15:00:25 <d34dh0r53> #startmeeting keystone 15:00:25 <opendevmeet> Meeting started Tue Mar 7 15:00:25 2023 UTC and is due to finish in 60 minutes. The chair is d34dh0r53. Information about MeetBot at http://wiki.debian.org/MeetBot. 15:00:25 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 15:00:25 <opendevmeet> The meeting name has been set to 'keystone' 15:00:29 <d34dh0r53> #topic roll-call 15:00:35 <d34dh0r53> admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, knikolla[m], lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek, gmann, zaitcev, arequate, dmendiza[m] 15:00:37 <xek> o/ 15:00:41 <hiromu> o/ 15:00:49 <zaitcev> o/ 15:01:10 <dmendiza[m]> 🙋♂️ 15:02:21 <knikolla[m]> o/ 15:02:39 <d34dh0r53> hi folks, thanks for joining :) 15:03:16 <d34dh0r53> #topic review past meeting work items 15:03:26 <d34dh0r53> d34dh0r53 look into the keystone-groups members as well https://review.opendev.org/admin/groups/d7203dc55fa9bdf98c578b16ac398e0c754a1a67,members not sure if it's used any more 15:03:36 <d34dh0r53> I didn't get a chance to look at this yet again 15:03:42 <d34dh0r53> :/ 15:03:48 <d34dh0r53> #action d34dh0r53 look into the keystone-groups members as well https://review.opendev.org/admin/groups/d7203dc55fa9bdf98c578b16ac398e0c754a1a67,members not sure if it's used any more 15:03:57 <dmendiza[m]> d34dh0r53: we could check the project-config repo to see what gerrit groups are still in use 15:03:57 <d34dh0r53> that's all for the past meeting work items 15:04:05 <d34dh0r53> dmendiza[m]: ack 15:04:07 <d34dh0r53> good idea 15:04:57 <d34dh0r53> dmendiza[m]: I might reach out to you for help on that this week 15:05:15 <dmendiza[m]> Sure, just ping me whenever 15:05:27 <d34dh0r53> thanks 15:05:36 <d34dh0r53> #topic liaison updates 15:05:44 <d34dh0r53> nothing from VMT 15:06:30 <d34dh0r53> knikolla[m], dmendiza[m], xek I added our highlights this morning, https://review.opendev.org/c/openstack/releases/+/876729 15:07:02 <d34dh0r53> let me know if I missed anything or if they need to be reworded 15:07:08 <dmendiza[m]> Nice 15:07:48 <d34dh0r53> that's it for liaison updates 15:08:27 <d34dh0r53> #topic specification OAuth 2.0 (hiromu) 15:08:42 <d34dh0r53> External OAuth 2.0 Specification 15:08:44 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone-specs/+/861554 15:08:46 <d34dh0r53> OAuth 2.0 Implementation 15:08:48 <d34dh0r53> #link https://review.opendev.org/q/topic:bp%252Fsupport-oauth2-mtls 15:08:50 <d34dh0r53> OAuth 2.0 Documentation 15:08:52 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone/+/838108 15:08:54 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystoneauth/+/838104 15:09:00 <d34dh0r53> we're very close to merging everything 15:09:15 <hiromu> Thanks a lot! I just submitted backport patches for keystoneauth and keystonemiddleware. 15:09:26 <d34dh0r53> excellent! thanks hiromu 15:09:32 <hiromu> https://review.opendev.org/c/openstack/keystoneauth/+/876746 15:09:39 <hiromu> https://review.opendev.org/c/openstack/keystonemiddleware/+/876745 15:10:13 <hiromu> Keystone's master branch already includes the mTLS patch. 15:10:49 <hiromu> So I didn't submit a backport patch to Keystone. 15:12:45 <coreycb> o/ ohh is this a community meeting? if so can I put this on the agenda? https://bugs.launchpad.net/keystone/+bug/2009600 15:13:22 <dmendiza[m]> hiromu: I think we might need to backport into the stable/2023.1 branch. We do have these under review: https://review.opendev.org/c/openstack/keystone/+/876722/ 15:13:48 <d34dh0r53> coreycb: sure, I'll add it 15:14:01 <coreycb> d34dh0r53: thanks 15:14:42 <hiromu> Oh, okay. I'll check commit tree again. 