| *** imacdonn has quit IRC | 00:00 | |
| *** imacdonn has joined #openstack-glance | 00:00 | |
| *** itlinux has joined #openstack-glance | 00:10 | |
| *** Sravan has quit IRC | 00:16 | |
| *** Sravan has joined #openstack-glance | 00:21 | |
| *** Sravan has quit IRC | 00:22 | |
| *** Sravan has joined #openstack-glance | 00:26 | |
| *** Sravan has quit IRC | 00:29 | |
| *** Sravan has joined #openstack-glance | 00:31 | |
| *** edmondsw has quit IRC | 00:38 | |
| *** Sravan has quit IRC | 00:41 | |
| *** Sravan has joined #openstack-glance | 00:48 | |
| *** gyee has quit IRC | 00:51 | |
| *** Sravan has quit IRC | 00:53 | |
| *** Sravan has joined #openstack-glance | 00:54 | |
| *** Sravan has quit IRC | 00:54 | |
| *** markvoelker has joined #openstack-glance | 01:10 | |
| *** markvoelker has quit IRC | 01:15 | |
| *** _alastor_ has quit IRC | 01:38 | |
| *** rosmaita has left #openstack-glance | 02:00 | |
| *** _alastor_ has joined #openstack-glance | 02:39 | |
| *** _alastor_ has quit IRC | 02:44 | |
| *** nehaalhat has joined #openstack-glance | 03:21 | |
| *** Sravan has joined #openstack-glance | 03:35 | |
| *** udesale has joined #openstack-glance | 04:02 | |
| *** Sravan has quit IRC | 04:11 | |
| *** abhishekk has joined #openstack-glance | 04:22 | |
| *** nehaalhat has quit IRC | 04:25 | |
| *** nehaalhat has joined #openstack-glance | 04:38 | |
| *** itlinux has quit IRC | 04:41 | |
| *** Sravan has joined #openstack-glance | 04:42 | |
| *** Sravan has quit IRC | 04:42 | |
| *** Sravan has joined #openstack-glance | 04:43 | |
| *** abhishekk has quit IRC | 05:11 | |
| *** _alastor_ has joined #openstack-glance | 05:12 | |
| *** _alastor_ has quit IRC | 05:17 | |
| *** ratailor has joined #openstack-glance | 05:23 | |
| *** udesale has quit IRC | 05:29 | |
| *** nehaalhat has quit IRC | 05:39 | |
| *** udesale has joined #openstack-glance | 05:51 | |
| *** udesale has quit IRC | 05:59 | |
| *** udesale has joined #openstack-glance | 06:00 | |
| *** bhagyashris has joined #openstack-glance | 06:08 | |
| *** edmondsw has joined #openstack-glance | 06:19 | |
| *** markvoelker has joined #openstack-glance | 06:20 | |
| *** markvoelker has quit IRC | 06:24 | |
| *** Sravan has quit IRC | 06:45 | |
| *** mosulica has joined #openstack-glance | 06:51 | |
| *** belmoreira has quit IRC | 06:53 | |
| *** Luzi has joined #openstack-glance | 06:56 | |
| *** udesale has quit IRC | 07:10 | |
| *** udesale has joined #openstack-glance | 07:18 | |
| *** udesale has quit IRC | 07:22 | |
| *** udesale has joined #openstack-glance | 07:26 | |
| *** abhishekk has joined #openstack-glance | 07:27 | |
| *** awalende has joined #openstack-glance | 08:12 | |
| *** markvoelker has joined #openstack-glance | 08:20 | |
| *** tkajinam has quit IRC | 08:48 | |
| *** pcaruana has joined #openstack-glance | 08:51 | |
| *** priteau has joined #openstack-glance | 08:54 | |
| *** markvoelker has quit IRC | 08:54 | |
| *** mvkr has joined #openstack-glance | 09:33 | |
| *** bhagyashris has quit IRC | 09:39 | |
| *** markvoelker has joined #openstack-glance | 09:51 | |
| *** markvoelker has quit IRC | 10:24 | |
| *** abhishekk has quit IRC | 10:31 | |
| *** mvkr has quit IRC | 10:46 | |
| *** belmoreira has joined #openstack-glance | 10:55 | |
| *** mvkr has joined #openstack-glance | 11:03 | |
| *** udesale has quit IRC | 11:09 | |
| *** _alastor_ has joined #openstack-glance | 11:15 | |
| *** _alastor_ has quit IRC | 11:19 | |
| *** markvoelker has joined #openstack-glance | 11:21 | |
| *** markvoelker has quit IRC | 11:53 | |
| *** kukacz has quit IRC | 12:04 | |
| *** kukacz has joined #openstack-glance | 12:04 | |
| *** abhi89 has joined #openstack-glance | 12:26 | |
| jokke_ | jaypipes: iirc admin can change the owner of the image, owner or other normal users can't | 12:29 |
|---|---|---|
| jokke_ | jaypipes: so if the owner really needs to be changed, that should be the route | 12:30 |
