15:02:17 <d34dh0r53> #startmeeting keystone
15:02:17 <opendevmeet> Meeting started Wed Mar 27 15:02:17 2024 UTC and is due to finish in 60 minutes.  The chair is d34dh0r53. Information about MeetBot at http://wiki.debian.org/MeetBot.
15:02:17 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
15:02:17 <opendevmeet> The meeting name has been set to 'keystone'
15:02:39 <d34dh0r53> #topic roll call
15:02:47 <d34dh0r53> admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, knikolla[m], lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek, gmann, zaitcev, reqa, dmendiza[m], mharley, jph, gtema
15:02:49 <d34dh0r53> o/
15:03:38 <dmendiza[m]> 🙋
15:04:26 <d34dh0r53> #topic review past meeting work items
15:05:05 <d34dh0r53> #link https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-03-20-15.00.html
15:05:19 <d34dh0r53> no updates from me
15:05:27 <d34dh0r53> #action d34dh0r53 Look into adding/restoring a known issues section to our documentation
15:05:34 <d34dh0r53> #action d34dh0r53 add https://bugs.launchpad.net/keystone/+bug/1305950 to the known issues section of our documentation
15:05:45 <d34dh0r53> #topic liaison updates
15:07:08 <d34dh0r53> nothing much, on the VMT side, we've converted two private bugs to public, LMK if you want details
15:07:20 <d34dh0r53> #topic specification OAuth 2.0 (hiromu)
15:07:29 <d34dh0r53> #link https://review.opendev.org/q/topic:bp%252Foauth2-client-credentials-ext
15:07:31 <d34dh0r53> #link https://review.opendev.org/q/topic:bp%252Fenhance-oauth2-interoperability
15:07:33 <d34dh0r53> External OAuth 2.0 Specification
15:07:35 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone-specs/+/861554
15:07:37 <d34dh0r53> OAuth 2.0 Implementation
15:07:39 <d34dh0r53> #link https://review.opendev.org/q/topic:bp%252Fsupport-oauth2-mtls
15:07:41 <d34dh0r53> OAuth 2.0 Documentation
15:07:43 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone/+/838108
15:07:45 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystoneauth/+/838104
15:08:50 <d34dh0r53> guess hiromu isn't around
15:09:07 <d34dh0r53> next up
15:09:37 <d34dh0r53> #topic specification Secure RBAC (dmendiza[m])
15:09:49 <d34dh0r53> #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_
15:09:51 <d34dh0r53> 2024.1 Release Timeline
15:09:51 <dmendiza[m]> 🙋
15:09:53 <d34dh0r53> Update oslo.policy in keystone to enforce_new_defaults=True
15:09:55 <d34dh0r53> Update oslo.policy in keystone to enforce_scope=True
15:09:55 <dmendiza[m]> Yeah, lots of updates
15:09:57 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone/+/902730 (Merged)
15:09:59 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/903713 (Merged)
15:10:06 <d34dh0r53> awesome!
15:10:51 <dmendiza[m]> OK, first up, it looks like Tempest currently has an all-or-nothing approach for setting scope in the Admin clients.
15:11:03 <dmendiza[m]> That means that they're either all project-scope or all system-scope
15:11:29 <dmendiza[m]> Unfortunately that does not work since some projects (i.e. neutron) only allow project-scoped requests for admin APIs.
15:11:46 <dmendiza[m]> So, for now, we want to only run tests as project-scoped admins
15:11:56 <dmendiza[m]> which is what this patch does: (in keystone at least)
15:12:02 <dmendiza[m]> #link https://review.opendev.org/c/openstack/keystone/+/913999
15:12:19 <dmendiza[m]> Still need another review (maybe from knikolla ?)
