15:04:07 <d34dh0r53> #startmeeting keystone
15:04:07 <opendevmeet> Meeting started Tue Jun  6 15:04:07 2023 UTC and is due to finish in 60 minutes.  The chair is d34dh0r53. Information about MeetBot at http://wiki.debian.org/MeetBot.
15:04:07 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
15:04:07 <opendevmeet> The meeting name has been set to 'keystone'
15:04:27 <dmendiza[m]> 🙋‍♂️
15:04:30 <d34dh0r53> #topic roll call
15:04:36 <d34dh0r53> admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, knikolla[m], lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek, gmann, zaitcev, reqa, dmendiza[m]
15:04:38 <d34dh0r53> o/
15:04:42 <d34dh0r53> brb
15:04:48 <zaitcev> oh
15:04:51 <xek> o/
15:06:47 <d34dh0r53> back, hi everybody!
15:07:02 <d34dh0r53> #topic review past meeting work items
15:07:18 <d34dh0r53> https://meetings.opendev.org/meetings/keystone/2023/keystone.2023-05-30-15.03.html
15:07:22 <d34dh0r53> #link https://meetings.opendev.org/meetings/keystone/2023/keystone.2023-05-30-15.03.html
15:07:36 <knikolla> o/
15:07:43 <d34dh0r53> first up d34dh0r53 review https://bugs.launchpad.net/keystone/+bug/2009752
15:07:57 <d34dh0r53> I marked this as confirmed as I'm pretty sure it's an issue
15:08:08 <d34dh0r53> next up d34dh0r53 Look into adding/restoring a known issues section to our documentation
15:08:22 <d34dh0r53> I still need to do this and the next one
15:08:26 <d34dh0r53> #action d34dh0r53 Look into adding/restoring a known issues section to our documentation
15:08:37 <d34dh0r53> #action d34dh0r53 add https://bugs.launchpad.net/keystone/+bug/1305950 to the known issues section of our documentation
15:08:47 <d34dh0r53> next up d34dh0r53 update https://review.opendev.org/c/openstack/keystonemiddleware/+/882401 to include test_ec2_token_middleware.py
15:09:01 <d34dh0r53> this has been added but the CI is failing, stevedore I think
15:09:25 <d34dh0r53> keystonemiddleware seems to be pretty broken due to stevedore and I don't know how to fix it
15:09:43 <d34dh0r53> I don't understand how those modules are being enumerated
15:10:53 <d34dh0r53> and I noticed that sahid was asking about keystonemiddleware earlier
15:11:23 <d34dh0r53> maybe dmendiza[m] and I can put our heads together this afternoon and figure out how to fix keystonemiddleware
15:11:43 <dmendiza[m]> Yeah, it's been a while since I looked under the hood at stevedore
15:11:52 <dmendiza[m]> some serious black magic going on there
15:11:58 <d34dh0r53> yeah, it's not pretty
15:12:30 <d34dh0r53> #action dmendiza[m] and d34dh0r53 to look at keystonemiddleware stevedore failures
15:12:42 <d34dh0r53> next up
15:12:54 <d34dh0r53> d34dh0r53 look at https://bugs.launchpad.net/keystone/+bug/2018644
15:13:00 <d34dh0r53> I haven't gotten to that one yet
15:13:03 <d34dh0r53> #action d34dh0r53 look at https://bugs.launchpad.net/keystone/+bug/2018644
15:13:12 <d34dh0r53> next up drencrom look at https://review.opendev.org/c/openstack/keystonemiddleware/+/878027 to see if we can add the test_ec2_token_middleware.py to it
15:13:28 <d34dh0r53> I think this is failing due to stevedore
15:14:03 <d34dh0r53> we'll see if we can get it passing if we're able to iron out the stevedore issue
15:14:32 <d34dh0r53> finally we have investigate dependency issue in this patch wallaby: https://review.opendev.org/c/openstack/keystone/+/874844
15:14:38 <d34dh0r53> not sure who was assigned to this one
15:15:10 <xek> https://review.opendev.org/c/openstack/keystonemiddleware/+/878027 is abandoned
15:15:26 <d34dh0r53> yep, thanks xek
15:17:27 <d34dh0r53> I think we need to re-submit that one once victoria is in better shape
