| *** mhen_ is now known as mhen | 01:13 | |
| opendevreview | Lajos Katona proposed openstack/keystone master: Don't fail for role_assignment list for bad project id https://review.opendev.org/c/openstack/keystone/+/923749 | 06:53 |
|---|---|---|
| ygk_12345 | hi all | 13:56 |
| ygk_12345 | i am facing an issue while upgrading from yoga to zed | 13:56 |
| ygk_12345 | while running the keystone playbook for upgrade, I am facing this message https://paste.opendev.org/show/bi006rJ8LgohPWh65J65/ | 13:58 |
| ygk_12345 | can someone advise me please | 13:58 |
| opendevreview | Markus Hentsch proposed openstack/keystone master: Implement the Domain Manager Persona for Keystone https://review.opendev.org/c/openstack/keystone/+/924132 | 14:33 |
| opendevreview | Markus Hentsch proposed openstack/keystone-tempest-plugin master: Update tests for new Domain Manager Persona https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/924222 | 14:35 |
| d34dh0r53 | #startmeeting keystone | 15:00 |
| opendevmeet | Meeting started Wed Jul 24 15:00:21 2024 UTC and is due to finish in 60 minutes. The chair is d34dh0r53. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:00 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:00 |
| opendevmeet | The meeting name has been set to 'keystone' | 15:00 |
| xek | o/ | 15:00 |
| gtema | o/ | 15:01 |
| d34dh0r53 | #topic roll call | 15:01 |
| d34dh0r53 | admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, knikolla[m], lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek, gmann, zaitcev, reqa, dmendiza[m], mharley, jph, gtema | 15:01 |
| mhen | o/ | 15:01 |
| * zaitcev peeks | 15:02 | |
| d34dh0r53 | #topic review past meeting work items | 15:03 |
| d34dh0r53 | #link https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-07-10-15.00.html | 15:03 |
| d34dh0r53 | no action items from the last meeting | 15:03 |
| d34dh0r53 | #topic liaison updates | 15:03 |
| d34dh0r53 | nothing from VMT or releases | 15:04 |
| d34dh0r53 | #topic specification OAuth 2.0 (hiromu) | 15:06 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:bp%252Foauth2-client-credentials-ext | 15:06 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:bp%252Fenhance-oauth2-interoperability | 15:07 |
| d34dh0r53 | External OAuth 2.0 Specification | 15:07 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone-specs/+/861554 (merged) | 15:07 |
| d34dh0r53 | OAuth 2.0 Implementation | 15:07 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:bp%252Fsupport-oauth2-mtls | 15:07 |
| d34dh0r53 | OAuth 2.0 Documentation | 15:08 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone/+/838108 (merged) | 15:08 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystoneauth/+/838104 (merged) | 15:08 |
| d34dh0r53 | no updates, hopefully I can get a chance to rebase those last tempest tests this week and get this off the agenda | 15:08 |
| d34dh0r53 | next up we have | 15:08 |
| d34dh0r53 | #topic specification Secure RBAC (dmendiza[m]) | 15:09 |
| d34dh0r53 | #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_ | 15:09 |
| mharley[m] | o/ | 15:09 |
| d34dh0r53 | 2024.1 Release Timeline | 15:09 |
| d34dh0r53 | Update oslo.policy in keystone to enforce_new_defaults=True | 15:09 |
| d34dh0r53 | Update oslo.policy in keystone to enforce_scope=True | 15:09 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone/+/902730 (Merged) | 15:09 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/903713 (Merged) | 15:09 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/tempest/+/912489 (Merged) | 15:09 |
| d34dh0r53 | dmendiza: you around? | 15:11 |
| d34dh0r53 | o/ | 15:12 |
| dmendiza[m] | 🙋♂️ | 15:12 |
| dmendiza[m] | Heya! | 15:12 |
| dmendiza[m] | Let me see .... I don't think I have any updates. IIRC we did merge the Domain-Manager spec? | 15:12 |
| d34dh0r53 | we did | 15:13 |
| gtema | should we move the notes for domain-manager | 15:14 |
| gtema | from open-discussion to ..here..? | 15:14 |
| dmendiza[m] | Yeah, I see domain-manager as part of SRBAC | 15:15 |
| d34dh0r53 | yeah, I was just thinking about that | 15:15 |
| d34dh0r53 | moved | 15:16 |
| gtema | great | 15:16 |
| gtema | Markus (mhen) - do you have updates here? I heard that from you already today, but ... | 15:16 |
| mhen | as written in the etherpad, implementation of policies is pretty much done (from my POV) | 15:17 |
| d34dh0r53 | yep, we'll pivot into | 15:17 |
| mhen | I'm currently filling remaining gaps in keystone-tempest-plugin | 15:17 |
| d34dh0r53 | #topic specification domain manager (mhen) | 15:17 |
| gtema | mhen - the stuff with domain specific roles is important to discuss here imho | 15:17 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone-specs/+/903172 | 15:18 |
