| opendevreview | Yonggen Sun proposed openstack/keystone-tempest-plugin master: OAuth 2.0 Mutual-TLS Support https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/875792 | 06:13 |
|---|---|---|
| opendevreview | Yonggen Sun proposed openstack/keystone-tempest-plugin master: OAuth 2.0 Mutual-TLS Support https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/875792 | 06:24 |
| opendevreview | OpenStack Release Bot proposed openstack/keystone master: Update master for stable/2023.1 https://review.opendev.org/c/openstack/keystone/+/876723 | 11:54 |
| coreycb | hi keystone folks, it seems that keystone has a hard dependency on cryptography 38.0.2 (or at least on a new rust-based cryptography) since the "OAuth 2.0 Mutual-TLS Support" patch landed. is that expected? | 12:47 |
| coreycb | I ask because we have python3-cryptograph 3.4.8 in ubuntu jammy and would prefer not to have to backport 38.0.2 to the ubuntu cloud archive because that would also require loads of risky rust backports. | 12:50 |
| coreycb | I filed a bug, hopefully someone can weigh in. thank you. https://bugs.launchpad.net/keystone/+bug/2009600 | 13:43 |
| coreycb | hiromu: thoughts on that? ^ | 13:51 |
| coreycb | maybe I can just patch out the use of the attr_name_override parameter on the backport | 14:06 |
| *** blarnath is now known as d34dh0r53 | 14:58 | |
| d34dh0r53 | #startmeeting keystone | 15:00 |
| opendevmeet | Meeting started Tue Mar 7 15:00:25 2023 UTC and is due to finish in 60 minutes. The chair is d34dh0r53. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:00 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:00 |
| opendevmeet | The meeting name has been set to 'keystone' | 15:00 |
| d34dh0r53 | #topic roll-call | 15:00 |
| d34dh0r53 | admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, knikolla[m], lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek, gmann, zaitcev, arequate, dmendiza[m] | 15:00 |
| xek | o/ | 15:00 |
| hiromu | o/ | 15:00 |
| zaitcev | o/ | 15:00 |
| dmendiza[m] | 🙋♂️ | 15:01 |
| knikolla[m] | o/ | 15:02 |
| d34dh0r53 | hi folks, thanks for joining :) | 15:02 |
| d34dh0r53 | #topic review past meeting work items | 15:03 |
| d34dh0r53 | d34dh0r53 look into the keystone-groups members as well https://review.opendev.org/admin/groups/d7203dc55fa9bdf98c578b16ac398e0c754a1a67,members not sure if it's used any more | 15:03 |
| d34dh0r53 | I didn't get a chance to look at this yet again | 15:03 |
| d34dh0r53 | :/ | 15:03 |
| d34dh0r53 | #action d34dh0r53 look into the keystone-groups members as well https://review.opendev.org/admin/groups/d7203dc55fa9bdf98c578b16ac398e0c754a1a67,members not sure if it's used any more | 15:03 |
| dmendiza[m] | d34dh0r53: we could check the project-config repo to see what gerrit groups are still in use | 15:03 |
| d34dh0r53 | that's all for the past meeting work items | 15:03 |
| d34dh0r53 | dmendiza[m]: ack | 15:04 |
| d34dh0r53 | good idea | 15:04 |
| d34dh0r53 | dmendiza[m]: I might reach out to you for help on that this week | 15:04 |
| dmendiza[m] | Sure, just ping me whenever | 15:05 |
| d34dh0r53 | thanks | 15:05 |
| d34dh0r53 | #topic liaison updates | 15:05 |
| d34dh0r53 | nothing from VMT | 15:05 |
| d34dh0r53 | knikolla[m], dmendiza[m], xek I added our highlights this morning, https://review.opendev.org/c/openstack/releases/+/876729 | 15:06 |
| d34dh0r53 | let me know if I missed anything or if they need to be reworded | 15:07 |
| dmendiza[m] | Nice | 15:07 |
| d34dh0r53 | that's it for liaison updates | 15:07 |
| d34dh0r53 | #topic specification OAuth 2.0 (hiromu) | 15:08 |
| d34dh0r53 | External OAuth 2.0 Specification | 15:08 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone-specs/+/861554 | 15:08 |
| d34dh0r53 | OAuth 2.0 Implementation | 15:08 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:bp%252Fsupport-oauth2-mtls | 15:08 |
| d34dh0r53 | OAuth 2.0 Documentation | 15:08 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone/+/838108 | 15:08 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystoneauth/+/838104 | 15:08 |
| d34dh0r53 | we're very close to merging everything | 15:09 |
| hiromu | Thanks a lot! I just submitted backport patches for keystoneauth and keystonemiddleware. | 15:09 |
| d34dh0r53 | excellent! thanks hiromu | 15:09 |
