| *** mhen_ is now known as mhen | 02:16 | |
| opendevreview | Stephen Finucane proposed openstack/keystoneauth master: Run mypy from tox https://review.opendev.org/c/openstack/keystoneauth/+/970461 | 10:18 |
|---|---|---|
| opendevreview | Stephen Finucane proposed openstack/keystoneauth master: WIP: typing: Add hints to fixtures https://review.opendev.org/c/openstack/keystoneauth/+/970462 | 10:18 |
| opendevreview | Stephen Finucane proposed openstack/keystoneauth master: Run mypy from tox https://review.opendev.org/c/openstack/keystoneauth/+/970461 | 11:59 |
| opendevreview | Stephen Finucane proposed openstack/keystoneauth master: WIP: typing: Add hints to fixtures https://review.opendev.org/c/openstack/keystoneauth/+/970462 | 11:59 |
| *** darmach3 is now known as darmach | 12:55 | |
| d34dh0r53 | #startmeeting keystone | 15:03 |
| opendevmeet | Meeting started Wed Jan 7 15:03:51 2026 UTC and is due to finish in 60 minutes. The chair is d34dh0r53. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:03 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:03 |
| opendevmeet | The meeting name has been set to 'keystone' | 15:03 |
| d34dh0r53 | Reminder: This meeting takes place under the OpenInfra Foundation Code of Conduct | 15:04 |
| d34dh0r53 | #link https://openinfra.dev/legal/code-of-conduct | 15:04 |
| d34dh0r53 | admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek, gmann, zaitcev, reqa, dmendiza[m], dmendiza, mharley, jph, gtema, cardoe, deydra | 15:04 |
| gtema | o/ | 15:04 |
| d34dh0r53 | dmendiza: bespoke ping | 15:04 |
| dmendiza[m] | 🙋♂️ | 15:06 |
| d34dh0r53 | #topic review past meeting work items | 15:09 |
| d34dh0r53 | #link https://meetings.opendev.org/meetings/keystone/2025/keystone.2025-12-10-15.12.html | 15:09 |
| d34dh0r53 | no action items to review | 15:09 |
| d34dh0r53 | #topic liaison updates | 15:10 |
| d34dh0r53 | nothing from me | 15:10 |
| gtema | from me: Happy New Year folks | 15:10 |
| dmendiza[m] | gtema: Happy New Year to you too! 🎉 | 15:11 |
| d34dh0r53 | happy new year! | 15:11 |
| d34dh0r53 | #topic specification OAuth 2.0 (hiromu) | 15:11 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:bp%252Foauth2-client-credentials-ext | 15:11 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:bp%252Fenhance-oauth2-interoperability | 15:11 |
| d34dh0r53 | no updates | 15:11 |
| d34dh0r53 | I think we can remove this, I'm pretty sure it went a year without any updates | 15:12 |
| gtema | right | 15:12 |
| d34dh0r53 | #action d34dh0r53 remove OAuth 2.0 section from weekly meeting doc | 15:13 |
| d34dh0r53 | #topic specification OAuth 2.0 (hiromu) Secure RBAC (dmendiza) | 15:13 |
| d34dh0r53 | #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_ | 15:13 |
| d34dh0r53 | 2026.1 Release Timeline | 15:13 |
| d34dh0r53 | Update oslo.policy in keystone to enforce_new_defaults=True | 15:13 |
| d34dh0r53 | Update oslo.policy in keystone to enforce_scope=True | 15:13 |
| d34dh0r53 | dmendiza: any updates? | 15:16 |
| d34dh0r53 | moving on | 15:18 |
| d34dh0r53 | #topic specification OAuth 2.0 (hiromu) Secuirty Compliance Testing (dmendiza) | 15:18 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/devstack/+/957969 | 15:18 |
| d34dh0r53 | also for dmendiza | 15:19 |
| dmendiza[m] | 🙋♂️ | 15:19 |
| dmendiza[m] | Sorry, got distracted for a second. | 15:19 |
| d34dh0r53 | no worries | 15:19 |
| dmendiza[m] | No updates from me this week as I'm just getting back into the swing of things after taking some time off for the holidays. | 15:19 |
| dmendiza[m] | But one of my New Year's resolutions is to be a better open source maintainer this year. 😅 | 15:20 |
| d34dh0r53 | That is a great resolution! | 15:20 |
| d34dh0r53 | I'll join you :) | 15:20 |
| gtema | lol | 15:20 |
| dmendiza[m] | 🥳 | 15:20 |
| d34dh0r53 | next up | 15:21 |
| d34dh0r53 | #topic specification OAuth 2.0 (hiromu) OpenAPI support (gtema) | 15:21 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:%22openapi%22+project:openstack/keystone | 15:21 |
