| *** markvoelker has quit IRC | 00:07 | |
| *** markvoelker has joined #openstack-keystone | 00:07 | |
| *** markvoelker has quit IRC | 00:12 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add user_id, external_id to access rules table https://review.opendev.org/663440 | 00:43 |
|---|---|---|
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add manager support for app cred access rules https://review.opendev.org/663462 | 00:43 |
| *** rcernin has joined #openstack-keystone | 00:45 | |
| *** rcernin has quit IRC | 00:45 | |
| *** rcernin has joined #openstack-keystone | 00:45 | |
| *** lbragstad has quit IRC | 00:58 | |
| *** spsurya has joined #openstack-keystone | 01:01 | |
| *** rcernin has quit IRC | 01:21 | |
| *** rcernin has joined #openstack-keystone | 01:21 | |
| *** itlinux has joined #openstack-keystone | 01:25 | |
| *** ayoung has quit IRC | 01:30 | |
| *** dave-mccowan has joined #openstack-keystone | 01:32 | |
| *** whoami-rajat has joined #openstack-keystone | 02:07 | |
| *** markvoelker has joined #openstack-keystone | 02:08 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:41 | |
| *** markvoelker has quit IRC | 02:42 | |
| *** jamesmcarthur has quit IRC | 03:08 | |
| *** shyamb has joined #openstack-keystone | 03:29 | |
| *** dave-mccowan has quit IRC | 03:50 | |
| *** shyamb has quit IRC | 04:29 | |
| *** schaney__ has quit IRC | 04:46 | |
| *** shyamb has joined #openstack-keystone | 04:47 | |
| *** pcaruana has joined #openstack-keystone | 04:50 | |
| *** tkajinam has quit IRC | 05:00 | |
| *** shyamb has quit IRC | 05:25 | |
| *** shyamb has joined #openstack-keystone | 05:28 | |
| *** shyamb has quit IRC | 05:55 | |
| *** shyamb has joined #openstack-keystone | 05:57 | |
| *** markvoelker has joined #openstack-keystone | 05:58 | |
| *** tkajinam has joined #openstack-keystone | 06:00 | |
| *** markvoelker has quit IRC | 06:02 | |
| *** xek has joined #openstack-keystone | 06:16 | |
| *** dklyle has quit IRC | 06:38 | |
| *** dklyle has joined #openstack-keystone | 06:38 | |
| *** shyamb has quit IRC | 06:46 | |
| *** shyamb has joined #openstack-keystone | 07:00 | |
| *** gyee has quit IRC | 07:04 | |
| *** tesseract has joined #openstack-keystone | 07:12 | |
| *** rcernin has quit IRC | 07:14 | |
| *** shyamb has quit IRC | 07:47 | |
| *** markvoelker has joined #openstack-keystone | 07:58 | |
| *** markvoelker has quit IRC | 08:32 | |
| *** shyamb has joined #openstack-keystone | 08:32 | |
| *** tkajinam has quit IRC | 09:01 | |
| *** jistr is now known as jistr|lnl | 09:28 | |
| *** markvoelker has joined #openstack-keystone | 09:29 | |
| *** shyamb has quit IRC | 09:34 | |
| *** shyamb has joined #openstack-keystone | 09:48 | |
| *** shyamb has quit IRC | 09:58 | |
| *** markvoelker has quit IRC | 10:03 | |
| *** shyamb has joined #openstack-keystone | 10:28 | |
| *** vishalmanchanda has joined #openstack-keystone | 10:28 | |
| *** markvoelker has joined #openstack-keystone | 10:59 | |
| *** takamatsu has quit IRC | 11:01 | |
| *** takamatsu has joined #openstack-keystone | 11:02 | |
| *** jistr|lnl is now known as jistr | 11:18 | |
| *** markvoelker has quit IRC | 11:32 | |
| *** raildo has joined #openstack-keystone | 11:36 | |
| *** shyamb has quit IRC | 11:40 | |
| *** shyamb has joined #openstack-keystone | 11:41 | |
| *** lbragstad has joined #openstack-keystone | 12:16 | |
| *** trident has quit IRC | 12:21 | |
| *** trident has joined #openstack-keystone | 12:26 | |
| *** markvoelker has joined #openstack-keystone | 12:29 | |
| *** dave-mccowan has joined #openstack-keystone | 12:29 | |
| *** Emine has joined #openstack-keystone | 12:32 | |
| *** pcaruana has quit IRC | 12:52 | |
| *** markvoelker has quit IRC | 13:03 | |
| *** shyamb has quit IRC | 13:06 | |
