| *** ykarel_ is now known as ykarel | 04:24 | |
| opendevreview | Stephen Finucane proposed openstack/oslo.policy master: pre-commit: Bump versions https://review.opendev.org/c/openstack/oslo.policy/+/994634 | 10:18 |
|---|---|---|
| opendevreview | Stephen Finucane proposed openstack/oslo.policy master: zuul: Use openstack-python3-next-jobs template https://review.opendev.org/c/openstack/oslo.policy/+/994635 | 10:18 |
| opendevreview | Stephen Finucane proposed openstack/oslo.limit master: pre-commit: Bump versions https://review.opendev.org/c/openstack/oslo.limit/+/994670 | 10:25 |
| opendevreview | Stephen Finucane proposed openstack/oslo.limit master: zuul: Use openstack-python3-next-jobs template https://review.opendev.org/c/openstack/oslo.limit/+/994671 | 10:25 |
| opendevreview | Stephen Finucane proposed openstack/keystoneauth master: trivial: Declare attributes on _BaseAdapter https://review.opendev.org/c/openstack/keystoneauth/+/994090 | 11:43 |
| opendevreview | Merged openstack/keystoneauth master: Remove get_oslo_config helper https://review.opendev.org/c/openstack/keystoneauth/+/994488 | 12:11 |
| opendevreview | Merged openstack/keystoneauth master: pre-commit: Bump versions https://review.opendev.org/c/openstack/keystoneauth/+/994471 | 12:11 |
| opendevreview | Merged openstack/keystoneauth master: zuul: Use openstack-python3-next-jobs template https://review.opendev.org/c/openstack/keystoneauth/+/994472 | 12:11 |
| opendevreview | Stephen Finucane proposed openstack/keystoneauth master: Drop Python 3.10 support https://review.opendev.org/c/openstack/keystoneauth/+/994694 | 12:28 |
| opendevreview | Grzegorz Grasza proposed openstack/keystone master: ec2: enforce timestamp presence in _check_timestamp https://review.opendev.org/c/openstack/keystone/+/993907 | 12:30 |
| opendevreview | Stephen Finucane proposed openstack/keystoneauth master: typing: Use objects from typing https://review.opendev.org/c/openstack/keystoneauth/+/994713 | 12:55 |
| opendevreview | Elod Illes proposed openstack/keystonemiddleware master: DNM: gate health test https://review.opendev.org/c/openstack/keystonemiddleware/+/994718 | 13:19 |
| opendevreview | Elod Illes proposed openstack/python-keystoneclient master: DNM: gate health test https://review.opendev.org/c/openstack/python-keystoneclient/+/994728 | 13:21 |
| d34dh0r53 | #startmeeting keystone | 15:20 |
| opendevmeet | Meeting started Wed Jun 24 15:20:20 2026 UTC and is due to finish in 60 minutes. The chair is d34dh0r53. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:20 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:20 |
| opendevmeet | The meeting name has been set to 'keystone' | 15:20 |
| d34dh0r53 | Reminder: This meeting takes place under the OpenInfra Foundation Code of Conduct | 15:21 |
| d34dh0r53 | #link https://openinfra.dev/legal/code-of-conduct | 15:21 |
| d34dh0r53 | #topic roll call | 15:21 |
| d34dh0r53 | admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek, gmann, zaitcev, reqa, dmendiza[m], dmendiza, mharley, jph, gtema, cardoe, deydra | 15:21 |
| bbobrov | o/ | 15:21 |
| d34dh0r53 | sorry I'm late | 15:21 |
| gtema | o/ | 15:21 |
| d34dh0r53 | lot's of PTO this week, so probably a light meeting | 15:22 |
| d34dh0r53 | #topic review past meeting work items | 15:22 |
| d34dh0r53 | #link https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-06-17-15.06.html | 15:23 |
| d34dh0r53 | no action items from last week to review | 15:23 |
| d34dh0r53 | #topic liaison updates | 15:23 |
| d34dh0r53 | nothing from me | 15:23 |
| gtema | neither from me | 15:23 |
| d34dh0r53 | #topic specification Secure RBAC (dmendiza) | 15:24 |
| d34dh0r53 | #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_ | 15:24 |
| d34dh0r53 | 2026.1 Release Timeline | 15:24 |
| d34dh0r53 | Update oslo.policy in keystone to enforce_new_defaults=True | 15:24 |
| d34dh0r53 | Update oslo.policy in keystone to enforce_scope=True | 15:24 |
| d34dh0r53 | Devstack still defaults to enforce_scope = False https://opendev.org/openstack/devstack/src/branch/master/lib/keystone#L120 | 15:24 |
| d34dh0r53 | Patch to default to true: https://review.opendev.org/c/openstack/devstack/+/956210 | 15:24 |
| d34dh0r53 | Fix config options in keystone-tempest-plugin https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/930829 | 15:24 |
| bbobrov | I have a question about srbac. | 15:25 |
| bbobrov | I have a pretty old deployment. I think it even predates system scope. In the deployment, bug 968696 is solved via a "superadmin" project. | 15:25 |
| bbobrov | However now the whole openstack decided to take the concept of "admin" being a "cloud admin" role and "manager" being the "project master". | 15:25 |
| bbobrov | I am wondering what my migration path now is. | 15:26 |