15:12:31 <dmendiza[m]> since Grzegorz Grasza is out on PTO this week
15:13:15 <dmendiza[m]> Now, for some reason, devstack also sets those same options
15:13:28 <dmendiza[m]> so we have duplicate code setting the same options in two repos
15:13:39 <dmendiza[m]> this is the patch to remove them from lib/tempest in the devstack repo:
15:13:45 <dmendiza[m]> #link https://review.opendev.org/c/openstack/devstack/+/914115
15:14:28 <dmendiza[m]> Next, I have a patch that modifies a couple of policies that were missed when we implemented Phase 1 of SRBAC:
15:14:36 <dmendiza[m]> #link https://review.opendev.org/c/openstack/keystone/+/914520
15:14:57 <dmendiza[m]> That one is fresh out of the oven, so still waiting on CI to run the gate jobs
15:15:58 <dmendiza[m]> Additionally, we still have the "protection" aka SRBAC jobs disabled in Keystone.  I have a patch up to re-enable them, but I am not sure why it failed when I rebased... I'll look into that next:
15:16:00 <dmendiza[m]> #link https://review.opendev.org/c/openstack/keystone/+/909238
15:16:57 <dmendiza[m]> Moving on, we do not have any tests that run the full tempest suite against Keystone with SRBAC turned on
15:17:55 <dmendiza[m]> Tempest does have an SRBAC job, but Keystone is not currently enforcing SRBAC.  I have a patch up to enable it in that existing job.  Currently failing the gate, but mostly due to needing some of the patches I've linked
15:18:00 <dmendiza[m]> #link https://review.opendev.org/c/openstack/tempest/+/912489
15:19:27 <dmendiza[m]> Lastly, I have a patch to rename the tempest option that enables SRBAC tests in keystone-tempest-plugin.  Currently it does its own thing, and my patch changes it to be in-line with the rest of the projects that use the [enforce_scope] section of tempest.conf
15:19:33 <dmendiza[m]> #link https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/913593
15:20:48 <dmendiza[m]> Oh, and I also have a DNM test to keystone-tempest-plugin to pull everything together across all those related repos and run a full suite test of SRBAC using project-admin credentials:
15:20:54 <dmendiza[m]> #link https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/914089
15:21:18 <dmendiza[m]> I still need to investigate why it's failing.  I think we may need to change some tests around in the srbac suite due to the change of admin scope.
15:21:22 <dmendiza[m]> That's all for now.
15:21:40 * dmendiza[m] feels like he's juggling spinning plates
15:22:54 <d34dh0r53> wow, that was a lot
15:22:57 <d34dh0r53> thanks dmendiza[m]
15:23:05 <d34dh0r53> I'll leave it open for questions for a minute or two
15:27:23 <d34dh0r53> #topic specification Improve federated users management (gtema)
15:27:27 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone-specs/+/748748 - waiting for reviews
15:33:17 <d34dh0r53> next up
15:33:28 <d34dh0r53> #topic specification OpenAPI support (gtema)
15:33:33 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone-specs/+/910584
15:35:28 <d34dh0r53> #topic open discussion
15:35:36 <d34dh0r53> passlib update
15:35:38 <d34dh0r53> The maintainer responded to the bug, and one of the top priorities is to fix the bcrypt version bug
15:35:40 <d34dh0r53> #link https://foss.heptapod.net/python-libs/passlib/-/issues/190
15:35:42 <d34dh0r53> Targeted to 1.7.5
15:36:20 <d34dh0r53> No updates on this, hopefully 1.7.5 will be released soon
15:39:33 <d34dh0r53> #topic bug review
15:39:40 <d34dh0r53> #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0
15:39:47 <d34dh0r53> no new bugs for keystone
15:39:59 <d34dh0r53> #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0
15:40:20 <d34dh0r53> python-keystoneclient is good
15:40:32 <d34dh0r53> #link https://bugs.launchpad.net/keystoneauth/+bugs?orderby=-id&start=0
15:40:48 <d34dh0r53> nothing new in keystoneauth
15:40:55 <d34dh0r53> #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0
15:42:06 <d34dh0r53> one new bug in keystonemiddleware
15:42:10 <d34dh0r53> #link https://bugs.launchpad.net/keystonemiddleware/+bug/1940770
15:42:26 <d34dh0r53> it's actually not new, just recently updated
15:43:04 <d34dh0r53> I'll keep an eye on that one, maybe we should move to pymemcache
15:43:16 <d34dh0r53> #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0
15:43:28 <d34dh0r53> no new bugs for pycadf
15:43:34 <d34dh0r53> #link https://bugs.launchpad.net/ldappool/+bugs?orderby=-id&start=0
15:43:45 <d34dh0r53> ldappool is good
15:43:49 <d34dh0r53> #topic conclusion
15:44:05 <d34dh0r53> Nothing from me, add topics for the PTG to
15:44:15 <d34dh0r53> #link https://etherpad.opendev.org/p/dalmation-ptg-keystone
15:44:22 <d34dh0r53> Thanks all!
15:44:25 <d34dh0r53> #endmeeting