| *** bnemec has joined #openstack-keystone | 13:11 | |
| *** shyamb has joined #openstack-keystone | 13:16 | |
| *** vishalmanchanda has quit IRC | 13:28 | |
| *** mloza has joined #openstack-keystone | 13:29 | |
| *** whoami-rajat has quit IRC | 13:47 | |
| *** jaosorior has joined #openstack-keystone | 13:47 | |
| knikolla | o/ | 13:49 |
| *** jaosorior has quit IRC | 13:51 | |
| lbragstad | o/ | 13:55 |
| *** whoami-rajat has joined #openstack-keystone | 13:57 | |
| *** markvoelker has joined #openstack-keystone | 13:59 | |
| *** jamesmcarthur has joined #openstack-keystone | 14:05 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Report correct domain in federated user token https://review.opendev.org/653068 | 14:13 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Deprecate [federation] federated_domain_name https://review.opendev.org/651614 | 14:16 |
| *** shyamb has quit IRC | 14:18 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Deprecate [federation] federated_domain_name https://review.opendev.org/651614 | 14:21 |
| *** markvoelker has quit IRC | 14:33 | |
| *** jaosorior has joined #openstack-keystone | 14:37 | |
| *** jaosorior has quit IRC | 14:39 | |
| *** jaosorior has joined #openstack-keystone | 14:41 | |
| *** xek_ has joined #openstack-keystone | 14:42 | |
| *** xek has quit IRC | 14:43 | |
| cmurphy | o/ | 14:49 |
| gagehugo | o/ | 14:54 |
| *** jaosorior has quit IRC | 14:55 | |
| *** jaosorior has joined #openstack-keystone | 14:57 | |
| *** gyee has joined #openstack-keystone | 15:16 | |
| *** notq has joined #openstack-keystone | 15:24 | |
| *** markvoelker has joined #openstack-keystone | 15:29 | |
| *** aloga has quit IRC | 15:32 | |
| *** aloga has joined #openstack-keystone | 15:34 | |
| notq | I think I placed this bug in the wrong place, https://bugs.launchpad.net/keystonemiddleware/+bug/1831791 - I think it's actually in keystone, I think it's missing the auditing for ec2 credentials. I don't look at keystone much, if someone has a second to look at it. I'm trying to dig through it and figure out where it should go. | 15:38 |
| openstack | Launchpad bug 1831791 in keystonemiddleware "openstack ec2 credentials not audited" [Undecided,New] | 15:39 |
| notq | contrib/ec2/controllers seems right. | 15:43 |
| kmalloc | lbragstad: I can do that today | 15:43 |
| notq | so then it's figuring out the correct syntax/details for each piece. ok | 15:43 |
| kmalloc | Re the testing. | 15:43 |
| lbragstad | kmalloc ok | 15:44 |
| kmalloc | Not traveling, just chilling inside in NYC | 15:44 |
| kmalloc | Erm... Upstate NY | 15:44 |
| kmalloc | NYC is like 5 hrs South of me :P | 15:44 |
| lbragstad | nice | 15:48 |
| lbragstad | feel free to push changes to that patch i have | 15:48 |
| lbragstad | i don't have anything locally that i currently working on | 15:48 |
| lbragstad | for that patch anyway | 15:49 |
| *** jaosorior has quit IRC | 15:50 | |
| *** markvoelker has quit IRC | 16:02 | |
| *** tesseract has quit IRC | 16:03 | |
| kmalloc | yeah it's some work to be done. | 16:03 |
| kmalloc | i think i can re-do the key repository | 16:03 |
| kmalloc | ugh... looks like my laptop is trying to give up the ghost...... | 16:04 |
| kmalloc | battery is dying :( | 16:04 |
| gagehugo | the x1? | 16:04 |
| kmalloc | yeah | 16:04 |
| kmalloc | it's the low end x1c6 though | 16:04 |
| kmalloc | (corp. issued) | 16:04 |
| gagehugo | :/ | 16:04 |
| kmalloc | i've found that the lower end machines don't do as well. | 16:05 |
| kmalloc | also this is the latest firmware. | 16:05 |
| notq | made the bug, wasn't sure if it was a security issue or not. It is for us, because it's untracked auditing tokens, but perhaps not in regards to keystone in general https://bugs.launchpad.net/keystonemiddleware/+bug/1831791 | 16:05 |
