| *** rcernin_ has joined #openstack-keystone | 00:04 | |
| *** rcernin has quit IRC | 00:07 | |
| *** rcernin_ has quit IRC | 00:19 | |
| *** gyee has quit IRC | 00:24 | |
| *** rcernin has joined #openstack-keystone | 00:27 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:28 | |
| *** awalende has joined #openstack-keystone | 00:28 | |
| *** dave-mccowan has joined #openstack-keystone | 00:29 | |
| *** gshippey has quit IRC | 00:29 | |
| *** dave-mccowan has quit IRC | 00:33 | |
| *** awalende has quit IRC | 00:33 | |
| *** jamesmcarthur has quit IRC | 01:07 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:24 | |
| *** jamesmcarthur has quit IRC | 01:24 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:24 | |
| *** jamesmcarthur has quit IRC | 01:32 | |
| *** dmellado has quit IRC | 02:45 | |
| *** vesper11 has quit IRC | 02:45 | |
| *** tridde has joined #openstack-keystone | 02:45 | |
| *** trident has quit IRC | 02:46 | |
| *** vesper11 has joined #openstack-keystone | 02:46 | |
| *** dmellado has joined #openstack-keystone | 02:48 | |
| *** awalende has joined #openstack-keystone | 03:39 | |
| *** jamesmcarthur has joined #openstack-keystone | 03:40 | |
| *** awalende has quit IRC | 03:44 | |
| *** jamesmcarthur has quit IRC | 04:32 | |
| *** jamesmcarthur has joined #openstack-keystone | 06:01 | |
| *** Luzi has joined #openstack-keystone | 06:04 | |
| *** jamesmcarthur has quit IRC | 06:06 | |
| *** pawan-gupta has joined #openstack-keystone | 06:37 | |
| *** ayoung has quit IRC | 06:59 | |
| *** ayoung has joined #openstack-keystone | 06:59 | |
| *** dancn has joined #openstack-keystone | 07:08 | |
| *** pcaruana has joined #openstack-keystone | 07:39 | |
| *** rcernin has quit IRC | 07:54 | |
| *** tkajinam has quit IRC | 08:06 | |
| *** awalende has joined #openstack-keystone | 08:18 | |
| *** tesseract has joined #openstack-keystone | 08:27 | |
| *** amoralej|off is now known as amoralej | 08:32 | |
| *** vishakha has joined #openstack-keystone | 08:50 | |
| *** Luzi has quit IRC | 09:11 | |
| *** spsurya has joined #openstack-keystone | 09:25 | |
| *** Luzi has joined #openstack-keystone | 09:26 | |
| *** gshippey has joined #openstack-keystone | 10:01 | |
| *** pawan-gupta has quit IRC | 10:15 | |
| *** raildo has joined #openstack-keystone | 11:42 | |
| *** amoralej is now known as amoralej|lunch | 12:25 | |
| *** spsurya has quit IRC | 12:35 | |
| *** ayoung has quit IRC | 12:41 | |
| *** ayoung has joined #openstack-keystone | 12:42 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:15 | |
| *** jamesmcarthur has quit IRC | 13:28 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:30 | |
| *** jamesmcarthur has quit IRC | 13:34 | |
| *** amoralej|lunch is now known as amoralej | 13:44 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:46 | |
| *** tkajinam has joined #openstack-keystone | 14:01 | |
| *** awalende has quit IRC | 14:13 | |
| *** awalende has joined #openstack-keystone | 14:14 | |
| *** awalende has quit IRC | 14:14 | |
| *** awalende has joined #openstack-keystone | 14:14 | |
| *** Luzi has quit IRC | 14:29 | |
| *** pcaruana has quit IRC | 14:36 | |
| *** tkajinam has quit IRC | 14:52 | |
| *** lbragsta_ has joined #openstack-keystone | 15:00 | |
| *** pcaruana has joined #openstack-keystone | 15:01 | |
| *** jamesmcarthur has quit IRC | 15:03 | |
| *** jamesmcarthur has joined #openstack-keystone | 15:15 | |
| *** jamesmcarthur has quit IRC | 15:15 | |
| *** bnemec has quit IRC | 15:15 | |
| *** jamesmcarthur_ has joined #openstack-keystone | 15:15 | |
| *** lbragsta_ has quit IRC | 15:36 | |
| *** lbragsta_ has joined #openstack-keystone | 15:37 | |
| *** adriant has quit IRC | 15:40 | |
| cmurphy | team meeting in 20 minutes in #openstack-meeting-alt | 15:40 |
|---|---|---|