| abhi89 | Hi All.. i have a doubt.. while creating image from api we don't mention any project-id, so looks like image is not associated with a project as such.. in the UI, image created in one project cannot be seen when we login via another project (both project have same compute & storage resources).. but we can deploy a vm in a project where this image doesn't exist using the image-id.. both of them kind of contradict.. | 12:30 |
| jokke_ | this is totally iirc 'though ... never had to do it | 12:30 |
| *** ratailor has quit IRC | 12:31 | |
| jokke_ | abhi89: did you create the image by any chance with visibility=community? | 12:31 |
| abhi89 | visibility of the image was set to private | 12:32 |
| abhi89 | jokke_: what is the expected behavior in this case? | 12:38 |
| *** pcaruana has quit IRC | 12:40 | |
| jokke_ | abhi89: Is it same user betwen two different projects? | 12:42 |
| jokke_ | between | 12:42 |
| jokke_ | as that's the only scenario where it should be accessible, I just have no idea why it's not listed | 12:45 |
| abhi89 | jokke_: its not the same user.. different user in different projects | 12:49 |
| *** pcaruana has joined #openstack-glance | 12:50 | |
| *** markvoelker has joined #openstack-glance | 12:50 | |
| *** mosulica has quit IRC | 12:59 | |
| *** mosulica has joined #openstack-glance | 13:03 | |
| *** priteau has quit IRC | 13:04 | |
| *** priteau has joined #openstack-glance | 13:04 | |
| *** priteau has quit IRC | 13:12 | |
| jokke_ | abhi89: and you have keystone auth setup and it's not admin user that can boot it? | 13:14 |
| *** mosulica has quit IRC | 13:15 | |
| abhi89 | jokke_: i have tried all this with admin user role for both users in different projects | 13:15 |
| jokke_ | ah yes, admin indeed has access to all images and image records | 13:16 |
| *** rosmaita has joined #openstack-glance | 13:17 | |
| *** mosulica has joined #openstack-glance | 13:18 | |
| abhi89 | jokke_: but he is the admin to just one project, not both of them.. one admin for one project | 13:18 |
| abhi89 | so technically admin of one project shouldn't be able to access images of another project.. isnt it? | 13:19 |
| *** markvoelker has quit IRC | 13:20 | |
| jokke_ | what version of openstack you're operating? There was a bug at some point where admin was treated as adming regardless | 13:22 |
| rosmaita | abhi89: when you say "admin of one project", do you mean "admin of glance vs. admin of cinder", or do you mean "admin of tenant 123456 vs admin of tenant 456789"? | 13:27 |
| abhi89 | our's is a customised IaaS product with openstack as base. here we have just one admin role (say for a project).. user with this admin role is an admin for all (glance, cinder ...) | 13:30 |
| abhi89 | jokke_: we are at queens | 13:30 |
| *** Sravan has joined #openstack-glance | 13:31 | |
| jokke_ | rosmaita: do you remember when that bug was where project(tenant) admin was treated as global admin? I think it was before queens | 13:32 |
| rosmaita | not sure that we ever had that bug ... it's been filed, but i think was always misconfiguration ... there's a setting in glance-api.conf that says what role glance will recognize as being an admin, this is in addition to whatever you have defining context_is_admin in the policy file ... maybe that's what's going on | 13:34 |
| jokke_ | rosmaita: ahh that might have been it | 13:35 |
| *** Sravan has quit IRC | 13:36 | |
| jokke_ | and might be it now as well, if the config is something like role:"admin" and the project admin role is also called "admin" | 13:36 |
| rosmaita | also, reading the scrollback, an image with null owner can be used by anyone ... doesn't show up in anyone's image-list, but anyone who knows the image_id can do an image-show on it or use it to boot a VM | 13:36 |
| rosmaita | abhi89: ^^ | 13:36 |