15:15:24 <hiromu> https://github.com/openstack/keystone/commits/master 15:15:38 <dmendiza[m]> hiromu: do a `git review -d 876722` to pull down the start of the stable/2023.1 branch and then cherry-pick the oauth patches to that chain 15:15:43 <hiromu> sorry it's worng. https://github.com/openstack/keystone/commits/stable/2023.1 15:16:14 <dmendiza[m]> Oh sweet! Looks like it's already there 15:16:17 <dmendiza[m]> (I think?) 15:17:07 <hiromu> yeah, I thought so. wrong? 15:18:21 <dmendiza[m]> I think we're good. My mistake 15:18:51 <hiromu> good :) 15:18:53 <hiromu> ls 15:18:55 <hiromu> sorry 15:19:25 <hiromu> by the way, I'd like to talk about Ext. Authorization Server Support today. 15:19:44 <d34dh0r53> ack, I'll add that as well 15:19:53 <d34dh0r53> anything else with mTLS? 15:20:26 <hiromu> No. That' all. thanks. 15:22:00 <d34dh0r53> thanks, moving on to 15:22:14 <d34dh0r53> #topic Secure RBAC (dmendiza[m]) 15:22:29 <d34dh0r53> #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_ 15:22:31 <d34dh0r53> Service Role Implementation 15:22:33 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone/+/863420 15:22:35 <d34dh0r53> Manager Role Implementation 15:22:37 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone/+/822601 15:22:50 <dmendiza[m]> No updates, sorry. I'm not even susre if gmann is still having the pop-up meetings? 15:22:53 <dmendiza[m]> *sure 15:23:34 <d34dh0r53> ack 15:24:22 <d34dh0r53> ok, moving on to 15:24:28 <d34dh0r53> #topic open discussion 15:24:42 <d34dh0r53> (drencrom) Need some reviews for this backport: 15:24:44 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystonemiddleware/+/873921 15:25:30 <d34dh0r53> I'll take a look at these today 15:26:25 <d34dh0r53> next up 15:26:27 <d34dh0r53> (coreycb) discuss mtls/cryptography bug 15:26:29 <d34dh0r53> #link https://bugs.launchpad.net/keystone/+bug/2009600 15:27:16 <knikolla[m]> can we lower the cryptography version to the one they mentioned? 15:27:48 <d34dh0r53> that's what I'm wondering. hiromu, dmendiza[m] ? 15:28:26 <coreycb> I'm attempting a patch to do that 15:28:35 <coreycb> hopefully that'll be ok 15:28:49 <knikolla[m]> i see that the version that we included was just what was in upper-constraints, so it doesn't feel like there's anything special about it. 15:29:20 <coreycb> it's more about what the lower constraints are in requirements.txt 15:30:00 <coreycb> for context, I'm a maintainer for the ubuntu cloud archive. the antelope cloud archive (and the next 2 to 3 openstack releases) are based on ubuntu jammy which has python3-cryptography 3.4.8. 15:30:19 <knikolla[m]> I don't think we have any global lower constraints 15:30:53 <knikolla[m]> (all i meant by my previous comment was that i don't think that version has any significance besides being what was written in the requirements repo as an upper constraint) 15:32:20 <coreycb> I started going down the path of backporting cryptography 38.0.2 yesterday but it gets complicated very quickly (25+ rust library backports) 15:33:57 <hiromu> At least, I can say I can look for workarounds to avoid using the feature that is only available on recent cryptography. 15:35:04 <coreycb> do you know if attr_name_overrides is required? I can test the version of cryptography and either specify it or not. or maybe it can just be dropped. 