14:01:17 <csatari> #startmeeting review_of_dublin_edge_notes
14:01:18 <openstack> Meeting started Thu Jun 28 14:01:17 2018 UTC and is due to finish in 60 minutes.  The chair is csatari. Information about MeetBot at http://wiki.debian.org/MeetBot.
14:01:19 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
14:01:21 <openstack> The meeting name has been set to 'review_of_dublin_edge_notes'
14:01:27 <csatari> #topic Roll Call
14:01:38 <csatari> #info Gergely Csatari
14:02:19 <Arkady_Kanevsky> hello again
14:02:38 <csatari> #link https://wiki.openstack.org/wiki/OpenStack_Edge_Discussions_Dublin_PTG
14:02:52 <Arkady_Kanevsky> i will have to drop in 15 min
14:03:05 <csatari> Hah, better to hurry , then :)
14:03:13 <Arkady_Kanevsky> +1
14:03:16 <csatari> #topic Housekeeping
14:03:31 <Arkady_Kanevsky> I did had one concern on federation.
14:03:42 <csatari> #info We continue from 5.3.2.5 User management data receiver side
14:03:51 <Arkady_Kanevsky> say we have edge/core that is vmware based, say VIO
14:03:56 <csatari> Okay, What is it?
14:04:02 <dpaterson> o/
14:04:10 <Arkady_Kanevsky> And and far edge is openstack on baremetal.
14:04:33 <Arkady_Kanevsky> how does keystone fderation worrk?
14:05:29 <csatari> The VIO OpenStack should be configured to be an Identity provider
14:05:55 <csatari> While the far edge Keystone should be configured to use the remote Identity providesr.
14:06:14 <Arkady_Kanevsky> VIO will use vSsphere for platform and its identity management. Keystone is just a shim on top of it.
14:06:51 <csatari> Aham. We should ask this from Ketstone guys.
14:07:05 <csatari> #topic Keystone architectures
14:07:10 <Arkady_Kanevsky> if kesyotone can use remote ID provider then it will work. probably with local cache for disconnect periods.
14:07:18 <Arkady_Kanevsky> thanks
14:07:44 <csatari> #info VIO Keystone is only a shim layer on top of vSphere. Is it possible to configure this as an Identity provider?
14:08:02 <Arkady_Kanevsky> I will ask vmware folks
14:08:15 <csatari> I will add this as a question to https://wiki.openstack.org/wiki/Keystone_edge_architectures
14:08:22 <csatari> Okay, please report back the result.
14:08:54 <csatari> #action csatari to add this question to  https://wiki.openstack.org/wiki/Keystone_edge_architectures#Several_keystone_instances_with_federation_and_API_synchronsation
14:09:41 <csatari> #topic Review of 5.3.2.5 User management data receiver side
14:10:19 <csatari> #link https://wiki.openstack.org/wiki/OpenStack_Edge_Discussions_Dublin_PTG#User_management_data_receiver_side
14:11:18 <csatari> I think we should add the option to create shadow users here as it is done with K2K federation.
14:11:44 <csatari> #action csatari 5.3.2.5 Add the possibility to use shadow users.
14:12:32 <dpaterson> csatari: Does all ACL associated with user come along with shadow user?
14:12:52 <csatari> I think not.
14:13:21 <csatari> Shadow user is created by rules defined on the far side.
14:13:30 <dpaterson> So things like object store permissions etc could be an issue at the edge node?
14:14:06 <csatari> According to my understanding these can be set using these rules.
14:14:53 <csatari> Mapping rules:  https://docs.openstack.org/keystone/latest/advanced-topics/federation/federated_identity.html#mapping-combinations
14:14:57 <dpaterson> So master keystone has to create mappings that will be used for creating shadow users?  Something along those lines?
14:15:19 <dpaterson> csatari: tx
14:15:21 <csatari> Nope, the mapping is done in the edge Keystones
14:15:52 <Arkady_Kanevsky> need to drop
14:16:08 <csatari> But the best is to ask it on the DL (any of them) from Keystone guys.
14:16:10 <csatari> Okay
14:16:13 <csatari> See you.
14:17:17 <csatari> Any more comments to 5.3.2.5 ?
14:17:55 <csatari> #topic Review of 5.3.2.5 User management data receiver side
14:18:04 <csatari> #link https://wiki.openstack.org/wiki/OpenStack_Edge_Discussions_Dublin_PTG#User_management_data_receiver_side
14:18:34 <csatari> Here we should also mention the sahdow users case.
14:19:16 <csatari> Hah! we just discussed this.
14:19:41 <csatari> #topic Review of 5.3.2.6 RBAC data source side
14:21:26 <csatari> #info Can we totally rely on K2K federation here or do we still need to synchronise data?
14:22:34 <csatari> I will ask in mail.
14:24:19 <csatari> #topic Review of 5.3.2.7 RBAC data receiver side
14:24:46 <csatari> #info Same goes to here as for 5.3.2.6
14:26:07 <csatari> I just saw esarault -s mail.
14:26:32 <csatari> Am I doing a lonely review here?
14:30:30 <csatari> I think I've lost quorum, so I stop here with the review.
14:30:38 <csatari> #topic End meeting
14:31:07 <csatari> #info We will continue from 5.3.2.8 VM images source side
14:32:03 <csatari> #info Next meeting is on 2018.07.05 16:00 CET on #edge-computing-group
14:32:15 <csatari> #endmeeting