| hiromu | https://review.opendev.org/c/openstack/keystoneauth/+/876746 | 15:09 |
| hiromu | https://review.opendev.org/c/openstack/keystonemiddleware/+/876745 | 15:09 |
| hiromu | Keystone's master branch already includes the mTLS patch. | 15:10 |
| hiromu | So I didn't submit a backport patch to Keystone. | 15:10 |
| coreycb | o/ ohh is this a community meeting? if so can I put this on the agenda? https://bugs.launchpad.net/keystone/+bug/2009600 | 15:12 |
| dmendiza[m] | hiromu: I think we might need to backport into the stable/2023.1 branch. We do have these under review: https://review.opendev.org/c/openstack/keystone/+/876722/ | 15:13 |
| d34dh0r53 | coreycb: sure, I'll add it | 15:13 |
| coreycb | d34dh0r53: thanks | 15:14 |
| hiromu | Oh, okay. I'll check commit tree again. | 15:14 |
| hiromu | https://github.com/openstack/keystone/commits/master | 15:15 |
| dmendiza[m] | hiromu: do a `git review -d 876722` to pull down the start of the stable/2023.1 branch and then cherry-pick the oauth patches to that chain | 15:15 |
| hiromu | sorry it's worng. https://github.com/openstack/keystone/commits/stable/2023.1 | 15:15 |
| dmendiza[m] | Oh sweet! Looks like it's already there | 15:16 |
| dmendiza[m] | (I think?) | 15:16 |
| hiromu | yeah, I thought so. wrong? | 15:17 |
| dmendiza[m] | I think we're good. My mistake | 15:18 |
| hiromu | good :) | 15:18 |
| hiromu | ls | 15:18 |
| hiromu | sorry | 15:18 |
| hiromu | by the way, I'd like to talk about Ext. Authorization Server Support today. | 15:19 |
| d34dh0r53 | ack, I'll add that as well | 15:19 |
| d34dh0r53 | anything else with mTLS? | 15:19 |
| hiromu | No. That' all. thanks. | 15:20 |
| d34dh0r53 | thanks, moving on to | 15:22 |
| d34dh0r53 | #topic Secure RBAC (dmendiza[m]) | 15:22 |
| d34dh0r53 | #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_ | 15:22 |
| d34dh0r53 | Service Role Implementation | 15:22 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone/+/863420 | 15:22 |
| d34dh0r53 | Manager Role Implementation | 15:22 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone/+/822601 | 15:22 |
| dmendiza[m] | No updates, sorry. I'm not even susre if gmann is still having the pop-up meetings? | 15:22 |
| dmendiza[m] | *sure | 15:22 |
| d34dh0r53 | ack | 15:23 |
| d34dh0r53 | ok, moving on to | 15:24 |
| d34dh0r53 | #topic open discussion | 15:24 |
| d34dh0r53 | (drencrom) Need some reviews for this backport: | 15:24 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystonemiddleware/+/873921 | 15:24 |
| d34dh0r53 | I'll take a look at these today | 15:25 |
| d34dh0r53 | next up | 15:26 |
| d34dh0r53 | (coreycb) discuss mtls/cryptography bug | 15:26 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/+bug/2009600 | 15:26 |
| knikolla[m] | can we lower the cryptography version to the one they mentioned? | 15:27 |
| d34dh0r53 | that's what I'm wondering. hiromu, dmendiza[m] ? | 15:27 |
| coreycb | I'm attempting a patch to do that | 15:28 |
| coreycb | hopefully that'll be ok | 15:28 |
| knikolla[m] | i see that the version that we included was just what was in upper-constraints, so it doesn't feel like there's anything special about it. | 15:28 |
| coreycb | it's more about what the lower constraints are in requirements.txt | 15:29 |
| coreycb | for context, I'm a maintainer for the ubuntu cloud archive. the antelope cloud archive (and the next 2 to 3 openstack releases) are based on ubuntu jammy which has python3-cryptography 3.4.8. | 15:30 |
| knikolla[m] | I don't think we have any global lower constraints | 15:30 |
| knikolla[m] | (all i meant by my previous comment was that i don't think that version has any significance besides being what was written in the requirements repo as an upper constraint) | 15:30 |
| coreycb | I started going down the path of backporting cryptography 38.0.2 yesterday but it gets complicated very quickly (25+ rust library backports) | 15:32 |
| hiromu | At least, I can say I can look for workarounds to avoid using the feature that is only available on recent cryptography. | 15:33 |
| coreycb | do you know if attr_name_overrides is required? I can test the version of cryptography and either specify it or not. or maybe it can just be dropped. | 15:35 |
| hiromu | It is required, but there's alternative way that doesn't use attr_name_overrides but brings the same effect. | 15:36 |
