystone/+bug/1993742
15:45:48 <xek> this was fixed in wallaby by an SQL upgrade
15:45:58 <d34dh0r53> ahh
15:46:12 <d34dh0r53> xek: would you mind commenting on that bug with a link?
15:47:07 <xek> d34dh0r53: ok, I'll also look into it to make sure this is the same bug
15:47:12 <d34dh0r53> xek: thank you
15:47:26 <d34dh0r53> that's it for new keystone bugs, next up we have python-keystoneclient
15:47:37 <d34dh0r53> #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0
15:47:55 <d34dh0r53> looks like this is new https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0
15:48:12 <d34dh0r53> man, the copy paste game is bad today :/
15:48:20 <d34dh0r53> https://bugs.launchpad.net/python-keystoneclient/+bug/1993614
15:51:20 <d34dh0r53> hmm, that doesn't seem right, anyone have a devstack up to verify that?
15:51:47 <d34dh0r53> I'll try to take a look at this one
15:52:05 <d34dh0r53> #action d34dh0r53 try to reproduce https://bugs.launchpad.net/python-keystoneclient/+bug/1993614
15:52:16 <d34dh0r53> that's all for python-keystoneclient
15:52:22 <d34dh0r53> next up we have keystoneauth
15:52:39 <d34dh0r53> #link https://bugs.launchpad.net/keystoneauth/+bugs?orderby=-id&start=0
15:52:54 <d34dh0r53> no new bugs there
15:53:02 <d34dh0r53> keystonemiddleware is next
15:53:10 <d34dh0r53> #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0
15:53:26 <d34dh0r53> nothing new here
15:53:33 <d34dh0r53> PyCADF
15:53:43 <d34dh0r53> #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0
15:54:00 <d34dh0r53> no new bugs
15:54:07 <d34dh0r53> Finally we have ldappool
15:54:15 <d34dh0r53> #link https://bugs.launchpad.net/ldappool/+bugs?orderby=-id&start=0
15:54:25 <d34dh0r53> which has nothing new
15:54:35 <d34dh0r53> Anything else before we end the meeting?
15:55:34 <d34dh0r53> Thanks for joining everyone! Have a great week, and I'll see y'all online :)
15:55:38 <d34dh0r53> #endmeeting