| *** VW has joined #craton | 00:28 | |
| *** VW has quit IRC | 00:33 | |
| *** palendae has quit IRC | 01:12 | |
| *** wirehead_ has quit IRC | 01:12 | |
| *** b3rn-n00dl3s has quit IRC | 01:12 | |
| *** wirehead_1 has joined #craton | 01:12 | |
| *** palendae has joined #craton | 01:13 | |
| *** palendae is now known as Guest64701 | 01:13 | |
| *** Guest64701 is now known as palendae | 01:14 | |
| *** b3rn-n00dl3s has joined #craton | 01:17 | |
| *** ChanServ sets mode: +o b3rn-n00dl3s | 01:17 | |
| *** izaakk has quit IRC | 01:23 | |
| *** lcastell has quit IRC | 01:23 | |
| *** lcastell has joined #craton | 01:24 | |
| *** izaakk has joined #craton | 01:28 | |
| *** valw has joined #craton | 01:51 | |
| *** Mudpuppy_ has joined #craton | 02:03 | |
| *** VW has joined #craton | 02:31 | |
| *** VW has quit IRC | 02:35 | |
| *** turvey has quit IRC | 02:42 | |
| *** b3rn-n00dl3s has quit IRC | 02:42 | |
| *** Tamayo has quit IRC | 02:42 | |
| *** turvey has joined #craton | 02:42 | |
| *** Tamayo has joined #craton | 02:45 | |
| *** b3rn-n00dl3s has joined #craton | 02:45 | |
| *** ChanServ sets mode: +o b3rn-n00dl3s | 02:45 | |
| *** david-lyle has quit IRC | 02:55 | |
| *** VW has joined #craton | 02:58 | |
| *** valw has quit IRC | 03:02 | |
| *** valw has joined #craton | 03:03 | |
| *** Mudpuppy_ has quit IRC | 03:25 | |
| *** valw has quit IRC | 03:27 | |
| *** valw has joined #craton | 03:36 | |
| *** valw has quit IRC | 03:55 | |
| *** valw has joined #craton | 04:07 | |
| *** VW has quit IRC | 04:10 | |
| *** VW has joined #craton | 04:14 | |
| *** valw has quit IRC | 04:27 | |
| *** VW has quit IRC | 04:39 | |
| *** ediardo has quit IRC | 06:32 | |
| *** ediardo has joined #craton | 06:33 | |
| *** VW has joined #craton | 06:40 | |
| *** VW has quit IRC | 06:44 | |
| *** tojuvone has quit IRC | 08:14 | |
| *** VW has joined #craton | 10:03 | |
| *** VW has quit IRC | 10:07 | |
| *** VW has joined #craton | 12:18 | |
| *** VW has quit IRC | 12:23 | |
| *** valw has joined #craton | 12:31 | |
| *** valw has quit IRC | 12:36 | |
| *** VW has joined #craton | 14:03 | |
| *** VW has quit IRC | 14:07 | |
| *** VW has joined #craton | 14:07 | |
| *** valw has joined #craton | 14:32 | |
| *** valw has quit IRC | 14:36 | |
| jimbaker | git-harry, palendae, sigmavirus, sulo, others interested - craton weekly meeting resumes in 10 min on #openstack-meeting-4. let's kickoff some great work in 2017! | 14:50 |
|---|---|---|
| *** VW has quit IRC | 14:53 | |
| *** Mudpuppy_ has joined #craton | 15:01 | |
| *** valw has joined #craton | 15:34 | |
| *** Syed__ has joined #craton | 15:39 | |
| *** VW has joined #craton | 15:42 | |
| *** VW has quit IRC | 15:43 | |
| *** VW has joined #craton | 15:43 | |
| *** valw has quit IRC | 15:45 | |
| *** valw has joined #craton | 15:45 | |
| *** valw has quit IRC | 15:50 | |
| *** valw has joined #craton | 15:52 | |
| *** valw_ has joined #craton | 15:55 | |
| *** valw has quit IRC | 15:57 | |
| jimbaker | palendae, maybe retrieving variables uses a default namespace unless other namespaces are *imported* by the query? that could work well. again it's just a question of who does the filtering | 16:42 |
| *** valw_ has quit IRC | 16:51 | |
| *** valw has joined #craton | 16:54 | |
| *** valw has quit IRC | 17:10 | |
| *** rainya has joined #craton | 17:14 | |
| *** VW has quit IRC | 17:15 | |
| *** VW has joined #craton | 17:17 | |
| *** rainya has quit IRC | 17:18 | |
| *** rainya has joined #craton | 17:20 | |
| *** VW has quit IRC | 17:22 | |
| *** VW has joined #craton | 17:22 | |
| jimbaker | Syed__, are you still working on https://review.openstack.org/#/c/396750/ ? | 17:29 |
| Syed__ | I haven't been looking into that lately but i need to. will look into it today | 17:30 |
| jimbaker | Syed__, also updated https://gist.github.com/jimbaker/faa6288a8fcd9ba736f950435a901537 with the change i mentioned in today's meeting | 17:31 |
| jimbaker | it's very trivial in terms of usage, just took some time to figure out how to use the api properly | 17:31 |
| *** jovon has joined #craton | 17:32 | |
| jimbaker | basically need to have what amounts to asserting that the role assignment exists for both target resource AND the credential of the principal. then standard chaining by the enforce method so the desired role can be proven to be in effect (or not) | 17:33 |
| jimbaker | again more in my writeup later this week | 17:33 |
| jimbaker | but the net of it is that implementing the policy.json stuff is going to be easy, at least with respect to scoped role assignments | 17:34 |
| jimbaker | sigmavirus, it's interesting to see that of the various openstack projects i track at the source level (to better understand decision making), namely barbican, cinder, keystone, magnum, nova, only cinder uses osprofiler. of course you would know about its possible problems! | 17:39 |
