| *** mhen_ is now known as mhen | 01:30 | |
| opendevreview | Rafael Weingartner proposed openstack/keystone-specs master: Keystone identity mapping to support project definition as a JSON https://review.opendev.org/c/openstack/keystone-specs/+/748748 | 11:31 |
|---|---|---|
| d34dh0r53 | #startmeeting keystone | 15:01 |
| opendevmeet | Meeting started Wed Jun 26 15:01:28 2024 UTC and is due to finish in 60 minutes. The chair is d34dh0r53. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:01 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:01 |
| opendevmeet | The meeting name has been set to 'keystone' | 15:01 |
| d34dh0r53 | #topic roll call | 15:01 |
| d34dh0r53 | admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, knikolla[m], lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek, gmann, zaitcev, reqa, dmendiza[m], mharley, jph, gtema | 15:01 |
| gtema | o/ | 15:02 |
| Luzi | o/ | 15:02 |
| jph | o/ | 15:02 |
| mhen | o/ | 15:03 |
| d34dh0r53 | Hello everyone, let's get started | 15:04 |
| d34dh0r53 | #topic review past meeting work items | 15:04 |
| d34dh0r53 | #link https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-06-12-15.03.html | 15:04 |
| d34dh0r53 | no work items to review from two weeks ago | 15:05 |
| d34dh0r53 | #topic liaison updates | 15:05 |
| d34dh0r53 | nothing from releases or vmt | 15:05 |
| d34dh0r53 | #topic specification OAuth 2.0 (hiromu) | 15:06 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:bp%252Foauth2-client-credentials-ext | 15:06 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:bp%252Fenhance-oauth2-interoperability | 15:07 |
| d34dh0r53 | External OAuth 2.0 Specification | 15:07 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone-specs/+/861554 (merged) | 15:07 |
| d34dh0r53 | OAuth 2.0 Implementation | 15:07 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:bp%252Fsupport-oauth2-mtls | 15:07 |
| d34dh0r53 | OAuth 2.0 Documentation | 15:07 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone/+/838108 (merged) | 15:07 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystoneauth/+/838104 (merged) | 15:07 |
| d34dh0r53 | There are a few more to merge, I should have some cycles to work on these over the next couple of weeks | 15:08 |
| gtema | there are some changes with merge conflict as of now | 15:08 |
| gtema | but those are not in keystone | 15:09 |
| d34dh0r53 | yeah, I'm not sure if I'll work on the non-keystone stuff | 15:09 |
| d34dh0r53 | maybe I can sync with dmendiza on the barbican ones | 15:09 |
| gtema | oh, the doc change for keystone is also in merge conflict | 15:09 |
| gtema | I am not sure https://review.opendev.org/c/openstack/keystoneauth/+/876746 should land | 15:11 |
| gtema | it seems like a backport | 15:11 |
| dmendiza[m] | 🙋 | 15:12 |
| d34dh0r53 | hi dmendiza | 15:12 |
| opendevreview | Markus Hentsch proposed openstack/keystone-specs master: Add identity spec for Domain Manager persona https://review.opendev.org/c/openstack/keystone-specs/+/903172 | 15:15 |
| Luzi | is this meeting still going on? | 15:20 |
| gtema | yes Luzi | 15:20 |
| d34dh0r53 | Yeah, sorry, was sidetracked with the keystoneauth patch | 15:20 |
| d34dh0r53 | moving on | 15:20 |
| d34dh0r53 | #topic specification Secure RBAC ( dmendiza ) | 15:21 |
| d34dh0r53 | #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_ | 15:21 |
| d34dh0r53 | 2024.1 Release Timeline | 15:21 |
| d34dh0r53 | Update oslo.policy in keystone to enforce_new_defaults=True | 15:21 |
| d34dh0r53 | Update oslo.policy in keystone to enforce_scope=True | 15:21 |
| dmendiza[m] | No updates from me. We should probably look a the above patch | 15:21 |
| dmendiza[m] | for Domain Manager | 15:22 |
| d34dh0r53 | Yeah, that's in the open discussion section, but we can talk about it now | 15:22 |
| gtema | yeah, lets do it | 15:22 |
| mhen | I just rebased it (hence the bot ping above). Should I move it to the 2024.2 subdirectory? (it's still in 2024.1) | 15:23 |
| gtema | I would rather keep it since otherwise all precious reviews are gone | 15:23 |