| openstack | Launchpad bug 1831791 in keystonemiddleware "openstack ec2 credentials not audited" [Undecided,New] | 16:05 |
| kmalloc | notq: thanks | 16:05 |
| kmalloc | notq: appreciate reporting it. it's on the edge if it's a security issue | 16:05 |
| kmalloc | but it's not a CVE. | 16:05 |
| kmalloc | or anything like that. | 16:05 |
| gagehugo | yeah | 16:06 |
| notq | makes sense. I'm going to keep trying to make sense of it for another hour to try and fix. I just don't work on keystone or python much so it's a bit of a challenge. | 16:06 |
| kmalloc | i would probably just classify it as a case we could improve security (VMT classification D, https://security.openstack.org/vmt-process.html#incident-report-taxonomy) | 16:06 |
| kmalloc | notq: well, we really appreciate the work you're putting in :) | 16:07 |
| notq | so i'll update it as a security issue? like i said, it absolutely is for us. | 16:07 |
| *** whoami-rajat has quit IRC | 16:07 | |
| notq | but I don't know how much people rely on the auditing as a core security aspect. | 16:07 |
| gagehugo | notq: we do | 16:07 |
| gagehugo | auditing is something we rely on quite a bit | 16:08 |
| kmalloc | notq: you're welcome to, don't mark it private | 16:08 |
| kmalloc | notq: like i said, it is at most a class-D | 16:08 |
| kmalloc | notq: and if you can't get it fixed i'm sure we can help (though it may be a bit slow for us to generate the code) | 16:09 |
| kmalloc | hey gagehugo, sending you a DM. need to ask you a couple questions | 16:09 |
| gagehugo | uh oh | 16:09 |
| notq | I see what the code looks like for other pieces, I see theoretically where it should go, but the fact it's contrib and a different structure makes it a bit more difficult than copy paste edit | 16:10 |
| notq | and i pasted the wrong bug, it's here https://bugs.launchpad.net/keystone/+bug/1831918 - setting to close the previous one in the wrong area | 16:12 |
| openstack | Launchpad bug 1831918 in OpenStack Identity (keystone) "ec2 credentials do not create audit notifications" [Undecided,New] | 16:12 |
| *** whoami-rajat has joined #openstack-keystone | 16:12 | |
| gagehugo | notq: marked the ksm one as invalid and left a link to the keystone one | 16:27 |
| notq | gagehugo++ | 16:27 |
| kmalloc | notq: as a point the ec2 token management is super wonky compared to the rest of the keystone subsystems | 16:28 |
| notq | still untangling this, it seems different pieces use different ways to the notifications. there's a simple way, used by most of them. But I'm trying to understand how credentials does it, since it works and ec2 doesn't, and I'm still searching. | 16:28 |
| kmalloc | it has not received the love that much of the rest of keystone has, so i am not surprised it is missing something like this | 16:28 |
| kmalloc | notq: it also isnt' really the same as credentials. we just happen to store the ec2 bits in the credentials backend | 16:29 |
| notq | good times... you can imagine my difficulty right now :) | 16:29 |
| kmalloc | yup. i totally get it :) | 16:29 |
| *** xek_ has quit IRC | 16:45 | |
| *** Emine has quit IRC | 16:50 | |
| *** markvoelker has joined #openstack-keystone | 16:59 | |
| kmalloc | lbragstad, cmurphy: ok, I should have a couple patches up soon for the resource option changes. I think this is looking good. | 17:27 |
| cmurphy | kmalloc: sweet | 17:27 |
| kmalloc | lbragstad, cmurphy: I'm going to setup an enum-like block (frozenset) for the allowed resources to use the various options. | 17:28 |
| kmalloc | so that we can reuse something like "immutable" across all resources we want. | 17:28 |
| kmalloc | and not need a different definition for user vs group vs role | 17:28 |