| sigmavirus | jimbaker: glance has support for it | 17:40 |
| sigmavirus | I think Nova does too | 17:40 |
| sigmavirus | As in, an operator can enable it | 17:40 |
| jimbaker | sigmavirus, ahh, sorry, you have been working in glance, right? | 17:41 |
| sigmavirus | Correct | 17:41 |
| sigmavirus | barbican and magnum, though, are fairly immature projects | 17:41 |
| sigmavirus | (by Foundation measures) | 17:41 |
| jimbaker | will have to contrast and compare | 17:41 |
| sigmavirus | So I'm not sure looking at them is the best judge of usage | 17:41 |
| jimbaker | i'm interested in immature projects, because sometimes they don't have cruft | 17:42 |
| jimbaker | just part of my overall code archeology work... | 17:42 |
| Syed__ | Yeap seems like policy.json work should be pretty straight forward | 17:43 |
| Syed__ | jimbaker: is this script working ? | 17:43 |
| jimbaker | Syed__, yes | 17:44 |
| jimbaker | but only on python 3.5 | 17:44 |
| Syed__ | so this is how i am doing it | 17:44 |
| jimbaker | fwiw | 17:44 |
| Syed__ | yeah python 3.5 is what i am using | 17:45 |
| Syed__ | https://www.irccloud.com/pastebin/MjfyuUtB/ | 17:45 |
| jimbaker | ok, i wonder how you can get a different result. gist? | 17:45 |
| jimbaker | Syed__, so i'm interested in the second script here | 17:45 |
| jimbaker | in the gist i attached | 17:46 |
| Syed__ | yeah i am using the same gist as you have put up and its giving me oslo_policy.policy.PolicyNotAuthorized: {} is disallowed by policy rule example:lowercase_admin with {} | 17:46 |
| *** valw has joined #craton | 17:47 | |
| jimbaker | as for the old script | 17:47 |
| jimbaker | that's the expected behavior | 17:47 |
| Syed__ | https://gist.github.com/ahsan518/8b4996bd224943cf1a2c752761d56faf | 17:48 |
| jimbaker | i was exploring what it took to get the oslo_policy.policy.PolicyNotAuthorized exception in the second usage, without admin credentials | 17:48 |
| jimbaker | anyway, try it out some more. but looks like you're getting what i'm seeing, which is important :) | 17:49 |
| Syed__ | hmm | 17:49 |
| jimbaker | so again old script is t-policy.py | 17:49 |
| jimbaker | new script is t-policy-using-role-assignment.py | 17:49 |
| jimbaker | order got jumbled with the addition. whatever | 17:50 |
| Syed__ | i see. | 17:50 |
| Syed__ | okay yeah new script works fine.. Let me look in the older one | 17:50 |
| Syed__ | just wanted to confirm | 17:50 |
| jimbaker | yeah, you are seeing the right behavior | 17:50 |
| Syed__ | thanks | 17:50 |
| jimbaker | first enforce succeeds; second fails in the old script. as expected | 17:51 |
| jimbaker | we still need to figure out policy registration, for kinds like fleet: | 17:51 |
| jimbaker | Syed__, maybe you can take a look at that part of the API | 17:51 |
| jimbaker | basically make it work to use the authorize method instead | 17:51 |
| Syed__ | Sure i will | 17:52 |
| jimbaker | Syed__, simply try replacing enforce with authorize | 17:52 |
| jimbaker | i'm sure this is documented in the oslo.policy tests | 17:52 |
| jimbaker | just not very well documented in the actual docs | 17:53 |
| Syed__ | yeap i looked into authorize but wasn't able to find much about it | 17:54 |
| jimbaker | i know it has something to do with the various registration methods, but i just haven't had time to really figure out why. but surely this is straightforward ;) | 17:54 |
| jimbaker | oslo.policy implements some subset of prolog. i'm just not sure what part :) | 17:55 |
| *** VW has quit IRC | 18:10 | |
| sigmavirus | jimbaker: found a bunch of typos in the spec while updating it with your copy-editing | 18:12 |
| jimbaker | cool, please make more awesome | 18:12 |
| jimbaker | also it looks it's available for review, i will take a look | 18:13 |
| *** valw has quit IRC | 18:18 | |
| *** VW has joined #craton | 18:19 | |
| *** valw has joined #craton | 18:21 | |
| *** harlowja_ has joined #craton | 18:31 | |
| *** harlowja has quit IRC | 18:31 | |
| *** VW has quit IRC | 18:42 | |
| *** VW has joined #craton | 18:43 | |
| *** valw has quit IRC | 18:54 | |
| *** valw has joined #craton | 18:56 | |
| *** valw has quit IRC | 19:07 | |
| *** valw has joined #craton | 19:12 | |
| *** rainya has quit IRC | 19:27 | |
| *** valw has quit IRC | 19:27 | |
| *** jovon has quit IRC | 19:50 | |
| *** valw has joined #craton | 20:01 | |
| *** jovon has joined #craton | 20:26 | |
| *** valw has quit IRC | 20:26 | |
| *** valw has joined #craton | 20:26 | |
| *** valw has quit IRC | 20:36 | |
| *** valw has joined #craton | 20:57 | |
| *** valw has quit IRC | 21:48 | |
| *** Mudpuppy_ has quit IRC | 21:52 | |
| *** jovon has quit IRC | 23:00 | |
| *** harlowja_ has quit IRC | 23:40 | |
| *** Mudpuppy_ has joined #craton | 23:40 | |
| *** harlowja has joined #craton | 23:41 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!