| *** VW has joined #craton | 00:31 | |
| *** VW has quit IRC | 00:35 | |
| *** VW has joined #craton | 00:37 | |
| *** VW has quit IRC | 00:45 | |
| *** VW has joined #craton | 01:11 | |
| *** VW has quit IRC | 01:36 | |
| *** VW has joined #craton | 01:39 | |
| *** valw has joined #craton | 02:38 | |
| *** valw has quit IRC | 02:43 | |
| *** VW has quit IRC | 06:06 | |
| *** valw has joined #craton | 06:40 | |
| *** valw has quit IRC | 06:44 | |
| *** VW has joined #craton | 07:07 | |
| *** Mudpuppy has quit IRC | 07:10 | |
| *** VW has quit IRC | 07:11 | |
| *** VW has joined #craton | 08:08 | |
| *** VW has quit IRC | 08:13 | |
| sulo | o/ | 08:45 |
|---|---|---|
| *** Mudpuppy has joined #craton | 09:41 | |
| *** Mudpuppy has quit IRC | 09:47 | |
| *** VW has joined #craton | 10:11 | |
| *** VW has quit IRC | 10:15 | |
| *** valw has joined #craton | 10:41 | |
| *** valw has quit IRC | 10:46 | |
| *** VW has joined #craton | 10:48 | |
| *** VW has quit IRC | 10:53 | |
| *** VW has joined #craton | 12:04 | |
| *** VW has quit IRC | 13:15 | |
| *** VW has joined #craton | 13:24 | |
| *** VW has quit IRC | 13:25 | |
| sigmavirus | I can't quite figure out why http://logs.openstack.org/38/401438/1/check/gate-python-cratonclient-docs-ubuntu-xenial/45223c6/console.html.gz#_2016-11-23_21_36_47_610157 is having a "POST_FAILURE" | 13:29 |
| * sulo just wasted hours today trying to figure out this workflow thing ... | 14:04 | |
| sigmavirus | sulo: what workflow thing? | 14:19 |
| sigmavirus | (also that gate just needed another recheck to fix the post_failure) | 14:19 |
| *** VW has joined #craton | 14:24 | |
| *** openstackstatus has quit IRC | 14:28 | |
| *** openstackstatus has joined #craton | 14:28 | |
| *** VW has quit IRC | 14:29 | |
| *** valw has joined #craton | 14:42 | |
| *** valw has quit IRC | 14:42 | |
| *** VW has joined #craton | 14:43 | |
| *** valw has joined #craton | 14:43 | |
| jimbaker | sigmavirus, so i guess this is why my approval of https://review.openstack.org/#/c/401974/ is still stuck... | 14:46 |
| jimbaker | sigmavirus, sulo - any thoughts on using openstack client as the way to work with our client? http://docs.openstack.org/developer/python-openstackclient/plugins.html | 14:49 |
| jimbaker | i don't think this came up in our discussions earlier, but it seems highly relevant now | 14:49 |
| sigmavirus | jimbaker: openstackclient has always been explicitly not operator focused iirc | 14:51 |
| sigmavirus | craton is operator focused | 14:51 |
| sigmavirus | ergo no | 14:51 |
| sigmavirus | jimbaker: I think you approved that change while zuul was dead | 14:52 |
| jimbaker | sigmavirus, so recheck? what | 14:52 |
| jimbaker | is the magic incantation to move it along? | 14:52 |
| jimbaker | git-harry, palendae, sulo, sigmavirus - irc meeting in 5 min | 14:55 |
| jimbaker | on #openstack-meeting-4 | 14:55 |
| jimbaker | and anyone else interested! | 14:55 |
| sulo | jimbaker: sigmavirus: i think that pr depends on another thats not merged yet | 14:55 |
| jimbaker | sulo, so https://review.openstack.org/#/c/402016/ ? | 14:56 |
| jimbaker | i don't see dependencies on the review. but it's not like i know all of the intricacies of gerrit either | 14:57 |
| sulo | yeah i agree its not very good at showing that | 14:58 |
| sigmavirus | jimbaker: sulo using gertty shows it pretty well | 14:59 |
| jimbaker | let's try it out. https://review.openstack.org/#/c/402016/ is an obvious fix | 14:59 |
| sigmavirus | jimbaker: I believe Harry's out this week | 15:00 |
| sigmavirus | also I started the meeting in -4 for us | 15:00 |
| jimbaker | sigmavirus, that's what he mentioned on #rbcops | 15:00 |
| jimbaker | yeah, saw that | 15:00 |
| sigmavirus | jimbaker: you can continue chairing it :) | 15:00 |
| jimbaker | really, you don't want to do this? | 15:01 |
| sulo | sigmavirus: yeah thats what i use .. i am talking about the gerrit UI i think thats what jimbaker was looking at | 15:01 |
| sigmavirus | jimbaker: nah, just wanted to make sure we didn't lose track of the meeting | 15:01 |
| * jimbaker is a very unsophisticated user of certain tooling ;) | 15:01 | |
