17:01:48 <gmann> #startmeeting policy_popup
17:01:48 <opendevmeet> Meeting started Tue May  9 17:01:48 2023 UTC and is due to finish in 60 minutes.  The chair is gmann. Information about MeetBot at http://wiki.debian.org/MeetBot.
17:01:48 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
17:01:48 <opendevmeet> The meeting name has been set to 'policy_popup'
17:01:53 <gmann> dmendiza[m]: hi
17:02:02 <dmendiza[m]> Hi gmann
17:02:11 <gmann> this is today agenda, #link https://etherpad.opendev.org/p/rbac-goal-tracking#L148
17:02:16 <gmann> dmendiza[m]: hi, how r u
17:02:37 <dmendiza[m]> Good, just trying to get back into the SRBAC happenings
17:02:45 <gmann> great
17:03:03 <gmann> let me go through the agenda and then we can discuss if anything specific you have
17:03:05 <gmann> Updating the RBAC goal timeline for old rule removal considering the SLURP releases
17:03:22 <gmann> I updated it and governance change is merged #link https://review.opendev.org/c/openstack/governance/+/880238
17:04:00 <gmann> and you might see neutron also switched their new defaults by default
17:04:19 <gmann> #link https://lists.openstack.org/pipermail/openstack-discuss/2023-May/033579.html
17:04:30 <dmendiza[m]> Nice
17:04:30 <gmann> nova, glance already did it in last cycle
17:04:44 <dmendiza[m]> I can get Barbican and Keystone to switch over this cycle too
17:04:59 <gmann> thanks
17:05:23 <gmann> I think we need some work to do in keystone on supporting the project scope for every rule.
17:05:31 <gmann> I will try to push the changes in this week
17:05:48 <dmendiza[m]> That's to s/system-scope/admin-role/g right?
17:05:48 <gmann> that is needed as all services except ironic dropped the system scope
17:06:19 <gmann> yeah, basically allow project scope token to keep accessing the APIs as per their original persona
17:06:32 <dmendiza[m]> >  supporting the project scope for every rule
17:06:43 <dmendiza[m]> Will that be a change to Keystone's policies?
17:07:15 <gmann> yes, it will add 'project' in allowed scope but will keep system scope support also
17:07:39 <gmann> I mean just addition of project scope allow and no change in what is allowed currently
17:07:42 <dmendiza[m]> oh gotcha.  So, not dropping system, but also allowing "admin" role to do those things.
17:07:49 <gmann> yup
17:08:09 <gmann> I will try to push the change and then it will be more clear, will add you in review
17:08:33 <dmendiza[m]> Thanks, yeah, I'll keep an eye out for that.
17:08:41 <gmann> cool
17:08:41 <dmendiza[m]> I think we need to do something similar in Barbican
17:08:51 <dmendiza[m]> there's a few Barbican APIs that still require system scope
17:09:16 <gmann> dmendiza[m]: but we do not want system scope support in anywhere except ironic and keystone
17:09:34 <dmendiza[m]> gotcha
17:09:35 <dmendiza[m]> OK
17:09:49 <dmendiza[m]> yeah, I'll propose a patch to Barbican to drop system scope
17:09:52 <gmann> octavia also dropped system scope recently which is what our goal is
17:09:57 <gmann> great
17:10:14 <gmann> #action dmendiza[m] to propose change in barbican to drop system scope
17:10:20 <gmann> dmendiza[m]: ^^ just to have it reminder
17:10:34 <gmann> #action gmann to propose keystone change to support project scope
17:10:43 <dmendiza[m]> thanks
17:11:13 <gmann> next is review requests
17:11:17 <gmann> magnum
17:11:20 <gmann> #link https://review.opendev.org/c/openstack/magnum/+/875625
17:11:43 <gmann> it has one +2 and I also reviewed it +1 since last cycle but not merging
17:11:56 <gmann> I think I need to send it on ML if any other core can merge
17:12:11 <gmann> #action gmann to ask for magnum rbac change review on ML
17:12:41 <gmann> next is keystone
17:12:47 <gmann> Service role #link https://review.opendev.org/c/openstack/keystone/+/863420
17:13:24 <gmann> dmendiza[m]: I think this is ready ? I also need to review the latest PS
17:13:44 <dmendiza[m]> I'll add it to the next Keystone Reviewathon.
17:13:52 <gmann> cool, thanks
17:13:55 <dmendiza[m]> (which won't be until next week because Red Hat has a holiday on Friday)
17:14:18 <gmann> ohk
17:14:18 <dmendiza[m]> but I'll try to review it before then
17:14:30 <gmann> thanks, really appreciate, they have been open for long
17:14:54 <gmann> manger role #link https://review.opendev.org/c/openstack/keystone/+/822601
17:15:04 <gmann> this need some changes as per review comment
17:15:17 <gmann> I will try to ping abhishek about it
17:15:33 <dmendiza[m]> Ah yes, I remember this one ... I'll need a refresher though.
17:16:41 <gmann> that is all from agenda today
17:16:48 <gmann> dmendiza[m]: anything else you have to discuss ?
17:17:09 <dmendiza[m]> Nope.  I was mainly wondering what the status of "system" scope was
17:17:21 <dmendiza[m]> but we talked about that already
17:17:41 <gmann> ok, yeah we decided to dropped system scope from every project except Ironic and Keystone
17:18:39 <gmann> dmendiza[m]: this is documentation for that and above section on why we need to do it #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#change-in-scope-implementation
17:19:10 <gmann> I am keeping this goal document up to dated so any time you can refer it
17:19:26 <dmendiza[m]> That's good to know.  Thanks for that. 👍️
17:19:32 <gmann> np!
17:19:40 <gmann> ok, let's close the meeting,
17:19:46 <gmann> thanks dmendiza[m] for joining
17:19:52 <dmendiza[m]> Sounds good, thanks gmann
17:19:55 <gmann> #endmeeting