| d34dh0r53 | implementation has started in keystone, tempest and keystone-tempest-plugin | 15:18 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:%22domain-manager%22 | 15:18 |
| d34dh0r53 | keystone | 15:18 |
| d34dh0r53 | all applicable policies implemented for SRBAC (enforce_new_defaults and enforce_scope enabled) | 15:18 |
| d34dh0r53 | TODO: fix policy variable naming (they got quite long, exceeding character limit in some places) | 15:18 |
| d34dh0r53 | tempest | 15:18 |
| d34dh0r53 | library updated to create pre-provisioned domain manager user for tests | 15:18 |
| d34dh0r53 | keystone-tempest-plugin | 15:18 |
| d34dh0r53 | fixed existing RBAC tests to incorporate changes done to API | 15:18 |
| d34dh0r53 | TODO: filling remaining gaps in tests to consider the new persona in all applicable places | 15:18 |
| mhen | yea, about domain-specific roles: I initially added domain role management capabilites to the domain manager persona but upon further inspection and testing I realized that it actually made no sense so I removed it again | 15:19 |
| mhen | for the long story expand the second comment here: https://review.opendev.org/c/openstack/keystone/+/924132/comment/d13d5bc4_540fd19a/ | 15:20 |
| mhen | the spec actually didn't consider domain roles (only global roles and their assignment within domains) | 15:21 |
| mhen | ... and it seems it is best to keep it this way, i.e. not allowing the domain manager persona to use the domain role endpoints | 15:22 |
| mhen | it might sound contradicting at first but please read the linked comment | 15:23 |
| mhen | on that note I realized that the naming of the role set rule for domain managers ("domain_managed_target_role") might not be the best considering it could be confused with domain roles, which is a different functionality | 15:25 |
| mhen | ref: https://github.com/openstack/keystone-specs/blob/master/specs/keystone/2024.1/domain-manager-persona.rst?plain=1#L139-L153 | 15:25 |
| gtema | ok, so a short summary - domain manager is not going to manage domain specific roles | 15:30 |
| mhen | based on the current patchset, yes | 15:31 |
| mhen | they will be limited to assign/revoke a fixed set of global roles within a domain | 15:32 |
| mhen | in order to manage user/project/group relations | 15:32 |
| gtema | ok | 15:32 |
| d34dh0r53 | ack | 15:33 |
| d34dh0r53 | that makes sense to me, I think we should target 924132 for the reviewathon to go over it though | 15:34 |
| gtema | 👍️ | 15:34 |
| d34dh0r53 | #action reviewathon look at https://review.opendev.org/c/openstack/keystone/+/924132 | 15:34 |
| d34dh0r53 | moving on | 15:34 |
| d34dh0r53 | #topic specification OpenAPI support (gtema) | 15:35 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone-specs/+/910584 (merged) | 15:35 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:%22openapi%22+project:openstack/keystone | 15:35 |
| gtema | thanks for approving blackify Dave Wilde (d34dh0r53) - that helps to avoid merge conflicts | 15:36 |
| d34dh0r53 | indeed | 15:36 |
| gtema | we have onboarded a Student to support me in that | 15:36 |
| gtema | so hopefully she is going to make her changes soon | 15:36 |
| d34dh0r53 | awesome | 15:37 |
| gtema | on the other side first chages are out there and the review is welcome | 15:37 |
| gtema | Grzegorz Grasza had a look already, but we should have a more formal reviews | 15:37 |
| d34dh0r53 | on which one? | 15:39 |
| gtema | in particular https://review.opendev.org/c/openstack/keystone/+/923067 | 15:39 |
| gtema | the framework addition itself | 15:39 |
| gtema | #link https://review.opendev.org/c/openstack/keystone/+/923324 covers credentials with schemas | 15:40 |
| d34dh0r53 | ack | 15:41 |
| d34dh0r53 | yeah, we can look at these on Friday as well | 15:41 |
| gtema | great | 15:41 |
| d34dh0r53 | #action reviewathon https://review.opendev.org/c/openstack/keystone/+/923067 and https://review.opendev.org/c/openstack/keystone/+/923324 | 15:42 |
| d34dh0r53 | moving on | 15:42 |
| d34dh0r53 | #topic open discussion | 15:42 |
| d34dh0r53 | 'v | 15:42 |
| d34dh0r53 | codebase renovation (gtema) | 15:42 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone/+/924522 - reformat patch. Would appretiate merge soon to reduce merge conflicts | 15:43 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:%22renovate%22 | 15:43 |
| d34dh0r53 | the first one is gating, it should merge in a couple of hours | 15:43 |
| gtema | I'll add new change adding commit to ignore blame once blackify merges | 15:43 |
| gtema | afterwards ensure other changes are fresh and mypy is not failing | 15:44 |
| d34dh0r53 | great | 15:44 |
| gtema | afterwards I would address py datetime.now() issue | 15:44 |
