| opendevreview | Merged openstack/keystonemiddleware master: Adopt pre-commit https://review.opendev.org/c/openstack/keystonemiddleware/+/989651 | 06:37 |
|---|---|---|
| gtema | #startmeeting keystone | 15:03 |
| opendevmeet | Meeting started Wed Sep 9 15:03:14 2026 UTC and is due to finish in 60 minutes. The chair is gtema. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:03 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:03 |
| opendevmeet | The meeting name has been set to 'keystone' | 15:03 |
| gtema | Reminder: This meeting takes place under the OpenInfra Foundation Code of Conduct | 15:03 |
| gtema | #link https://openinfra.dev/legal/code-of-conduct | 15:03 |
| gtema | #topic roll call | 15:03 |
| gtema | bbobrov, d34dh0r53, xek, gmann, dmendiza[m], dmendiza, mharley, jph, gtema, cardoe, deydra | 15:03 |
| cardoe | o/ | 15:04 |
| dmendiza[m] | 🙋🏽♂️ | 15:04 |
| gtema | wow, dmendiza, not even a special ping :-) | 15:04 |
| gtema | not many participants :-( | 15:05 |
| gtema | #topic review past meeting work items | 15:05 |
| gtema | #link https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-09-02-15.03.html | 15:05 |
| gtema | no action items in the last log | 15:06 |
| gtema | #topic liaison updates | 15:06 |
| gtema | I wanted just to bring to protocol from discussions among team members, VMT our agreement that we will most likely handle all security bugs in open when they a) require new api b) require new feature | 15:07 |
| gtema | which are mostly all of our current vulnerabilities | 15:07 |
| gtema | this will help us to make the process less insanely complex | 15:08 |
| gtema | there are no other updates from my side | 15:08 |
| gtema | #topic specification | 15:08 |
| gtema | #topic: Secure RBAC (dmendiza) | 15:08 |
| gtema | #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_ | 15:08 |
| gtema | dmendiza - stage is yours | 15:09 |
| dmendiza[m] | Right, I did not look into the thing I was going to look into... 😅 | 15:10 |
| gtema | so we even do not know whether something is still to be done, right? | 15:11 |
| dmendiza[m] | Right | 15:12 |
| gtema | okay | 15:13 |
| gtema | #topic Secuirty Compliance Testing (dmendiza) | 15:13 |
| gtema | I assume the same is true here? | 15:13 |
| dmendiza[m] | Still frozen in carbonite | 15:13 |
| gtema | ack | 15:14 |
| gtema | #topic User Specified Project/User UUIDs (dmendiza, alee) | 15:14 |
| gtema | #link https://review.opendev.org/c/openstack/keystone-specs/+/997320 | 15:14 |
| gtema | there was a review to the project one recently underlining a much harder dependency than anticipated on soft deletion | 15:14 |
| gtema | and is a sort of dead end: chose A and you break B, chose B and you break A | 15:15 |
| gtema | need to spend more thoughts on that | 15:16 |
| gtema | for the sake of the time, unless there is something else to report jumping straight next | 15:16 |
| gtema | #topic: #topic keystone-rs (gtema) | 15:16 |
| gtema | #link https://github.com/openstack-experimental/keystone | 15:16 |
| gtema | I am still working on the "making openstack zero trust ready" from keystone-rs pov | 15:17 |
| gtema | started implementing devstack plugins to make it more testable | 15:17 |
| gtema | added openfga assignment driver | 15:17 |
| gtema | found another inconsistency in the authz models that exist on the world with respect to user/group relations which are usually part of the identity, but some authz systems require this information as part of the assignment | 15:18 |
| gtema | not an easy beast | 15:18 |
| gtema | other than that I try to work out the global Keystone (IAM) vision for OpenStack which we could discuss wider with other services | 15:19 |
| gtema | this one to e.g., address system scope and other relevant issues | 15:19 |
| gtema | nothing else on that this week | 15:20 |
| gtema | #topic open discussion | 15:20 |
| gtema | is there anything? | 15:20 |
| cardoe | I've got a few patches I wanted some feedback on | 15:20 |
| cardoe | https://review.opendev.org/c/openstack/openstacksdk/+/981605 | 15:20 |
| gtema | hmm, another dirty workaround, but I get the reason | 15:21 |
| cardoe | Yeah | 15:22 |
| gtema | this need a careful evaluation - thing like that is a door for CVEs | 15:22 |
| cardoe | The other one is I'd like to see the test https://review.opendev.org/c/openstack/keystone/+/981321 land because it's currently uncovered by a test. | 15:22 |