| kmalloc | obviously the API will still need the code to support the option, but this will help us DRY as much as possible | 17:29 |
| kmalloc | and each resource will just define which thing it is for purposes of storing the data | 17:30 |
| * kmalloc has a better idea even than that, but will try it in code to make sure it's not "too clever" | 17:30 | |
| *** markvoelker has quit IRC | 17:32 | |
| *** jamesmcarthur has quit IRC | 17:33 | |
| *** spsurya has quit IRC | 17:40 | |
| cmurphy | what was the retrospective tool we used at the last denver ptg? | 18:14 |
| cmurphy | the keystone trello team is about to hit the limit on free boards since the new change to trello's ToS | 18:15 |
| cmurphy | by last denver ptg i mean the last stapleton one | 18:15 |
| cmurphy | hrybacki: ^ | 18:16 |
| cmurphy | actually probably easiest to just use etherpad | 18:17 |
| kmalloc | just capture an image of the old trello boards and nuke them? | 18:19 |
| cmurphy | that doesn't capture comments, checklists, attachments, relationships | 18:21 |
| kmalloc | it might be worth capturing that metadata, it's not needed to keep the fully interactive forms. i'm seeing if trello has a nice "oh you're an open source project, we'll give you some freebies" thing before we move to another tool. | 18:22 |
| kmalloc | cmurphy: another option is one of the FOSS ones. mnaser has been awesome and granted me some credit, i could stand up the board on vexxhost and then we can use that until we settle on another tool we like. | 18:23 |
| kmalloc | like tiaga or kanboard | 18:24 |
| kmalloc | cmurphy: also tiaga is free for public boards. (hosted) if we don't want our own. | 18:25 |
| cmurphy | for this particular case i'm inclined to just use etherpad, for ongoing planning i'll investigate those other options | 18:26 |
| kmalloc | wfm. i'm checking out tiaga (https://tree.taiga.io/) now will report back my findings. but it seems nice at first glance | 18:26 |
| cmurphy | awesome | 18:26 |
| cmurphy | is it open source? | 18:26 |
| kmalloc | yup | 18:27 |
| cmurphy | woot | 18:27 |
| kmalloc | also... you can import directly from trello | 18:27 |
| cmurphy | A+ | 18:27 |
| cmurphy | nice | 18:27 |
| kmalloc | exactly | 18:27 |
| cmurphy | they anticipated us having this exact scenario | 18:27 |
| kmalloc | just doing a test importing the keystone queens retro to see how it works. | 18:27 |
| *** mvkr has quit IRC | 18:28 | |
| kmalloc | annnnd it can do auto-invite of users of the trello board | 18:28 |
| kmalloc | which is badass. | 18:28 |
| *** markvoelker has joined #openstack-keystone | 18:29 | |
| kmalloc | only downside is taiga is AGPL... but since it's stand-alone, (django+python+angular) whocares | 18:30 |
| kmalloc | looks really good, seeing if there are limits on the public board side, if not, woo, even better | 18:31 |
| hrybacki | cmurphy: that tool is no longer in existence unfortunately :( | 18:34 |
| kmalloc | cmurphy: looks like taiga is no limits on boards if they are public (hosted). and we can totally run our own if we want | 18:34 |
| kmalloc | so the biggest downside it looks like for the hosted taiga is webSSO is only github or gitlab | 18:37 |
| kmalloc | (i know... worst downside ever) | 18:37 |
| kmalloc | and it mostly looks like it works just like trello. | 18:37 |
| kmalloc | and has some nice additional bits that wont matter for us | 18:37 |
| kmalloc | we could probably use it for this retro and even convert train workboard over to it | 18:38 |
| kmalloc | if you'd like etherpad though, we can explore this after this retro | 18:39 |
| cmurphy | websso over github is a slight downer :/ | 18:42 |
| cmurphy | i think etherpad will work fine for now, we don't really need a lot of advanced functionality imo | 18:42 |