| bbobrov | My first idea is to start giving out "manager" role to users, add it to policies, let it soak and then remove admin at some point. | 15:26 |
| bbobrov | is it really it? Is there anything that i have missed? Some other recipe prepared somewhere else? | 15:27 |
| d34dh0r53 | That seems reasonable to me, but I am far from an expert on SRBAC, dmendiza would know more, but he's on PTO. | 15:27 |
| gtema | in my eyes it is correct | 15:28 |
| dmendiza[m] | 🙋♂️ | 15:28 |
| dmendiza[m] | Just so happened to be on my laptop signing some docs. 😄 | 15:28 |
| d34dh0r53 | ohai dmendiza ! | 15:28 |
| dmendiza[m] | bbobrov: so, the main issue with admin anywhere is admin everywhere is that policies are not centrally managed. Every project/service manages their own policies. | 15:29 |
| dmendiza[m] | Even though keystone issues tokens that include scope information, not every project uses that in their policies | 15:30 |
| dmendiza[m] | so, for a project that has not implemented scopes in their policies for whatever reason, a user that has the admin role on a project looks the same as a user that has the admin role on the system | 15:30 |
| dmendiza[m] | The manager role was introduced so that project can opt-in to modify their policies to both check for scope and this new role to allow administrative tasks on a narrower scope | 15:31 |
| dmendiza[m] | HOWEVER, I don't think any projects have actually adopted the manager role except for us (keystone) | 15:31 |
| bbobrov | oh they did. | 15:32 |
| dmendiza[m] | And we have only implemented the Domain Manager persona -- in other words, Keystone does allow some API access to users with a token that is scoped on a domain and has the manager role. | 15:32 |
| bbobrov | nova, neutron and ironic have project manager. | 15:32 |
| dmendiza[m] | So, I don't know the extent of the policy changes in other projects, so I can't recommend a migration path there. | 15:33 |
| dmendiza[m] | For Keystone, you can grant "manager" on a specific domain. Then that user can request a domain-scoped token to create users/projects/role assignments that are allowed as long as they are created on that specific project | 15:33 |
| dmendiza[m] | A Domain Manager could create a user and a project within their domain, and then assign the manager role to that user on that project | 15:34 |
| bbobrov | that all is with default policies, and default policies don't work for me, and it is fine for me to edit them heavily. | 15:35 |
| dmendiza[m] | Yeah, I mean, you can make policies to do whatever you want, HOWEVER | 15:35 |
| dmendiza[m] | Allowed scopes are hard-coded and can't be overwritten in a custom policy | 15:35 |
| bbobrov | i am concerned about a situation when a new API endpoint gets added, gets a default rule "role:admin", and in my deployment admin is project-contained. | 15:35 |
| dmendiza[m] | If you're only dealing with project-scoped things you should be fine. | 15:36 |
| dmendiza[m] | Yeah, unfortunately, we were unable to get community buy-in on scoping admin :( | 15:36 |
| bbobrov | ok. I guess i will just go with my plan and let you know how it went in a year or so. | 15:37 |
| dmendiza[m] | Yeah, I would suggest modifying your custom policies to use Project Managers to avoid that | 15:37 |
| bbobrov | i'm done, thanks. | 15:39 |
| dmendiza[m] | you're welcome | 15:39 |
| * dmendiza[m] goes back to PTO | 15:39 | |
| d34dh0r53 | cool, thanks dmendiza and bbobrov | 15:39 |
| d34dh0r53 | #topic specification Secuirty Compliance Testing (dmendiza) | 15:40 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/devstack/+/957969 | 15:40 |
| dmendiza[m] | Doug's not here, man. 😛 | 15:40 |
| d34dh0r53 | lol | 15:40 |
| dmendiza[m] | Heh, no updates because PTO | 15:40 |
| d34dh0r53 | Enjoy the PTO :) | 15:41 |
| d34dh0r53 | next up | 15:41 |
| dmendiza[m] | I'm moving, so no enjoyment to be had 😭 | 15:41 |
| d34dh0r53 | #topic keystone-rs | 15:41 |
| d34dh0r53 | #link https://github.com/openstack-experimental/keystone | 15:41 |
| d34dh0r53 | indeed, all the best on the move | 15:41 |
| gtema | I was quite long time fighting the compiler, or actually a compilation performance penalty caused by creating mocks for complex traits | 15:42 |
| gtema | and since students now are actively adding code the compilation again got worse | 15:42 |
| gtema | but I was able to reduce compliation time of the central crate from 70s down to 15s, so now the local development is again possible | 15:43 |
| gtema | all of that disturbed me from completing switching auth providers to the unified mapping engine | 15:43 |
| gtema | but now I am back and now completing the final (and the biggest) step of migrating the oidc/jwt flow to this new mapping engine | 15:44 |