| sigmavirus | jimbaker: I'm happy to run meetings if you want | 15:01 |
| sigmavirus | they'll just be short | 15:02 |
| *** syed__ has joined #craton | 15:21 | |
| *** Mudpuppy has joined #craton | 15:23 | |
| *** valw has quit IRC | 15:44 | |
| *** valw has joined #craton | 15:44 | |
| *** valw has quit IRC | 15:49 | |
| *** valw has joined #craton | 15:59 | |
| jimbaker | sulo, re functional tests - i'm going to revisit | 16:00 |
| sulo | sigmavirus: also you wanted to discuss something on rbac ? | 16:00 |
| jimbaker | i couldn't +1 it because it didn't work for me. so something screwed up, almost certainly on my end | 16:00 |
| sulo | jimbaker: didnt work ? | 16:00 |
| jimbaker | yes, doesn't work. despite all the docker cleanup i did | 16:01 |
| sulo | oh !?! | 16:01 |
| *** david-lyle has quit IRC | 16:01 | |
| *** keekz has quit IRC | 16:01 | |
| sulo | what you getting for errors ? | 16:01 |
| sulo | also i added https://review.openstack.org/#/c/397872/7/tox.ini | 16:01 |
| *** keekz has joined #craton | 16:02 | |
| sulo | so its separate from unit testing now | 16:02 |
| jimbaker | sulo, last time i tried - and this was wed, maybe subsequent updates? | 16:02 |
| jimbaker | it just stalled indefinitely | 16:02 |
| *** david-lyle has joined #craton | 16:02 | |
| sigmavirus | sulo: I want something to discuss about RBAC | 16:02 |
| jimbaker | so as i said, i will revisit | 16:02 |
| sigmavirus | I have questions and stuff to poke at, but it's still too ephemeral | 16:02 |
| jimbaker | (friday i focused on rbac) | 16:02 |
| sigmavirus | So, I am refraining from getting into a rabbit hole with it right now | 16:03 |
| jimbaker | sigmavirus, it is a rabbit hole | 16:03 |
| sigmavirus | right, I'm saving it for another day | 16:03 |
| jimbaker | there's a reason why we haven't touched it for real until now | 16:03 |
| sulo | sigmavirus: ok | 16:04 |
| sulo | jimbaker: can you try again ? | 16:04 |
| jimbaker | sulo, for sure | 16:05 |
| sulo | i want to say its local to your setting but would love to find out why it would just stall | 16:05 |
| jimbaker | sulo, yeah, i want to figure this out. after all, i'm a big proponent of this approach for craton :) | 16:06 |
| jimbaker | sulo, re rbac - re https://gist.github.com/jimbaker/6a4fd7e07a16a318a45d7d1d96819040 (the rbac modeling code) | 16:07 |
| *** VW_ has joined #craton | 16:07 | |
| jimbaker | i think this is the simplest approach that is flexible enough | 16:07 |
| *** VW_ has quit IRC | 16:08 | |
| jimbaker | there is still more work to do here. one specific thing that we discussed was a role that was based on a key prefix; or maybe a regex to be more general | 16:09 |
| sigmavirus | jimbaker: so what representation of a resource are we using for the rbac? | 16:10 |
| sigmavirus | The route itself or something else? | 16:10 |
| jimbaker | but that seems like something we could just add on to oslo.policy | 16:10 |
| sigmavirus | you mean like "fleet:" as the prefix for a rule? | 16:10 |
| jimbaker | sigmavirus, the actual resource, as mediated by a given rest api | 16:10 |
| jimbaker | fleet: is just the kind | 16:10 |
| sigmavirus | jimbaker: so, for example, `/v1/hosts`? | 16:11 |
| *** VW has quit IRC | 16:11 | |
| sigmavirus | or `GET /v1/hosts`? | 16:11 |
| jimbaker | so we can hook into oslo.policy. but tbh, i haven't done any such dev work yet. it seemed close enough to what oslo.policy actually does :) | 16:11 |
| jimbaker | sigmavirus, so my assumption is that the rest api supporting /v1/hosts will be able to ask of the given resource - a host in this case - are you authorized by the roles associated with you for this user? | 16:13 |
| jimbaker | sigmavirus, in the forward chaining that oslo.policy, we would somehow apply the results from https://gist.github.com/jimbaker/6a4fd7e07a16a318a45d7d1d96819040#file-gistfile1-txt-L68 | 16:14 |
| jimbaker | or more precisely the usage in https://gist.github.com/jimbaker/6a4fd7e07a16a318a45d7d1d96819040#file-gistfile1-txt-L81 | 16:15 |
| jimbaker | APIs are not at all settled :) | 16:15 |
| jimbaker | but the union-all implied by that seems to make sense to me | 16:15 |