15:36:04 <hiromu> It is required, but there's alternative way that doesn't use attr_name_overrides but brings the same effect. 15:36:57 <coreycb> ok, maybe I should defer to you to work on a fix. I was just going to drop the parameter for older cryptography versions which is probably naive. 15:38:44 <hiromu> I'm not sure which is easier 15:40:04 <hiromu> but, I think there's possiblity that this kinds of problems happen again. 15:40:17 <hiromu> so I think I should fix it. 15:41:57 <hiromu> is that in line with your thought? 15:42:25 <coreycb> that would be great, thank you. if I can help please let me know. I'll send an email for more global discussion about cryptography to the mailing list, not related specifically to this issue. 15:42:48 <hiromu> great. thanks 15:42:50 <d34dh0r53> awesome, thank you coreycb 15:42:54 <d34dh0r53> thanks hiromu 15:43:23 <d34dh0r53> next topic, is (hiromu) discuss Ext. Authorization Server Support 15:43:53 <hiromu> I added this topic to https://etherpad.opendev.org/p/keystone-weekly-meeting 15:44:18 <hiromu> We're planing to investigate if the following projects work with Ext. Authorizations, and how we can modify them to work with Ext. Authorization servers. Any other projects we must check? 15:44:26 <hiromu> heat 15:44:28 <hiromu> glance 15:44:30 <hiromu> nova 15:44:32 <hiromu> newtron 15:44:34 <hiromu> (placement) *low priority 15:44:36 <hiromu> (cinder) *low priority 15:45:01 <hiromu> These projects are selected based on DevStack minimal install. 15:46:13 <hiromu> Do you have any idea? knikolla: 15:47:41 <knikolla[m]> That's a good start. I don't have any other ideas at the moment, though I would add Ironic as well. 15:48:54 <d34dh0r53> and barbican? dmendiza[m]? 15:49:23 <hiromu> Sure. We have chance to discuss with ironic at vPTG. Depending on the result of that discussion, we might not have to check Ironic (hopefully barbican). 15:50:07 <d34dh0r53> ack 15:50:34 <d34dh0r53> That's a good start, I'll add this to the vPTG agenda for one of our sessions 15:50:56 <d34dh0r53> moving on as we're almost out of time 15:50:59 <d34dh0r53> #topic bug review 15:51:16 <d34dh0r53> #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0 15:51:26 <d34dh0r53> we already discussed the cryptography bug 15:52:32 <d34dh0r53> another bug landed https://bugs.launchpad.net/keystone/+bug/2008890 but this looks to be kolla container specific 15:52:46 <d34dh0r53> I'll make sure that is the case 15:52:59 <d34dh0r53> #action d34dh0r53 ensure that https://bugs.launchpad.net/keystone/+bug/2008890 is kolla specific 15:53:18 <d34dh0r53> #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0 15:53:29 <d34dh0r53> nothing new for python-keystoneclient 15:53:52 <d34dh0r53> #link https://bugs.launchpad.net/keystoneauth/+bugs?orderby=-id&start=0 15:54:09 <d34dh0r53> keystoneauth is clean 15:54:19 <d34dh0r53> #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0 15:54:34 <d34dh0r53> as is keystone middleware 15:54:42 <d34dh0r53> #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0 15:55:01 <d34dh0r53> pycadf has no new bugs 15:55:08 <d34dh0r53> #link https://bugs.launchpad.net/ldappool/+bugs?orderby=-id&start=0 15:55:19 <d34dh0r53> and ldappool is clean too 15:55:27 <d34dh0r53> #topic conclusion 15:55:44 <d34dh0r53> Thanks for all the hard work in getting mTLS merged the last few weeks! 15:55:54 <d34dh0r53> Anyone have anything else before we go? 15:57:03 <d34dh0r53> thanks folks! 15:57:07 <d34dh0r53> #endmeeting