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone-specs master: Alembic Migrations Specification https://review.opendev.org/698279 | 15:46 |
| *** spatel has joined #openstack-keystone | 15:50 | |
| spatel | Hi | 15:51 |
| spatel | good morning, I want to assign network permission to one of specific user in project, how do i do that | 15:52 |
| spatel | I am trying to avoid edit policy file. | 15:52 |
| spatel | currently i doing this "openstack role add --project myproject --user spatel --user-domain myproject _member_" | 15:54 |
| *** lbragsta_ has quit IRC | 15:55 | |
| spatel | how do i tell user spatel can have _member_ + neutron | 15:56 |
| *** jmlowe has joined #openstack-keystone | 16:00 | |
| cmurphy | spatel: you need to create a new role and edit your policy files, there's no other way | 16:02 |
| spatel | policy file on neutron server? | 16:03 |
| gagehugo | spatel: yeah, the neutron policy | 16:04 |
| spatel | what is the path of policy file? | 16:05 |
| gagehugo | usually /etc/<service>/policy.yaml | 16:06 |
| spatel | gagehugo: no file found | 16:07 |
| spatel | ls -l /etc/neutron/policy.* | 16:07 |
| *** awalende has quit IRC | 16:08 | |
| *** awalende has joined #openstack-keystone | 16:08 | |
| gagehugo | it might be using default policy in-code then | 16:09 |
| gagehugo | otherwise the policy file can be located somewhere else, ususally the path is specified in the <service>.conf file | 16:10 |
| *** awalende has quit IRC | 16:13 | |
| *** dancn has quit IRC | 16:14 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Add name in GET API of application credentials https://review.opendev.org/696519 | 16:20 |
| cmurphy | neutron probably has policy-in-code if you're not on too old of a release, which means to change its policy you need to create the file | 16:20 |
| cmurphy | check https://docs.openstack.org/oslo.policy/latest/admin/policy-yaml-file.html for info on the policy file | 16:21 |
| *** pmatulis has joined #openstack-keystone | 16:22 | |
| pmatulis | why is it i do not see 'reader' in the output of 'openstack role list'? | 16:23 |
| pmatulis | i installed Train | 16:23 |
| gmann | cmurphy: lbragstad ^^ i can get reader in my train env(its devstack default env) but pmatulis cannot see. | 16:24 |
| lbragstad | pmatulis how did you install your deployment? | 16:26 |
| lbragstad | did your run keystone-manage bootstrap? | 16:26 |
| pmatulis | lbragstad, i installed via Juju charms. i've never heard of 'keystone-manage bootstrap' | 16:27 |
| lbragstad | pmatulis keystone-manage bootstrap is a commandline utility to bootstrap new deployesr | 16:27 |
| lbragstad | deployments* | 16:27 |
| lbragstad | it's also responsible for creating default roles, and building role implications | 16:27 |
| lbragstad | if you're missing a role, bootstrap probably wasn't run | 16:28 |
| pmatulis | ok, i guess i'll have to look at the keystone charm. it's odd that i do get some roles: 'Member' and 'Admin' and 'service' | 16:29 |
| lbragstad | pmatulis the keystone charm is probably responsible for that | 16:29 |
| spatel | gagehugo: how do i generate policy.yaml file? is there any utility? | 16:31 |
| spatel | cmurphy: how do i generate default policy file? | 16:37 |
| *** gyee has joined #openstack-keystone | 16:37 | |
| gagehugo | spatel: https://docs.openstack.org/oslo.policy/latest/cli/index.html#oslopolicy-sample-generator sorry took me a bit to find the command | 16:38 |
| gagehugo | a sample neutron policy file can be found here: https://docs.openstack.org/neutron/train/configuration/policy-sample.html <-- that's for train | 16:39 |
| pmatulis | fwiw, i have oslopolicy-config-generator but not oslopolicy-sample-generator | 16:42 |
| spatel | This command works for me "/openstack/venvs/neutron-19.0.6.dev13/bin/oslopolicy-sample-generator --namespace neutron" | 16:44 |
| *** awalende has joined #openstack-keystone | 16:45 | |