15:17:36 <d34dh0r53> gerrit was rejecting it
15:19:00 <d34dh0r53> I'm not sure what's going on with the keystoneauth package version either, which is why https://review.opendev.org/c/openstack/keystone/+/874844 is failing
15:19:32 <d34dh0r53> #action d34dh0r53 figure out why https://review.opendev.org/c/openstack/keystone/+/874844 is failing
15:20:06 <d34dh0r53> #topic liaison update
15:20:13 <d34dh0r53> nothing from VMT this week
15:20:49 <d34dh0r53> #topic specification OAuth 2.0 (hiromu)
15:21:14 <d34dh0r53> External OAuth 2.0 Specification
15:21:16 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone-specs/+/861554
15:21:18 <d34dh0r53> OAuth 2.0 Implementation
15:21:20 <d34dh0r53> #link https://review.opendev.org/q/topic:bp%252Fsupport-oauth2-mtls
15:21:22 <d34dh0r53> OAuth 2.0 Documentation
15:21:24 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone/+/838108
15:21:26 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystoneauth/+/838104
15:23:22 <d34dh0r53> #topic Secure RBAC (dmendiza[m])
15:23:33 <d34dh0r53> #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_
15:23:35 <d34dh0r53> Service Role Implementation
15:23:37 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone/+/863420
15:23:39 <d34dh0r53> Manager Role Implementation
15:23:41 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone/+/822601
15:25:32 <dmendiza[m]> Yeah, no progress on those, still working on Barbican SRBAC and some downstream Keystone SRBAC stuff... should hopefully get a chance to work on that stuff later this month
15:25:44 <d34dh0r53> ack, thanks dmendiza[m]
15:26:02 <d34dh0r53> #topic specification SQLAlchemy 2.0 (stephenfin)
15:26:18 <d34dh0r53> #link https://review.opendev.org/q/topic:sqlalchemy-20+is:open+project:openstack/keystone
15:26:19 <d34dh0r53> Can I get reviews on this, while I have context/time to close it out?
15:26:21 <d34dh0r53> What more do you need from me?
15:27:00 <d34dh0r53> Once we get the CI for keystonemiddleware a bit more healthy we'll circle back to these and get them merged
15:27:19 <d34dh0r53> #topic open discussion
15:27:53 <d34dh0r53> (drencrom) We need to merge these backports to fix pep8 tests
15:27:55 <d34dh0r53> wallaby #link https://review.opendev.org/c/openstack/keystonemiddleware/+/878026
15:27:57 <d34dh0r53> This is blocking #link https://review.opendev.org/c/openstack/keystonemiddleware/+/873921
15:27:59 <d34dh0r53> zed #link https://review.opendev.org/c/openstack/keystonemiddleware/+/878023
15:28:09 <d34dh0r53> we're working on getting these in, we reviewed quite a bit last Friday
15:28:43 <d34dh0r53> (drencrom) Remove cache invalidation when using expired token (ussuri backport)
15:28:44 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystonemiddleware/+/877398
15:28:46 <d34dh0r53> Zuul jobs seem to run but no +1 message
15:29:05 <d34dh0r53> we need to see if we can get that one merged as well
15:29:47 <d34dh0r53> dmendiza[m], xek already has a +2 on https://review.opendev.org/c/openstack/keystonemiddleware/+/877398, can you bump it?
15:30:14 <dmendiza[m]> d34dh0r53: needs Wallaby first
15:30:27 <dmendiza[m]> #link https://review.opendev.org/c/openstack/keystonemiddleware/+/873921
15:30:47 <d34dh0r53> ahh, ack
15:30:50 <dmendiza[m]> Hmm.. not sure why that's active still actually
15:30:54 <d34dh0r53> sorry, I missed that one
15:30:58 <dmendiza[m]> it's got the necessary +'es
15:31:41 <dmendiza[m]> I tried to add/remove the +W just now ... let'
15:31:48 <dmendiza[m]> s see if Zuul picks it up
15:31:58 <d34dh0r53> ok, does it need https://review.opendev.org/c/openstack/keystonemiddleware/+/878026/2 first?