| gtema | one student actually even created github action so we would have possibility to test it muct better in the CI finally giving end users possibility to interact with OpenStack from GitHub workflows easily. It was possible, but now is going to be even easier | 15:45 |
| gtema | after I complete that I will move to the encryption layer for raft storage since that is a pre-requisite for implementing api-key based auth which is a prerequisite for SCIM | 15:46 |
| gtema | summary - everything is moving, moving pretty fast | 15:46 |
| gtema | students are great and the progress is great | 15:47 |
| gtema | that's it for this week | 15:47 |
| d34dh0r53 | thanks gtema | 15:49 |
| d34dh0r53 | #topic open discussion | 15:49 |
| gtema | I do not have topics | 15:49 |
| d34dh0r53 | neither do I | 15:50 |
| d34dh0r53 | #topic bug review | 15:50 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0 | 15:50 |
| d34dh0r53 | two new bugs in keystone | 15:51 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/+bug/2157343 | 15:51 |
| gtema | lol | 15:51 |
| d34dh0r53 | uhh | 15:52 |
| gtema | closed - invalid | 15:52 |
| d34dh0r53 | thanks, beat me to it | 15:52 |
| d34dh0r53 | next up | 15:52 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/+bug/2157958 | 15:53 |
| gtema | doubt is also a "keystone" issue | 15:54 |
| d34dh0r53 | yeah | 15:54 |
| d34dh0r53 | I added Glance to the affected projects and saw your update | 15:56 |
| d34dh0r53 | moving on | 15:56 |
| d34dh0r53 | #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0 | 15:56 |
| d34dh0r53 | nothing new there | 15:56 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystoneauth/+bugs?orderby=-id&start=0 | 15:56 |
| d34dh0r53 | nothing new in keystoneauth either | 15:57 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0 | 15:57 |
| d34dh0r53 | keystonemiddleware is good | 15:57 |
| d34dh0r53 | #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0 | 15:57 |
| d34dh0r53 | pycadf has no new bugs | 15:57 |
| d34dh0r53 | #link https://bugs.launchpad.net/ldappool/+bugs?orderby=-id&start=0 | 15:57 |
| d34dh0r53 | ldappool is also clean | 15:58 |
| d34dh0r53 | #topic conclusion | 15:58 |
| d34dh0r53 | I'm on PTO for the next couple of weeks | 15:58 |
| gtema | oh, ok | 15:58 |
| gtema | enjoy it | 15:58 |
| d34dh0r53 | thanks! | 15:59 |
| d34dh0r53 | looking forward to it, heading to Southern California to see friends and family | 15:59 |
| gtema | :) | 16:00 |
| d34dh0r53 | #endmeeting | 16:00 |
| opendevmeet | Meeting ended Wed Jun 24 16:00:13 2026 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 16:00 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-06-24-15.20.html | 16:00 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-06-24-15.20.txt | 16:00 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-06-24-15.20.log.html | 16:00 |
| gtema | thanks Dave Wilde (d34dh0r53) | 16:00 |
| opendevreview | Artem Goncharov proposed openstack/keystone master: Fix nullable enabled column security vulnerabilities for user and project https://review.opendev.org/c/openstack/keystone/+/993206 | 16:26 |
| opendevreview | Abhishek Kekane proposed openstack/oslo.limit master: Honor -1 as unlimited in enforce_limits https://review.opendev.org/c/openstack/oslo.limit/+/994787 | 16:54 |
| opendevreview | Nicholas Kuechler proposed openstack/keystoneauth master: Exclude empty endpoint lists from get_endpoints result https://review.opendev.org/c/openstack/keystoneauth/+/994802 | 18:12 |
| opendevreview | Merged openstack/oslo.policy master: pre-commit: Bump versions https://review.opendev.org/c/openstack/oslo.policy/+/994634 | 19:39 |
| opendevreview | Merged openstack/oslo.limit master: pre-commit: Bump versions https://review.opendev.org/c/openstack/oslo.limit/+/994670 | 19:56 |
| gmaan | d34dh0r53: dmendiza[m] can either of you check these enforce_scope removal changes https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/993835 https://review.opendev.org/c/openstack/keystone/+/993829 https://review.opendev.org/c/openstack/keystone/+/993852/2 | 20:12 |
| opendevreview | Merged openstack/oslo.policy master: zuul: Use openstack-python3-next-jobs template https://review.opendev.org/c/openstack/oslo.policy/+/994635 | 21:03 |
| opendevreview | Merged openstack/oslo.limit master: zuul: Use openstack-python3-next-jobs template https://review.opendev.org/c/openstack/oslo.limit/+/994671 | 21:36 |
| opendevreview | Oria Weng proposed openstack/keystone master: Pre-commit: Add toml dependency for bandit https://review.opendev.org/c/openstack/keystone/+/994833 | 23:20 |
| opendevreview | Oria Weng proposed openstack/keystone master: Remove `enabled` as a filter for endpoint groups https://review.opendev.org/c/openstack/keystone/+/994834 | 23:24 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!