| cardoe | Then a docs fix https://review.opendev.org/c/openstack/keystone/+/976718 | 15:23 |
| gtema | cardoe - I am not looking into this patch unless I get repro logs from you | 15:23 |
| cardoe | Well that's unrelated to the other patches. | 15:24 |
| gtema | this particular patch (test repro) is verifying different thing what you initially think | 15:24 |
| gtema | it is not verifying system scope by federated user, but that you can auth as federated user and rescope into system scope - this is not what we need | 15:25 |
| cardoe | It's possible today so it's just testing it. | 15:25 |
| gtema | what we need is a failing test that shows you traceback | 15:25 |
| cardoe | Yes. It's unrelated I agree. | 15:25 |
| gtema | your | 15:25 |
| cardoe | I've got customer timelines and needs before I can setup a test env again. | 15:25 |
| cardoe | I'll get you data as soon as I can. | 15:26 |
| gtema | alone this test is useless and is maybe actually execricing (proving) another failing behavior | 15:26 |
| gtema | ok, anything else? | 15:26 |
| cardoe | https://review.opendev.org/c/openstack/keystone/+/1004178 | 15:27 |
| cardoe | https://review.opendev.org/c/openstack/keystone/+/976718 the docs fix | 15:27 |
| cardoe | https://review.opendev.org/c/openstack/keystone/+/1004177 | 15:27 |
| cardoe | https://review.opendev.org/c/openstack/keystone/+/1002330 should likely go in and be backported | 15:27 |
| cardoe | https://review.opendev.org/c/openstack/keystone/+/1004205 | 15:28 |
| gtema | I reviewed all of them. Will +W myself latest friday unless other core looks | 15:28 |
| cardoe | 1004205 and 1004178 should likely get backported to stable/2026.2 as well | 15:28 |
| cardoe | gtema: okay cool. | 15:28 |
| cardoe | Those were mostly low hanging clean ups or corrections | 15:28 |
| gtema | sure | 15:28 |
| cardoe | There's a lot of drive by behavior changes like you've noted | 15:29 |
| cardoe | And I'm avoiding those. | 15:29 |
| gtema | https://review.opendev.org/c/openstack/keystone/+/1002330 is a tricky one, we were discussing it with Dave Wilde (d34dh0r53) today and agreed on the strategy | 15:29 |
| cardoe | https://review.opendev.org/c/openstack/keystone/+/987627 was another backport that seemed ready to go | 15:29 |
| gtema | oh, just stuck unnoticed | 15:30 |
| cardoe | yeah 1002330 took me a while to read through but it seemed to make sense and tighten up the behavior. | 15:30 |
| gtema | just as I pointed in the bug - not sufficient | 15:31 |
| gtema | ok, I am currently in parallel in other meeting, so may disappear shortly | 15:32 |
| gtema | #topic bug review | 15:33 |
| gtema | this is short - there are multiple security bugs which we will likely make public shortly | 15:33 |
| gtema | other than that there are no new bugs in either of the deliverables | 15:33 |
| cardoe | fwiw, #/dashboard/?title=Open+backports&foreach=is:open+(projects:openstack/keystone+OR+projects:openstackkeystonemiddleware)&stable=(branch:^stable/.*)&unmaintained=(branch:^unmaintained/.*) is the query I'm using for backports | 15:33 |
| gtema | we can't do anything on unmaintained, so they are useless for us | 15:34 |
| cardoe | There's a number of open ones | 15:34 |
| gtema | but only security ones | 15:37 |
| gtema | with then we are at | 15:38 |
| gtema | #topic conclusion | 15:38 |
| gtema | thanks for participating | 15:39 |
| gtema | #endmeeting | 15:39 |
| opendevmeet | Meeting ended Wed Sep 9 15:39:40 2026 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:39 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-09-09-15.03.html | 15:39 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-09-09-15.03.txt | 15:39 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-09-09-15.03.log.html | 15:39 |
| opendevreview | Merged openstack/keystone stable/2025.1: Include system scope in rescope guard https://review.opendev.org/c/openstack/keystone/+/987627 | 18:28 |
| opendevreview | Merged openstack/keystone master: tox: Drop redundant passenv https://review.opendev.org/c/openstack/keystone/+/1004205 | 18:28 |
| opendevreview | Merged openstack/keystone master: Fix markup issue in federation documentation https://review.opendev.org/c/openstack/keystone/+/976718 | 18:28 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!