| spatel | so all i need to create /etc/neutron/policy.yaml and edit file as per my need right? | 16:45 |
| cmurphy | there should be no such thing as oslopolicy-config-generator https://opendev.org/openstack/oslo.policy/src/branch/master/setup.cfg#L39-L42 | 16:45 |
| cmurphy | spatel: yes you can copy the sample to /etc/neutron/policy.yaml and uncomment the policy you want to edit | 16:45 |
| cmurphy | spatel: you may need to change the policy_file config in /etc/neutron/neutron.conf to point to the .yaml file, it might default to looking for a .json file | 16:46 |
| spatel | all i need that my users can create neutron port and attach to instance. | 16:47 |
| spatel | cmurphy: i will create .json file if that is default extension | 16:47 |
| cmurphy | spatel: it would be better to use the .yaml, as the policy sample file has yaml comments | 16:48 |
| spatel | Ok | 16:48 |
| spatel | default policy for create port is -> "create_port": "", | 16:49 |
| spatel | look like empty "" | 16:49 |
| *** jmlowe has quit IRC | 16:50 | |
| *** awalende has quit IRC | 16:50 | |
| cmurphy | spatel: that means the default is anyone can do that action, so your user with the _member_ role should already have that permission | 16:50 |
| spatel | https://pastebin.com/wDHkM4T6 | 16:50 |
| *** jaosorior has joined #openstack-keystone | 16:50 | |
| spatel | Users getting error - https://pastebin.com/e10rPqD7 | 16:52 |
| spatel | I believe i need to adjust following two policy | 16:53 |
| -spatel- "create_port:binding:host_id": "rule:admin_only", | 16:53 | |
| -spatel- "create_port:binding:profile": "rule:admin_only", | 16:53 | |
| spatel | is it ok i can make them empty like "" ? | 16:54 |
| cmurphy | spatel: that would let any user perform those actions, is that what you want? | 16:55 |
| spatel | I think yes.. because everyone from my team. | 16:56 |
| spatel | what if i want to give permission to specific user or project? <-- just for my knowledge ? | 16:56 |
| cmurphy | spatel: you need to create a new role, change the policy string to have role:newrole, and you would also have to change other "" policy rules for other services to have "not role:newrole" it's a hassle :/ | 16:58 |
| *** tesseract has quit IRC | 16:58 | |
| spatel | cmurphy: totally get it now :) | 16:59 |
| spatel | cmurphy: do i need to reload any services after change in policy file? | 16:59 |
| cmurphy | spatel: i don't think so, it should be picked up automatically as long as your neutron.conf is already pointing to the right file | 17:00 |
| spatel | cmurphy: Thank you so much! | 17:00 |
| cmurphy | you're welcome | 17:01 |
| spatel | cmurphy: also i watched you youtube video about LDAP integration and its freaking awesome!! | 17:01 |
| cmurphy | spatel: that must be someone else, i don't think i've ever talked about ldap ;) | 17:02 |
| spatel | really, i believe it was use because in video they used cmurphy username :) let me search and see if i am right or wrong | 17:05 |
| cmurphy | might have been about federation :) | 17:06 |
| spatel | https://www.youtube.com/watch?v=fm1pVRIpjjo | 17:07 |
| spatel | what is this person> | 17:07 |
| cmurphy | oh yeah that's me, that's about app creds | 17:08 |
| spatel | sorry it wasn't about ldap but something which i was badly looking for. | 17:08 |
| cmurphy | :) | 17:08 |
| spatel | my app creds working great, but one problem. why i am not able to use nova client or any other client ? | 17:08 |
| spatel | with app creds only openstack --os-cloud style working | 17:09 |
| cmurphy | spatel: you should be able to use them with any client that uses keystoneauth | 17:09 |
| spatel | i was trying to load app creds in shell variable but that didn't work ( like source /root/openrc) | 17:10 |
| spatel | I download shell version and load in my linux bash variable but when i was trying to run command getting auth error | 17:10 |