15:32:38 * dmendiza[m] is confused
15:32:46 <d34dh0r53> me too
15:33:43 <drencrom> Yes, I think it needs 878026
15:34:14 <drencrom> which needs another +2
15:34:18 <dmendiza[m]> OK, less confused now, haha
15:34:29 <dmendiza[m]> merging 878026
15:35:07 <d34dh0r53> sweet, thanks
15:35:10 <d34dh0r53> let's see how that goes
15:35:41 <d34dh0r53> (mustafakemalgilor) PooledLdapHandler message.clean() patch backports
15:35:43 <d34dh0r53> review request
15:35:45 <d34dh0r53> #link ussuri: https://review.opendev.org/c/openstack/keystone/+/874846
15:35:47 <d34dh0r53> #link victoria: https://review.opendev.org/c/openstack/keystone/+/874847
15:35:49 <d34dh0r53> #link wallaby: https://review.opendev.org/c/openstack/keystone/+/874844
15:36:08 <d34dh0r53> the wallaby patch for this one is complaining about the keystoneauth package version
15:36:11 <zaitcev> At this point I'd actually make a little "spreadsheet" in a text file, with all the backports and what needs what. I just cannot keep up.
15:36:16 <d34dh0r53> so we have a mismatch somewhere
15:36:24 <d34dh0r53> zaitcev: that's a good idea
15:36:35 <d34dh0r53> I'll try to do that this afternoon
15:36:46 <zaitcev> Well... extensive bureaucracy has its costs, but my mind is too small.
15:38:39 <d34dh0r53> finally we have
15:38:42 <d34dh0r53> (reqa) Add openstack cli support for OAuth 2.0 Device Authorization Grant with PKCE:
15:38:44 <d34dh0r53> review request
15:38:46 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystoneauth/+/883852
15:38:48 <d34dh0r53> Reasoning: When switching wsgi-keystone.conf to use PKCE for WebSSO, this also applies to the CLI (e.g. ForgeRock implemented the same)
15:38:56 <d34dh0r53> this looks reasonable at first glance
15:40:52 <d34dh0r53> depending on how the keystonemiddleware and keystoneauth issues we're facing in CI go this week, maybe we can review this patch during the reviewathon on Friday
15:41:15 <d34dh0r53> we need to get CI healthy first though
15:41:29 <d34dh0r53> anything else for open discussion?
15:42:28 <zaitcev> You know what I'll say, right? https://review.opendev.org/c/openstack/keystone/+/874346
15:42:46 <zaitcev> But I was remiss at looking at Hiromu's stuff too, so oh well
15:43:50 <d34dh0r53> indeed, we will look at this on Friday
15:44:24 <d34dh0r53> #action reviewathon https://review.opendev.org/c/openstack/keystone/+/874346
15:45:18 <d34dh0r53> #topic bug review
15:45:25 <d34dh0r53> #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0
15:45:57 <d34dh0r53> no new bugs in keystone
15:46:06 <d34dh0r53> #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0
15:46:24 <d34dh0r53> nothing new in python-keystoneclient
15:46:40 <d34dh0r53> #link https://bugs.launchpad.net/keystoneauth/+bugs?orderby=-id&start=0
15:46:51 <d34dh0r53> nor is there anything new in keystoneauth
15:46:57 <d34dh0r53> #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0
15:47:32 <d34dh0r53> looks like Sahid added https://bugs.launchpad.net/keystonemiddleware/+bug/2023015
15:48:05 <d34dh0r53> there is a fix proposed to master
15:48:27 <d34dh0r53> #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0
15:48:47 <d34dh0r53> pycadf is clean
15:48:48 <d34dh0r53> #link https://bugs.launchpad.net/ldappool/+bugs?orderby=-id&start=0
15:48:51 <d34dh0r53> so is ldappool
15:48:56 <d34dh0r53> #topic conclusion
15:49:25 <d34dh0r53> No meeting or reivewathon next week, OpenInfra Summit and PTG
15:49:46 <d34dh0r53> I'd like to focus on keystonemiddleware and the keystoneauth package version issues
15:50:52 <d34dh0r53> I'll start looking at those now and try to come up with a way to better track what we have in flight and what needs merging when
15:51:02 <d34dh0r53> anyone have anything else?
15:51:35 <d34dh0r53> thanks folks! Hope to see you in Vancouver :)
15:51:42 <d34dh0r53> dmendiza[m]: enjoy your PTO
15:51:51 <d34dh0r53> #endmeeting