| kmalloc | you can use a discreet password | 18:44 |
| kmalloc | just the only WebSSO options are github and gitlab | 18:44 |
| kmalloc | s/discreet password/local account | 18:44 |
| cmurphy | oh got it | 18:45 |
| cmurphy | that's fine then | 18:45 |
| kmalloc | :) yeah | 18:46 |
| kmalloc | i just like my google SSO because i haven't bothered to get something better that works as well for everything | 18:46 |
| notq | going to give up for today, will try some more tomorrow. maybe trying to just add the notifications and send audit in the ec2 controller and see if it works. Trying to untangle it isn't working for me, so I can just try it and see if anything works there. Need to setup a dev environment as well. I thought this would end up easier ;) | 18:49 |
| kmalloc | notq: what version of openstack are you running. I ask because a number of things changed (flask framework) in more recente releases | 18:52 |
| kmalloc | notq: it might be easier under flask to get those notifications. I can commit to taking a closer look once I'm back home. | 18:52 |
| kmalloc | notq: just to help give you some direction. | 18:53 |
| notq | rocky is the current one I'm working against. | 18:53 |
| notq | our custom sapcc build, but it looks mostly the same afaik | 18:54 |
| * kmalloc nods | 18:56 | |
| kmalloc | yeah rocky is all flask, so that makes me less worried about old code vs new | 18:56 |
| kmalloc | or.. wait.. | 18:56 |
| *** jamesmcarthur has joined #openstack-keystone | 18:56 | |
| kmalloc | maybe stien was all flask. and rocky was 1st parts. | 18:56 |
| * kmalloc checks | 18:56 | |
| notq | to be fair, I just don't work inside keystone, or with openstack much. I work on a golang service for querying and handling audit events, so I only have a real light touch against the openstack code. | 18:57 |
| kmalloc | ah no, stein was where we ported to flask for the rest of the tuff | 18:57 |
| kmalloc | stuff* | 18:57 |
| kmalloc | this might be a hard thing for upstream to backport to rocky. | 18:58 |
| notq | I did notice it looks like some stein prep was done in parts, but not done for ec2 yet. Seemed odd, but more tangles I didn't need to focus on | 18:58 |
| kmalloc | because we'd need to do the change (possibly) in a totally different way for master and stein. | 18:58 |
| kmalloc | like i said, i'll be able to help give some more direction next week | 18:58 |
| notq | we aggressively upgrade, so perhaps stein would be a reasonable solution | 18:58 |
| kmalloc | stien with some code change to ensure we have the notifications going out* | 18:59 |
| kmalloc | :) | 18:59 |
| notq | Sure. I'll be around, and I appreciate it. I will still likely spend some more time on it just to see, it's a real hole to not have it for us, but the time it may take for me to sort it out may not justify the benefit :) | 18:59 |
| kmalloc | but that would be easier backport from master | 18:59 |
| notq | will also drag in our actual keystone guy, but ec2 cred seems like it's own beast. | 19:00 |
| *** markvoelker has quit IRC | 19:02 | |
| kmalloc | ec2 cred is it's own beast ;) | 19:05 |
| *** jamesmcarthur has quit IRC | 19:12 | |
| kmalloc | notq: are you looking to capture when keystone tokens are used to auth or when ec2 tokens are created (or both)? | 19:13 |
| *** jamesmcarthur has joined #openstack-keystone | 19:14 | |
| notq | just creation/deletion | 19:18 |
| notq | i see how to make a notifications message similar to other services, but i couldn't sort out how normal credentials do it. I was trying to see if I could follow the trail to enable them for ec2 as well, or if it would make sense just attaching it's own notifications. Then I was just shaving yaks. So I thought tomorrow, try just attaching it's own notifications to it, and see if that just works. | 19:21 |