| gtema | and hopefully fix the py312 job - at least that is the initial target | 15:44 |
| d34dh0r53 | ok | 15:45 |
| d34dh0r53 | thank you for this work! | 15:45 |
| gtema | welcome :) | 15:46 |
| d34dh0r53 | anything else for open discussion? | 15:46 |
| gtema | not from me | 15:46 |
| d34dh0r53 | #topic bug review | 15:48 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0 | 15:48 |
| d34dh0r53 | Looks like we have a couple for Keystone | 15:48 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/+bug/2073377 | 15:48 |
| gtema | there is actuallychange proposed for that | 15:49 |
| gtema | #link https://review.opendev.org/c/openstack/keystone/+/924153 | 15:49 |
| d34dh0r53 | ahh, yeah | 15:49 |
| d34dh0r53 | next up | 15:51 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone/+/924153 | 15:51 |
| d34dh0r53 | oops, wrong link | 15:51 |
| d34dh0r53 | #undo | 15:51 |
| opendevmeet | Removing item from minutes: #link https://review.opendev.org/c/openstack/keystone/+/924153 | 15:51 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/+bug/2072945 | 15:51 |
| d34dh0r53 | Yeah, that looks like an unhandled exception to me | 15:53 |
| d34dh0r53 | added a comment | 15:56 |
| d34dh0r53 | finally | 15:57 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/+bug/2072639 | 15:57 |
| d34dh0r53 | Thanks for the reply on that one mhen | 15:57 |
| d34dh0r53 | That does it for keystone | 15:58 |
| d34dh0r53 | next up | 15:58 |
| mhen | :) | 15:58 |
| d34dh0r53 | #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0 | 15:58 |
| d34dh0r53 | no new bugs for python-keystoneclient | 15:58 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystoneauth/+bugs?orderby=-id&start=0 | 15:59 |
| d34dh0r53 | this may be a new bug | 15:59 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystoneauth/+bug/2072481 | 15:59 |
| d34dh0r53 | I think we may need version bumps | 16:01 |
| gtema | hopefully it is sufficient. It's bit hard to understand what is going on there | 16:02 |
| d34dh0r53 | yeah | 16:02 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0 | 16:03 |
| d34dh0r53 | no new bugs for keystonemiddleware | 16:04 |
| d34dh0r53 | #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0 | 16:04 |
| d34dh0r53 | nothing new for pycadf | 16:04 |
| d34dh0r53 | #link https://bugs.launchpad.net/ldappool/+bugs?orderby=-id&start=0 | 16:04 |
| d34dh0r53 | no ldappool | 16:05 |
| d34dh0r53 | we're over time | 16:05 |
| d34dh0r53 | #topic conclusion | 16:05 |
| d34dh0r53 | thanks everyone, see y'all at the reviewathon | 16:05 |
| d34dh0r53 | #endmeeting | 16:05 |
| opendevmeet | Meeting ended Wed Jul 24 16:05:25 2024 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 16:05 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-07-24-15.00.html | 16:05 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-07-24-15.00.txt | 16:05 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-07-24-15.00.log.html | 16:05 |
| gtema | see ya, thanks | 16:05 |
| opendevreview | Merged openstack/keystone master: Blackify the keystone code base https://review.opendev.org/c/openstack/keystone/+/924522 | 17:15 |
| daddycat | Hello all - The here https://docs.openstack.org/keystone/latest/contributor/set-up-keystone.html says python3.6 is required. Is this absolute essential or can you use the latest python version (3.10.x in my case) on your system? | 19:17 |
| gtema | daddycat: it is moment snapshot in docs. Of course you can use newer versions (3.12 is not passing tests as of now) | 19:58 |
| gtema | And actually I am not 100 sure 3.6 is supported now, you should be using 3.8 as min | 19:59 |
| JayF | gtema: daddycat: Likely that should be updated to reference https://governance.openstack.org/tc/reference/runtimes/ which is the source material for what releases support what python versions. For 2024.2 (current master), it is python 3.9, 3.10, 3.11 (and optional per-project 3.12) | 20:01 |
| daddycat | Thanks guys. I am trying to set up keystone for development and keep running into the following issues, hence I was asking about python version in case there is some sort of mismatch. | 20:20 |
| daddycat | I am running into the following problems following the instructions here https://docs.openstack.org/keystone/latest/contributor/set-up-keystone.html | 20:23 |
| daddycat | 1. keystone-manage bootstrap setp fails with the error below | 20:23 |
| daddycat | 2. the USWGI command outlined here doesn't work, seems out of date. | 20:23 |
| daddycat | 3. keystone-manage db_sync seems to run into the same error below. | 20:23 |
| daddycat | ERROR keystone sqlalchemy.exc.NoSuchModuleError: Can't load plugin: sqlalchemy.plugins:dbcounter | 20:23 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!