| coreycb | ok, maybe I should defer to you to work on a fix. I was just going to drop the parameter for older cryptography versions which is probably naive. | 15:36 |
| hiromu | I'm not sure which is easier | 15:38 |
| hiromu | but, I think there's possiblity that this kinds of problems happen again. | 15:40 |
| hiromu | so I think I should fix it. | 15:40 |
| hiromu | is that in line with your thought? | 15:41 |
| coreycb | that would be great, thank you. if I can help please let me know. I'll send an email for more global discussion about cryptography to the mailing list, not related specifically to this issue. | 15:42 |
| hiromu | great. thanks | 15:42 |
| d34dh0r53 | awesome, thank you coreycb | 15:42 |
| d34dh0r53 | thanks hiromu | 15:42 |
| d34dh0r53 | next topic, is (hiromu) discuss Ext. Authorization Server Support | 15:43 |
| hiromu | I added this topic to https://etherpad.opendev.org/p/keystone-weekly-meeting | 15:43 |
| hiromu | We're planing to investigate if the following projects work with Ext. Authorizations, and how we can modify them to work with Ext. Authorization servers. Any other projects we must check? | 15:44 |
| hiromu | heat | 15:44 |
| hiromu | glance | 15:44 |
| hiromu | nova | 15:44 |
| hiromu | newtron | 15:44 |
| hiromu | (placement) *low priority | 15:44 |
| hiromu | (cinder) *low priority | 15:44 |
| hiromu | These projects are selected based on DevStack minimal install. | 15:45 |
| hiromu | Do you have any idea? knikolla: | 15:46 |
| knikolla[m] | That's a good start. I don't have any other ideas at the moment, though I would add Ironic as well. | 15:47 |
| d34dh0r53 | and barbican? dmendiza[m]? | 15:48 |
| hiromu | Sure. We have chance to discuss with ironic at vPTG. Depending on the result of that discussion, we might not have to check Ironic (hopefully barbican). | 15:49 |
| d34dh0r53 | ack | 15:50 |
| d34dh0r53 | That's a good start, I'll add this to the vPTG agenda for one of our sessions | 15:50 |
| d34dh0r53 | moving on as we're almost out of time | 15:50 |
| d34dh0r53 | #topic bug review | 15:50 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0 | 15:51 |
| d34dh0r53 | we already discussed the cryptography bug | 15:51 |
| d34dh0r53 | another bug landed https://bugs.launchpad.net/keystone/+bug/2008890 but this looks to be kolla container specific | 15:52 |
| d34dh0r53 | I'll make sure that is the case | 15:52 |
| d34dh0r53 | #action d34dh0r53 ensure that https://bugs.launchpad.net/keystone/+bug/2008890 is kolla specific | 15:52 |
| d34dh0r53 | #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0 | 15:53 |
| d34dh0r53 | nothing new for python-keystoneclient | 15:53 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystoneauth/+bugs?orderby=-id&start=0 | 15:53 |
| d34dh0r53 | keystoneauth is clean | 15:54 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0 | 15:54 |
| d34dh0r53 | as is keystone middleware | 15:54 |
| d34dh0r53 | #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0 | 15:54 |
| d34dh0r53 | pycadf has no new bugs | 15:55 |
| d34dh0r53 | #link https://bugs.launchpad.net/ldappool/+bugs?orderby=-id&start=0 | 15:55 |
| d34dh0r53 | and ldappool is clean too | 15:55 |
| d34dh0r53 | #topic conclusion | 15:55 |
| d34dh0r53 | Thanks for all the hard work in getting mTLS merged the last few weeks! | 15:55 |
| d34dh0r53 | Anyone have anything else before we go? | 15:55 |
| d34dh0r53 | thanks folks! | 15:57 |
| d34dh0r53 | #endmeeting | 15:57 |
| opendevmeet | Meeting ended Tue Mar 7 15:57:07 2023 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:57 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/keystone/2023/keystone.2023-03-07-15.00.html | 15:57 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/keystone/2023/keystone.2023-03-07-15.00.txt | 15:57 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/keystone/2023/keystone.2023-03-07-15.00.log.html | 15:57 |
| gmann | dmendiza[m]: d34dh0r53: I do policy popup meeting on every alternate week - https://wiki.openstack.org/wiki/Consistent_and_Secure_Default_Policies_Popup_Team#Meeting | 18:23 |
| gmann | but we need to get those keystone patches for Member and service role merged | 18:24 |
| gmann | they are open without review for long and it might demotivate authors. | 18:24 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!