| *** bnemec has quit IRC | 19:23 | |
| kmalloc | ah | 19:23 |
| kmalloc | that is a lot easier than i was looking at | 19:23 |
| notq | yeah, i tried to tackle the complex ball of stuff. i've now given up, and will see if i can't just import notifications, and make a call to them. It's the weak, likely "incorrect" way out, but it is going to be faster if it works than understanding all of this | 19:24 |
| kmalloc | i might have some quick guidance for you... if opendev will load (holy crap the internet at my inlaws is ... inconsistent) | 19:24 |
| *** d34dh0r53 has quit IRC | 19:25 | |
| *** cloudnull has quit IRC | 19:25 | |
| *** bnemec has joined #openstack-keystone | 19:25 | |
| *** cloudnull has joined #openstack-keystone | 19:30 | |
| *** bnemec has quit IRC | 19:31 | |
| *** d34dh0r53 has joined #openstack-keystone | 19:31 | |
| *** bnemec has joined #openstack-keystone | 19:34 | |
| *** bnemec has quit IRC | 19:41 | |
| *** bnemec has joined #openstack-keystone | 19:42 | |
| *** imacdonn has quit IRC | 19:53 | |
| *** imacdonn has joined #openstack-keystone | 19:54 | |
| *** jamesmcarthur has quit IRC | 19:55 | |
| *** jamesmcarthur has joined #openstack-keystone | 19:56 | |
| *** markvoelker has joined #openstack-keystone | 19:59 | |
| kmalloc | notq: i'll follow up with you later. but def have some ideas that should be quick/easy | 20:11 |
| notq | sweet malloc++ | 20:12 |
| notq | kmalloc: just heard we are working on the stein upgrade now | 20:13 |
| *** bnemec has quit IRC | 20:16 | |
| *** bnemec has joined #openstack-keystone | 20:17 | |
| *** jamesmcarthur has quit IRC | 20:24 | |
| *** jamesmcarthur has joined #openstack-keystone | 20:27 | |
| *** jamesmcarthur_ has joined #openstack-keystone | 20:29 | |
| *** jamesmcarthur has quit IRC | 20:31 | |
| *** markvoelker has quit IRC | 20:32 | |
| *** raildo has quit IRC | 20:58 | |
| *** jamesmcarthur_ has quit IRC | 21:03 | |
| *** jamesmcarthur has joined #openstack-keystone | 21:05 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Exclude constants from autodoc https://review.opendev.org/663373 | 21:10 |
| cmurphy | i think that's gonna work ^ | 21:11 |
| *** jamesmcarthur_ has joined #openstack-keystone | 21:16 | |
| *** jamesmcarthur has quit IRC | 21:18 | |
| *** whoami-rajat has quit IRC | 21:27 | |
| *** markvoelker has joined #openstack-keystone | 21:29 | |
| *** jamesmcarthur_ has quit IRC | 21:36 | |
| *** jamesmcarthur has joined #openstack-keystone | 21:37 | |
| *** jamesmcarthur has quit IRC | 21:46 | |
| *** cloudnull has quit IRC | 22:00 | |
| *** d34dh0r53 has quit IRC | 22:01 | |
| *** markvoelker has quit IRC | 22:03 | |
| *** rcernin has joined #openstack-keystone | 22:23 | |
| *** rcernin has quit IRC | 22:23 | |
| *** rcernin has joined #openstack-keystone | 22:24 | |
| *** notq has quit IRC | 22:26 | |
| *** rcernin has quit IRC | 22:26 | |
| *** cloudnull has joined #openstack-keystone | 22:27 | |
| *** rcernin has joined #openstack-keystone | 22:28 | |
| *** d34dh0r53 has joined #openstack-keystone | 22:28 | |
| *** tkajinam has joined #openstack-keystone | 22:53 | |
| *** markvoelker has joined #openstack-keystone | 22:59 | |
| *** jamesmcarthur has joined #openstack-keystone | 23:13 | |
| *** jamesmcarthur has quit IRC | 23:16 | |
| *** jamesmcarthur has joined #openstack-keystone | 23:17 | |
| *** markvoelker has quit IRC | 23:31 | |
| *** jamesmcarthur has quit IRC | 23:42 | |
| *** jamesmcarthur has joined #openstack-keystone | 23:45 | |
| *** rcernin has quit IRC | 23:55 | |
| *** rcernin has joined #openstack-keystone | 23:56 | |
| *** jamesmcarthur has quit IRC | 23:57 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!