| gtema | and it takes so long to get them | 15:23 |
| d34dh0r53 | I think 2024.1 is ok | 15:23 |
| mhen | ok | 15:24 |
| dmendiza[m] | Not the branch, but the directory | 15:24 |
| dmendiza[m] | I would prefer it be updated to reflect when it merges | 15:24 |
| dmendiza[m] | I'm sure it can be updated in the same gerrit patch? 🤔 | 15:24 |
| gtema | can we then do the following: a follow-up that moves it to 2024.2? | 15:24 |
| dmendiza[m] | gtema (Artem Goncharov): sure, moving it after works for me | 15:25 |
| d34dh0r53 | works for me | 15:25 |
| gtema | perfect, then only your review is open dmendiza | 15:25 |
| dmendiza[m] | ack, will review asap | 15:27 |
| gtema | thks a lot | 15:27 |
| mhen | thank you :) | 15:27 |
| mhen | btw, is there a spec freeze deadline for Keystone? | 15:27 |
| d34dh0r53 | looking now | 15:29 |
| gtema | actually a next week (milestone-2) is so to say a deadline for specs, but projects are capable in defining own deadline for specs | 15:29 |
| gtema | i.e. Nova does it bit later (+2 weeks) | 15:29 |
| gtema | https://releases.openstack.org/dalmatian/schedule.html | 15:30 |
| d34dh0r53 | Yeah, we're next week | 15:30 |
| gtema | so we should do everything possible to land it by that time | 15:30 |
| dmendiza[m] | +1 | 15:30 |
| mhen | that would be very appreciated | 15:31 |
| gtema | mhen - I suggest you can start implementation | 15:31 |
| gtema | not to waste time | 15:31 |
| gtema | "under expectation" | 15:32 |
| gtema | let's please move on, time ticks | 15:33 |
| d34dh0r53 | ack, I think we're good on that spec and SRBAC | 15:33 |
| d34dh0r53 | next up | 15:33 |
| d34dh0r53 | #topic specification Improve federated users management (gtema) | 15:33 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone/+/920892 | 15:34 |
| gtema | I am waiting (still) for reviews | 15:34 |
| d34dh0r53 | I'll review this week | 15:34 |
| gtema | thks a lot Dave Wilde (d34dh0r53) | 15:34 |
| d34dh0r53 | dmendiza, Grzegorz Grasza please take a look as well | 15:35 |
| d34dh0r53 | next up | 15:35 |
| d34dh0r53 | #topic specification OpenAPI support (gtema) | 15:35 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone-specs/+/910584 (merged) | 15:35 |
| d34dh0r53 | gtema: design started | 15:35 |
| gtema | cool, we started similar stuff on Manila and Nova | 15:36 |
| gtema | I will push a change in next days to add a new job that generates OpenAPI spec | 15:36 |
| gtema | it will not be used so far, but necessary to see the progress of moving schemas into the Keystone code base | 15:36 |
| gtema | so in next days changes will start appearing | 15:36 |
| d34dh0r53 | great! | 15:36 |
| gtema | that's it so far | 15:37 |
| d34dh0r53 | #topic open discussion | 15:37 |
| d34dh0r53 | passlib update | 15:37 |
| d34dh0r53 | no movement upstream in the passlib project | 15:37 |
| d34dh0r53 | in the meantime I've pinned bcrypt in the requirements | 15:38 |
| gtema | that's a real crap with upstream | 15:38 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/requirements/+/921873 | 15:38 |
| d34dh0r53 | yep, it sucks | 15:38 |
| gtema | as I have tried to start switching it appeared to be quite a dirty work in some algorythms | 15:38 |
| gtema | but apparently threre is no way around it - it feels like a dead end for passlib | 15:39 |
| d34dh0r53 | there are several people willing to take over maintenance of passlib but the maintainer has gone dark again without giving anyone access | 15:40 |
| d34dh0r53 | I'll keep pinging on the open tickets | 15:40 |
| d34dh0r53 | maybe it's time for a fork | 15:40 |
| gtema | ah - not sure this is a good idea - there are too many very dirty things inside | 15:41 |
| gtema | and it's imho better to get rid of it as such - that's going to be clearer | 15:41 |
| d34dh0r53 | do you have the cycles to do that work? | 15:42 |
| gtema | well, all depends on priorities | 15:42 |
| d34dh0r53 | indeed :) | 15:42 |
| gtema | in principle - yes, but I can't commit it would be ready this cycle | 15:42 |