| d34dh0r53 | that's not right | 15:21 |
| gtema | no changes here. There were few backports, but I think nothing should be open now | 15:21 |
| d34dh0r53 | #undo | 15:21 |
| opendevmeet | Removing item from minutes: #link https://review.opendev.org/q/topic:%22openapi%22+project:openstack/keystone | 15:21 |
| d34dh0r53 | OpenAPI support (gtema) | 15:21 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:%22openapi%22+project:openstack/keystone | 15:22 |
| gtema | I am much more focused on the rust reimpl | 15:22 |
| gtema | maybe we want/should add this to the weekly agenda as well? | 15:22 |
| gtema | I got many more necessary approvals and start working on deploying it on our cloud. Current focus in only auth and token validation | 15:23 |
| gtema | was busy adding support for trust and system scope token | 15:23 |
| d34dh0r53 | I'm okay with it | 15:23 |
| gtema | I have a new independent contributor - party | 15:24 |
| d34dh0r53 | woo hoo! | 15:24 |
| gtema | anyway, I will then add the topic for agenda for the next week | 15:24 |
| * dmendiza[m] adds "Re-learn Rust" to his resolutions | 15:24 | |
| gtema | hahaha | 15:24 |
| d34dh0r53 | awesome, thanks gtema ! | 15:24 |
| d34dh0r53 | #topic open discussion | 15:25 |
| d34dh0r53 | I see that stephenfin has added a future topic, do you want to discuss that now? | 15:25 |
| stephenfin | if it suits | 15:25 |
| gtema | it is technically now on the TC level to decide - I left my review for the governance change | 15:26 |
| d34dh0r53 | (stephenfin) Move ksa to OpenStackSDK governance | 15:26 |
| d34dh0r53 | Proposal and rationale https://review.opendev.org/c/openstack/governance/+/971178 | 15:26 |
| d34dh0r53 | I previously proposed this on IRC during the week and gtema seemed okay with the idea | 15:26 |
| gtema | but, stephenfin, if we move further this way half of OpenStack will land in SDK team :-) | 15:26 |
| d34dh0r53 | https://meetings.opendev.org/irclogs/%23openstack-keystone/%23openstack-keystone.2025-12-10.log.html#openstack-keystone.2025-12-10.log.html#t2025-12-10T16:37:19 | 15:26 |
| stephenfin | gtema: agreed (on both counts /o\) | 15:27 |
| stephenfin | I'm mainly bringing it up here since I don't want anyone to feel blindsided or ignored | 15:28 |
| stephenfin | but as I mentioned in the PR, it feels like the more natural place for it nowadays | 15:28 |
| stephenfin | s/PR/proposed change/ | 15:28 |
| d34dh0r53 | thanks stephenfin | 15:32 |
| d34dh0r53 | anything else for open discussion? | 15:35 |
| gtema | not from me | 15:35 |
| stephenfin | nope | 15:36 |
| d34dh0r53 | #topic bug review | 15:36 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0 | 15:36 |
| d34dh0r53 | several new bugs in keystone | 15:36 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/+bug/2134596 | 15:37 |
| d34dh0r53 | maybe something that could be assisted with AI? | 15:38 |
| gtema | is such header exist at all? | 15:39 |
| d34dh0r53 | I feel like I've seen it before, but I'm not 100% certain | 15:39 |
| gtema | I am sure sdk and all other clients do not set anything like that | 15:40 |
| gtema | so I do not really even understand what should that do | 15:40 |
| gtema | wow, it is really present in the code (keystone) | 15:41 |
| gtema | but as said - the clients are not sending it - they do not have access to it (unless explicitly querying) | 15:42 |
| gtema | and comment hints that it is maybe some outdated stuff | 15:43 |
| gtema | "# Header set by versions of keystonemiddleware that understand application | 15:44 |
| gtema | # credential access rules | 15:44 |
| d34dh0r53 | hmm | 15:44 |
| d34dh0r53 | I wonder what version the reporter is running | 15:45 |
| stephenfin | That's from my team | 15:45 |
| * stephenfin tries to find the relevant gophercloud ticket | 15:46 | |
| stephenfin | https://github.com/gophercloud/gophercloud/pull/3576 | 15:46 |