| *** VW has joined #craton | 16:16 | |
| jimbaker | sorry, better gist location - https://gist.github.com/jimbaker/6a4fd7e07a16a318a45d7d1d96819040#file-t-roles-py-L81 | 16:20 |
| jimbaker | i should do a WIP change on gerrit. would work much better for actual discussion! | 16:21 |
| sigmavirus | jimbaker: so resource is even more fine grained, as in a particular host | 16:25 |
| sigmavirus | right? | 16:25 |
| sigmavirus | or device, or network device, etc. | 16:25 |
| jimbaker | sigmavirus, yes | 16:27 |
| jimbaker | i assume no one would actually do that assignment | 16:28 |
| jimbaker | but it could be done in principle | 16:28 |
| sigmavirus | Ok, so then what do you expect resource to be then? You haven't really given me a firm answer for that | 16:28 |
| *** VW has quit IRC | 16:29 | |
| jimbaker | sigmavirus, anything that mixins in RoleAssignmentMixin | 16:29 |
| jimbaker | you would still need to actually use this in the corresponding rest api... this mixin only gives you scoped role assignments | 16:30 |
| sigmavirus | oh we're looking at doing this at the model layer | 16:30 |
| jimbaker | sigmavirus, the model layer provides support | 16:31 |
| sigmavirus | Right, but you'd mix this in with Region, User, Project, Host, Device, etc.? | 16:31 |
| sigmavirus | or just Device (since Host subclasses Device) | 16:31 |
| jimbaker | Device works, given subclass relationships | 16:31 |
| jimbaker | likewise if we follow this model, mixin to Principal gives the ability to assign scoped roles to users and workflow | 16:32 |
| jimbaker | which could be interesting since it's principal, resource, role - but a resource could be a role | 16:32 |
| *** VW has joined #craton | 16:33 | |
| *** VW has quit IRC | 16:33 | |
| jimbaker | room for debate! | 16:33 |
| *** VW has joined #craton | 16:33 | |
| sigmavirus | yeah, I need a firm description of what needs solving versus what we're solving fo | 16:34 |
| sigmavirus | Also, https://review.openstack.org/401438 is now passing. The POST_FAILURES from last week were zuul issues | 16:36 |
| jimbaker | good to know | 16:45 |
| jimbaker | and yeah, this experiment on scoped triples for rbac is hopefully going to help firm this up | 16:46 |
| jimbaker | in terms of firming up, we will do in the context of user stories | 16:47 |
| jimbaker | an admin needs to configure a region; or a developer is defining a new workflow; or an operator needs to run a workflow on a cell | 16:48 |
| jimbaker | that sort of thing | 16:48 |
| *** VW has quit IRC | 16:53 | |
| *** jovon has joined #craton | 16:58 | |
| *** VW has joined #craton | 17:01 | |
| *** VW has quit IRC | 17:06 | |
| *** VW has joined #craton | 17:13 | |
| *** valw has quit IRC | 17:16 | |
| *** valw has joined #craton | 17:25 | |
| *** valw has quit IRC | 17:29 | |
| sulo | am i the only one having vidyo problems ? | 17:32 |
| *** valw has joined #craton | 17:38 | |
| jovon | I had issues recently because i am running OS sierra. Do you use a Mac? | 17:47 |
| *** valw has quit IRC | 17:58 | |
| *** VW_ has joined #craton | 18:00 | |
| *** VW_ has quit IRC | 18:02 | |
| *** VW_ has joined #craton | 18:02 | |
| *** VW has quit IRC | 18:02 | |
| *** VW_ has quit IRC | 18:02 | |
| *** VW has joined #craton | 18:02 | |
| *** valw has joined #craton | 18:03 | |
| *** valw has quit IRC | 18:37 | |
| *** valw has joined #craton | 18:47 | |
| *** valw has quit IRC | 18:52 | |
| jimbaker | sulo, any thoughts on https://github.com/NerdWalletOSS/versionalchemy ? blog post here, https://www.nerdwallet.com/blog/engineering/versionalchemy-tracking-row-changes/ | 19:00 |
| jimbaker | i like the approach of serializing the row into json. lighter weight than tracking more explicitly (that's the bitemporal approach i mentioned) | 19:02 |
| jimbaker | if we did do the heavier weight approach, ideally we would have db support. something like http://clarkdave.net/2015/02/historical-records-with-postgresql-and-temporal-tables-and-sql-2011/ | 19:04 |
| *** valw has joined #craton | 19:05 | |
| *** valw has quit IRC | 19:16 | |
| *** valw has joined #craton | 19:19 | |