| d34dh0r53 | I think the pin will suffice for this release | 15:43 |
| gtema | I think we are good now with the pin and in the meanwhile I start (slowly) getting rid of passlib | 15:43 |
| gtema | correct | 15:43 |
| d34dh0r53 | ack, thanks gtema (Artem Goncharov) ! | 15:43 |
| dmendiza[m] | I'm curious, what are the alternatives to passlib ? 🤔 | 15:43 |
| gtema | no alternatives. Basically passlib is just a wrapper around native things like bcrypt and scrypt | 15:44 |
| gtema | so it's sort of single API for those | 15:44 |
| dmendiza[m] | Oh, so just rewrite in cryptography.io probably | 15:44 |
| gtema | that's the point - I was able to achieve this | 15:44 |
| gtema | but the most complex thing is that passlib does some black magic in bcrypt pass | 15:45 |
| gtema | and it is a problem to keep backward compatibility not forcing people changing their passwordds | 15:45 |
| gtema | just start using cryptography is very simple in reality | 15:46 |
| dmendiza[m] | I see ... 🤔 | 15:48 |
| d34dh0r53 | moving on for time | 15:48 |
| d34dh0r53 | we already talked about the domain manager patch | 15:48 |
| d34dh0r53 | so the last item in open discussion is | 15:48 |
| d34dh0r53 | domain list scoping fix (mhen) | 15:48 |
| d34dh0r53 | the main fix was merged a while ago: https://review.opendev.org/c/openstack/keystone/+/900028 | 15:48 |
| d34dh0r53 | Q: is https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/900545 still applicable? | 15:48 |
| d34dh0r53 | it would have been a necessary adjustment to the tempest tests after the above merge but tests have been restructured in the meantime (mentioned at PTG) | 15:49 |
| gtema | dmendiza's final blessing is required | 15:49 |
| gtema | as he left few -1 in the past | 15:49 |
| gtema | great, it works ;-) | 15:51 |
| d34dh0r53 | book | 15:51 |
| d34dh0r53 | err, boom | 15:51 |
| d34dh0r53 | thanks dmendiza | 15:52 |
| dmendiza[m] | lgtm | 15:52 |
| gtema | next thing in "open" - does the review-a-thon taking place? 2 last Fridays I waited in an empty meeting | 15:52 |
| d34dh0r53 | For sure it will happen this week | 15:52 |
| gtema | awesome | 15:53 |
| d34dh0r53 | sorry, some unexpected PTO on my part | 15:53 |
| gtema | np | 15:53 |
| d34dh0r53 | #topic bug review | 15:53 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0 | 15:53 |
| d34dh0r53 | we have a new bug filed against keystone | 15:53 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/+bug/2069960 | 15:53 |
| d34dh0r53 | That should be a pretty easy fix but I'm not sure about the backportability | 15:54 |
| gtema | if that is going to happen it will influence my OpenAPI stuff and similar, since I have seen places around the OpenStack "consuming" tools with length limit (explicitly in the strong-typed languages) | 15:54 |
| gtema | generally I am not having any issues with that, but it definitely has an impact | 15:55 |
| d34dh0r53 | yeah | 15:55 |
| d34dh0r53 | I just looked, we don't have new bugs in any of the remaining projects | 15:57 |
| d34dh0r53 | #topic conclusion | 15:58 |
| d34dh0r53 | anything else before we go? | 15:58 |
| gtema | not for me | 15:58 |
| d34dh0r53 | thanks everyone! | 16:01 |
| d34dh0r53 | #endmeeting | 16:01 |
| opendevmeet | Meeting ended Wed Jun 26 16:01:54 2024 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 16:01 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-06-26-15.01.html | 16:01 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-06-26-15.01.txt | 16:01 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-06-26-15.01.log.html | 16:01 |
| gtema | thanks, see you | 16:02 |
| opendevreview | Merged openstack/keystone-tempest-plugin master: Adjust domain tests for changed list_domains scoping behavior https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/900545 | 16:21 |
| opendevreview | Artem Goncharov proposed openstack/keystone master: Enable non-voting OpenAPI build job https://review.opendev.org/c/openstack/keystone/+/922851 | 16:51 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!