| stephenfin | keystone insists on that header being present if the application credential has access rules associated with it | 15:47 |
| gtema | assisted by: claude - the world is crazy | 15:47 |
| stephenfin | keystonemiddleware will do that in most cases for us, which is why you're likely not aware of it (nor was I when I looked) | 15:48 |
| gtema | I have never experienced any issues without this header | 15:48 |
| stephenfin | *looked first | 15:48 |
| stephenfin | right, because you have keystonemiddleware in the loop | 15:48 |
| stephenfin | however, I don't believe that's the case with keystone itself? | 15:49 |
| stephenfin | iirc, you can trigger this by trying to validate a token against keystone using an application credential with access_rules set | 15:49 |
| gtema | I would need to play around with that explicitly, but I think I was also playing around locally with bare keystone and appcreds when implementing it in rust | 15:49 |
| stephenfin | the access_rules bit is key | 15:50 |
| gtema | I get it | 15:50 |
| d34dh0r53 | let's move the discussion to the bug, we've got several more to get through | 15:50 |
| stephenfin | ack | 15:50 |
| gtema | ok | 15:50 |
| d34dh0r53 | thx | 15:50 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/+bug/2134607 | 15:50 |
| gtema | the pagination strikes again - I would need to go back to that beast | 15:51 |
| d34dh0r53 | indeed | 15:51 |
| d34dh0r53 | guess what :) | 15:52 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/+bug/2134871 | 15:52 |
| gtema | I think I meant exactly this - remember that I have seen something end of last year | 15:52 |
| gtema | it is so hard to force myself to go back to insane python after reimplementing this features in rust | 15:53 |
| d34dh0r53 | :) lumps of coal in your stocking | 15:53 |
| d34dh0r53 | next up | 15:54 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/+bug/2134925 | 15:54 |
| gtema | no - that is the bug I was refering to | 15:54 |
| d34dh0r53 | ahh | 15:54 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/+bug/2135250 | 15:58 |
| gtema | 😮💨 | 15:59 |
| d34dh0r53 | it looks like someone is going to investigate that one | 16:00 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/+bug/2136771 | 16:00 |
| gtema | https://bugs.launchpad.net/keystone/+bug/2135250 is something we were discussing with stephenfin in a bit different context - it is possible to screw the data in the database even through API. In this case the validation of responses fail. I think this bug should be "invalid" with the disablment of the response validation that merged recently | 16:02 |
| d34dh0r53 | ack | 16:08 |
| d34dh0r53 | sorry, getting pinged elsewhere | 16:08 |
| d34dh0r53 | #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0 | 16:08 |
| d34dh0r53 | no new bugs for python-keystoneclient | 16:09 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystoneauth/+bugs?orderby=-id&start=0 | 16:09 |
| d34dh0r53 | keystoneauth is good | 16:09 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0 | 16:09 |
| d34dh0r53 | keystonemiddleware is also good | 16:12 |
| d34dh0r53 | #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0 | 16:12 |
| d34dh0r53 | pycadf is good | 16:13 |
| d34dh0r53 | #link https://bugs.launchpad.net/ldappool/+bugs?orderby=-id&start=0 | 16:13 |
| d34dh0r53 | so is ldappool | 16:13 |
| d34dh0r53 | #topic conclusion | 16:13 |
| d34dh0r53 | happy new year folks :) | 16:13 |
| d34dh0r53 | #endmeeting | 16:13 |
| opendevmeet | Meeting ended Wed Jan 7 16:13:52 2026 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 16:13 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-01-07-15.03.html | 16:13 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-01-07-15.03.txt | 16:13 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-01-07-15.03.log.html | 16:13 |
| gtema | thanks folks | 16:14 |
| gtema | have a nice day/evening | 16:14 |
Generated by irclog2html.py 4.0.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!