| rosmaita | i should clarify, that's with visibility==private | 13:37 |
| jokke_ | rosmaita: but it needs to be nulled intentionally, if you just don't specify it it will be owned by the creator | 13:37 |
| rosmaita | right | 13:37 |
| *** zul has quit IRC | 13:38 | |
| abhi89 | rosmaita, jokke_: do you by any chance remember that setting in glance-api.conf? | 13:40 |
| rosmaita | http://git.openstack.org/cgit/openstack/glance/tree/etc/glance-api.conf?h=stable/queens#n28 | 13:40 |
| rosmaita | cleverly named "admin_role" :) | 13:40 |
| rosmaita | jokke_: i think that pre-dates policy files ... we should probably deprecate that setting | 13:41 |
| jokke_ | yeah don't we have the admin-role thingie in policy.json as well? | 13:42 |
| abhi89 | we have admin role name as "admin" itslef.. | 13:44 |
| rosmaita | yes, and last time i looked at our context.py, it processes the policy file, and then last thing it does is see if the user has this role, and if so, makes is_admin true on the context ... so that person will be an admin even if the policy file rules them out, i think | 13:44 |
| abhi89 | "context_is_admin": "role:admin", -> this is our policy.json setting for admin role | 13:44 |
| rosmaita | abhi89: yes, so with the default setting, any user you give the role 'admin' to will be recognized by Glance as a *glance admin* | 13:44 |
| jokke_ | yup | 13:44 |
| jokke_ | indeed as serivce admin, not just project(tenant) admin | 13:45 |
| abhi89 | so if he is a glance admin, he can view images from all projects? | 13:46 |
| rosmaita | yep | 13:46 |
| jokke_ | yes | 13:46 |
| abhi89 | oh ok | 13:46 |
| jokke_ | and do lot more than just view | 13:46 |
| rosmaita | yeah, modify, delete, everything | 13:46 |
| abhi89 | ohk | 13:46 |
| jokke_ | like delete, change owner, reactivate deactivated images, overwrite almost any metadata etc. | 13:46 |
| rosmaita | abhi89: you might want to take a look at this, it's aimed at cinder, but it pretty much applies to glance too: https://review.openstack.org/#/c/624424/ | 13:46 |
| jokke_ | ok, need to run. back in few | 13:49 |
| abhi89 | rosmaita: thanks.. will go through the link.. we just want the admin to behave as an admin at the project level, not glance admin.. | 13:49 |
| rosmaita | one difference though is that glance still has a json policy file that sets the defaults ... but the explanation of what context_is_admin is still applies | 13:50 |
| abhi89 | jokke_: sure..thanks | 13:50 |
| rosmaita | abhi89: well, i think just a regular tenant is a project-level admin | 13:50 |
| rosmaita | a regular tenant can do all the normal stuff -- create, read, update, delete within their own project (tenant) | 13:51 |
| rosmaita | so what you need to do is to come up with some new roles if you want to restrict some users to say read-only within a project | 13:51 |
| rosmaita | and then adjust the policy file | 13:51 |
| rosmaita | when i say "regular tenant" i mean "a regular user within a tenant (project)" | 13:52 |
| rosmaita | (i really wish we had better vocabulary for this!) | 13:52 |
| abhi89 | rosmaita: thanks for the info.. will need sometime to digest all this & try out few things.. will get back tomorrow on this to share how it went.. | 13:53 |
| rosmaita | good luck! and it will definitely take a bit of time ... policy config is tricky and it is easy to get results different from what you expectg | 13:54 |
| rosmaita | i proposed a session on this at the Denver summit -- look for it at voting time! :) | 13:55 |
| abhi89 | rosmaita: sure :) | 13:56 |
| *** jdillaman has joined #openstack-glance | 14:02 | |
| *** udesale has joined #openstack-glance | 14:24 | |
| *** pcaruana has quit IRC | 14:45 | |
| *** pcaruana has joined #openstack-glance | 14:53 | |
| *** mosulica has quit IRC | 14:53 | |
| *** Luzi has quit IRC | 15:05 | |
| *** udesale has quit IRC | 15:18 | |
| *** awalende has quit IRC | 15:33 | |