| spatel | cmurphy: i believe keystone+ldap doesn't like that, i spent lots of hours to find out but no luck and then finally i end up using openstack --os-cloud way | 17:11 |
| spatel | may be its LDAP+keystone implementation bug, but anyway its not a big deal so no worry | 17:13 |
| cmurphy | there should be no difference, they both use keystoneauth so as long as you have the right parameters set it shouldn't matter if it's environment variables or clouds.yaml | 17:13 |
| spatel | cmurphy: i will give it a try again later sometime and will give you full report. | 17:14 |
| cmurphy | okay :) | 17:14 |
| *** pmatulis has left #openstack-keystone | 17:18 | |
| *** lbragstad_ has joined #openstack-keystone | 17:27 | |
| *** lbragstad has quit IRC | 17:30 | |
| openstackgerrit | Merged openstack/keystone master: Fix application credential doc example https://review.opendev.org/697367 | 17:42 |
| spatel | cmurphy: I don't have policy_file option in my /etc/neutron/neutron.conf so if i want to add one in which section i should be adding it? | 17:45 |
| cmurphy | spatel: [oslo_policy] | 17:46 |
| spatel | I don't have that section anywhere in neutron.conf file | 17:46 |
| cmurphy | spatel: you can add it | 17:46 |
| spatel | oh! got it :) | 17:47 |
| spatel | done -> policy_file = policy.yaml | 17:49 |
| spatel | what if there is a typo in policy file does that create issue or just load default policy? | 17:50 |
| *** jaosorior has quit IRC | 17:59 | |
| cmurphy | spatel: it depends on the typo, if it's bad yaml i think it will cause an error | 18:03 |
| spatel | yes any kind of typo, can i use any kind of tool to validate yaml syntax check | 18:04 |
| cmurphy | you can use any online tool to check that it's valid yaml, you can use https://docs.openstack.org/oslo.policy/latest/cli/index.html#oslopolicy-checker to try to validate your policies for different types of users | 18:09 |
| spatel | Thanks! | 18:11 |
| spatel | cmurphy: my policy file works :) hurray!!! | 18:25 |
| cmurphy | yay \o/ | 18:25 |
| spatel | cmurphy: you are life saver... | 18:25 |
| cmurphy | :) | 18:25 |
| *** jamesmcarthur_ has quit IRC | 18:26 | |
| *** jamesmcarthur has joined #openstack-keystone | 18:26 | |
| *** jamesmcarthur has quit IRC | 18:36 | |
| cmurphy | lbragstad_: could you review this stable backport https://review.opendev.org/676969 | 18:58 |
| *** amoralej is now known as amoralej|off | 19:07 | |
| *** ayoung has quit IRC | 19:08 | |
| *** ayoung has joined #openstack-keystone | 19:10 | |
| *** ayoung has quit IRC | 19:14 | |
| *** spatel has quit IRC | 19:16 | |
| *** ayoung has joined #openstack-keystone | 19:16 | |
| *** spatel has joined #openstack-keystone | 19:33 | |
| cmurphy | thanks lbragstad_ | 19:35 |
| *** lbragstad_ is now known as lbragstad | 19:36 | |
| lbragstad | cmurphy no problem | 19:36 |
| *** gmann is now known as gmann_afk | 19:40 | |
| openstackgerrit | Merged openstack/keystonemiddleware master: Update master for stable/train https://review.opendev.org/683462 | 19:48 |
| *** awalende has joined #openstack-keystone | 20:09 | |
| *** awalende has quit IRC | 20:14 | |
| *** rcernin has joined #openstack-keystone | 20:16 | |
| *** pcaruana has quit IRC | 20:16 | |
| *** jaosorior has joined #openstack-keystone | 21:05 | |
| *** adriant has joined #openstack-keystone | 21:26 | |
| *** raildo has quit IRC | 21:27 | |
| *** jaosorior has quit IRC | 22:01 | |
| *** spatel has quit IRC | 22:09 | |
| *** awalende has joined #openstack-keystone | 22:10 | |
| *** awalende has quit IRC | 22:15 | |
| *** awalende has joined #openstack-keystone | 22:30 | |
| *** awalende has quit IRC | 22:35 | |
| *** tkajinam has joined #openstack-keystone | 23:05 | |
| *** gmann_afk is now known as gmann | 23:06 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!