| *** Mudpuppy has quit IRC | 19:29 | |
| *** VW has quit IRC | 19:34 | |
| *** VW has joined #craton | 19:34 | |
| *** VW has quit IRC | 19:36 | |
| *** valw has quit IRC | 19:38 | |
| *** valw has joined #craton | 19:40 | |
| *** Mudpuppy has joined #craton | 19:43 | |
| sigmavirus | jovon: running sierra for a while | 19:49 |
| *** VW has joined #craton | 19:53 | |
| *** VW has quit IRC | 19:55 | |
| *** VW has joined #craton | 20:00 | |
| syed__ | jimbaker: let me know when you get some time, need to discuss few things about rbac | 20:03 |
| syed__ | I would appreciate if everyone raises bugs and then fix them, makes tracking a lot easier :) | 20:04 |
| *** VW has quit IRC | 20:05 | |
| *** VW has joined #craton | 20:10 | |
| syed__ | jimbaker: I like the VersionAlchemy , its pretty cool | 20:30 |
| *** VW has quit IRC | 20:37 | |
| *** VW has joined #craton | 20:37 | |
| jimbaker | syed__, yeah, that's something we need to do a better job of | 20:46 |
| *** valw has quit IRC | 20:56 | |
| *** valw has joined #craton | 21:01 | |
| *** valw has quit IRC | 21:33 | |
| *** VW has quit IRC | 21:44 | |
| *** valw has joined #craton | 21:47 | |
| *** VW has joined #craton | 21:49 | |
| *** valw has quit IRC | 21:51 | |
| *** valw has joined #craton | 21:52 | |
| *** valw has quit IRC | 21:54 | |
| *** valw has joined #craton | 21:56 | |
| *** VW has quit IRC | 21:57 | |
| *** VW has joined #craton | 21:59 | |
| *** Mudpuppy has quit IRC | 22:07 | |
| *** valw has quit IRC | 22:07 | |
| jimbaker | syed__, re rbac, can we discuss further in about 30 min? | 22:27 |
| jimbaker | i will walk you through my thoughts on scoped roles | 22:28 |
| jimbaker | it will be interesting to compare with say https://technet.microsoft.com/en-us/library/dd335146%28v=exchg.150%29.aspx | 22:28 |
| jimbaker | in active directory | 22:28 |
| jimbaker | brb | 22:29 |
| *** VW has quit IRC | 22:41 | |
| *** VW has joined #craton | 22:44 | |
| *** VW has quit IRC | 22:51 | |
| *** valw has joined #craton | 23:05 | |
| jimbaker | sulo, so tox -e functional works fine on ubuntu 16.04; but stalls for me on os x | 23:09 |
| jimbaker | given that os x is not a true target, and given that the functional test now can be run as a separate test env, it's fine for now. we can look at os x in the future | 23:10 |
| *** valw has quit IRC | 23:13 | |
| *** jovon has quit IRC | 23:18 | |
| jimbaker | syed__, we can also discuss rbac tomorrow. maybe briefly in tomorrow's vidyo meeting | 23:25 |
| jimbaker | i still need to convince sigmavirus after all :) | 23:25 |
| *** VW has joined #craton | 23:38 | |
| *** VW has quit IRC | 23:43 | |
| syed__ | jimbaker: sounds good | 23:52 |
| syed__ | Tomorrow it is then | 23:52 |
| syed__ | :) | 23:52 |
| jimbaker | cool | 23:53 |
| jimbaker | syed, do read up on those two active directory links i sent you | 23:53 |
| jimbaker | this should give you context in terms of the modeling thoughts i have | 23:53 |
| jimbaker | the other thing is to look at http://docs.openstack.org/developer/oslo.policy/api/oslo_policy.html#oslo_policy.policy.register and corresponding logic, such as the Check class | 23:54 |
| jimbaker | syed__, ideally you can write this code | 23:54 |
| jimbaker | i think the scoped role assignment is pretty much implemented at this point in the gist i shared earlier (https://gist.github.com/jimbaker/6a4fd7e07a16a318a45d7d1d96819040) | 23:55 |
| jimbaker | in terms of what active directory calls regular scoped role assignments | 23:55 |
| jimbaker | exclusive scope would seem to be a straightforward extension where instead of doing a union-all of all the scopes in the hierarchy, it's a more complex combination | 23:57 |
| jimbaker | much like describing a penguin as a bird; or a platypus as a mammal :) | 23:58 |
| jimbaker | just need to provide an exclusion mechanism | 23:58 |
| jimbaker | when using generalizations | 23:59 |
| jimbaker | anyway, i'm finally making headway on writing the blueprint for this functionality | 23:59 |
| jimbaker | and hope to do the same on virtualized variables, which we need right now | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!