| *** awalende has joined #openstack-glance | 15:33 | |
| *** awalende has quit IRC | 15:37 | |
| *** _alastor_ has joined #openstack-glance | 16:01 | |
| *** tstrul has joined #openstack-glance | 16:37 | |
| *** tstrul has quit IRC | 16:38 | |
| *** samc-bbc has joined #openstack-glance | 16:39 | |
| *** abhi89 has quit IRC | 16:40 | |
| *** mosulica has joined #openstack-glance | 16:53 | |
| *** pcaruana has quit IRC | 17:01 | |
| *** mosulica has quit IRC | 17:02 | |
| *** gyee has joined #openstack-glance | 17:03 | |
| *** Sravan has joined #openstack-glance | 17:53 | |
| *** Sravan has quit IRC | 17:59 | |
| *** Sravan has joined #openstack-glance | 18:17 | |
| *** Sravan has quit IRC | 18:27 | |
| *** Sravan has joined #openstack-glance | 18:28 | |
| *** Sravan has quit IRC | 18:30 | |
| *** Sravan has joined #openstack-glance | 18:30 | |
| *** Sravan has quit IRC | 18:32 | |
| *** mosulica has joined #openstack-glance | 18:33 | |
| *** mosulica has quit IRC | 18:38 | |
| *** awalende has joined #openstack-glance | 18:45 | |
| *** awalende has quit IRC | 18:49 | |
| *** Sravan has joined #openstack-glance | 18:50 | |
| *** mvkr has quit IRC | 19:06 | |
| *** Sravan has quit IRC | 19:12 | |
| *** Sravan has joined #openstack-glance | 19:14 | |
| *** Sravan has quit IRC | 19:28 | |
| *** Sravan has joined #openstack-glance | 19:29 | |
| *** cfriesen has joined #openstack-glance | 19:54 | |
| cfriesen | Hi all...just alerting people to the fact that https://review.openstack.org/#/c/633256 is available for review. Should be straightforward, just adding some new definitions for use in nova. | 20:01 |
| *** mriedem has joined #openstack-glance | 20:03 | |
| rosmaita | cfriesen: you might want to hit the rebase button on it and let it run through zuul check again, people tend to ignore stuff until zuul gives +1 | 20:06 |
| cfriesen | can do | 20:06 |
| rosmaita | cfriesen: and you raised all the right questions on that patch | 20:06 |
| *** Sravan has quit IRC | 20:07 | |
| *** openstackgerrit has joined #openstack-glance | 20:07 | |
| openstackgerrit | Chris Friesen proposed openstack/glance master: Add flavor options to select emulated virtual tpm https://review.openstack.org/633256 | 20:07 |
| *** mriedem has left #openstack-glance | 20:10 | |
| *** Sravan has joined #openstack-glance | 20:31 | |
| *** Sravan has quit IRC | 20:36 | |
| *** Sravan has joined #openstack-glance | 20:41 | |
| *** Sravan has quit IRC | 20:46 | |
| *** Sravan has joined #openstack-glance | 21:20 | |
| *** Sravan has quit IRC | 21:25 | |
| *** Sravan has joined #openstack-glance | 21:55 | |
| *** Sravan has quit IRC | 21:58 | |
| *** Sravan has joined #openstack-glance | 21:58 | |
| *** Sravan has quit IRC | 22:08 | |
| *** Sravan has joined #openstack-glance | 22:16 | |
| *** Sravan has quit IRC | 22:18 | |
| *** Sravan has joined #openstack-glance | 22:21 | |
| *** jdillaman has quit IRC | 22:32 | |
| *** Sravan has quit IRC | 22:33 | |
| *** Sravan has joined #openstack-glance | 22:33 | |
| *** gyee has quit IRC | 22:35 | |
| *** Sravan has quit IRC | 22:38 | |
| *** Sravan has joined #openstack-glance | 22:47 | |
| *** MattMan has quit IRC | 22:51 | |
| *** Sravan has quit IRC | 22:51 | |
| *** MattMan has joined #openstack-glance | 22:51 | |
| *** Sravan has joined #openstack-glance | 22:53 | |
| *** tkajinam has joined #openstack-glance | 22:55 | |
| -openstackstatus- NOTICE: http://zuul.openstack.org is not working. https://zuul.openstack.org does work. Please use that while we investigate. | 23:13 | |
| *** Sravan has quit IRC | 23:16 | |
| *** Sravan has joined #openstack-glance | 23:16 | |
| *** Sravan has quit IRC | 23:19 | |
| *** Sravan has joined #openstack-glance | 23:20 | |
| *** Sravan has quit IRC | 23:35 | |
| *** Sravan has joined #openstack-glance | 23:39 | |
| *** rcernin has quit IRC | 23:53 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!