| opendevreview | Artem Goncharov proposed openstack/keystonemiddleware master: WIP: add SPIFFE mTLS transport option https://review.opendev.org/c/openstack/keystonemiddleware/+/1005601 | 08:48 |
|---|---|---|
| opendevreview | Grzegorz Grasza proposed openstack/keystonemiddleware master: Add memcache TLS support to external_oauth2_token https://review.opendev.org/c/openstack/keystonemiddleware/+/1005852 | 10:00 |
| opendevreview | Grzegorz Grasza proposed openstack/keystone master: Validate EC2 credential project access https://review.opendev.org/c/openstack/keystone/+/973225 | 10:09 |
| opendevreview | Grzegorz Grasza proposed openstack/keystone master: ec2: enforce timestamp presence in _check_timestamp https://review.opendev.org/c/openstack/keystone/+/993907 | 10:14 |
| opendevreview | Grzegorz Grasza proposed openstack/keystone master: Validate EC2 credential project access https://review.opendev.org/c/openstack/keystone/+/973225 | 10:14 |
| opendevreview | Grzegorz Grasza proposed openstack/keystonemiddleware master: [WiP] External OAuth2.0 service tokens https://review.opendev.org/c/openstack/keystonemiddleware/+/942994 | 10:16 |
| opendevreview | Grzegorz Grasza proposed openstack/keystonemiddleware master: [WiP] Add tests for external OAuth2 service tokens and JWKS https://review.opendev.org/c/openstack/keystonemiddleware/+/942995 | 10:16 |
| opendevreview | Grzegorz Grasza proposed openstack/keystoneauth master: [WiP] External OAuth2.0 plugin https://review.opendev.org/c/openstack/keystoneauth/+/941082 | 10:16 |
| opendevreview | Grzegorz Grasza proposed openstack/keystone master: [WiP] Run external_oauth2_token if it's configured https://review.opendev.org/c/openstack/keystone/+/942222 | 10:16 |
| opendevreview | Grzegorz Grasza proposed openstack/keystone master: ec2: enforce timestamp presence in _check_timestamp https://review.opendev.org/c/openstack/keystone/+/993907 | 12:47 |
| opendevreview | Grzegorz Grasza proposed openstack/keystone master: Validate EC2 credential project access https://review.opendev.org/c/openstack/keystone/+/973225 | 12:47 |
| opendevreview | Grzegorz Grasza proposed openstack/keystone master: ec2: enforce timestamp presence in _check_timestamp https://review.opendev.org/c/openstack/keystone/+/993907 | 14:31 |
| opendevreview | Grzegorz Grasza proposed openstack/keystone master: Validate EC2 credential project access https://review.opendev.org/c/openstack/keystone/+/973225 | 14:31 |
| gtema | #startmeeting keystone | 15:04 |
| opendevmeet | Meeting started Wed Sep 16 15:04:43 2026 UTC and is due to finish in 60 minutes. The chair is gtema. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:04 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:04 |
| opendevmeet | The meeting name has been set to 'keystone' | 15:04 |
| gtema | Reminder: This meeting takes place under the OpenInfra Foundation Code of Conduct | 15:04 |
| gtema | #link https://openinfra.dev/legal/code-of-conduct | 15:05 |
| gtema | #topic roll call | 15:05 |
| gtema | bbobrov, d34dh0r53, xek, gmann, dmendiza[m], dmendiza, mharley, jph, gtema, cardoe, deydra | 15:05 |
| dmendiza[m] | šāāļø | 15:05 |
| xek | o/ | 15:06 |
| gtema | okay, again not many, but let's go | 15:06 |
| gtema | #topic review past meeting work items | 15:06 |
| gtema | #link https://meetings.opendev.org/meetings/keystone/2026 | 15:07 |
| gtema | there were no AIs | 15:07 |
| gtema | #topic liaison updates | 15:07 |
| gtema | RC1 is out. It only included the ec2credential auth method addition from recently | 15:07 |
| gtema | rest will be included in RC2 | 15:08 |
| gtema | unless someone else has updates we jump next | 15:08 |
| gtema | #topic specification | 15:08 |
| gtema | #topic Secure RBAC (dmendiza) | 15:08 |
| dmendiza[m] | Heya! | 15:09 |
| gtema | #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_ | 15:09 |
| dmendiza[m] | So I did go digging through eavesdrop and found this lingering patch: | 15:09 |
| dmendiza[m] | #link https://review.opendev.org/c/openstack/keystone/+/995413 | 15:09 |
| dmendiza[m] | It's a dependency bump to the minimum oslo.config that removes the scope option. | 15:09 |
| gtema | I'm actually wondering whether requirements freeze actually covers this or not | 15:10 |
| gtema | I mean whether we can have the change now at all | 15:11 |
| dmendiza[m] | well, now that RC1 is out we're tracking Indri, so we can go ahead and merge | 15:11 |
| gtema | on the other side the 2026.2 was branched, so it's a question whether if we merge it now we should backport it to 2026.2 | 15:11 |
| dmendiza[m] | 2026.2 has branched off, IRRC? | 15:11 |
| dmendiza[m] | *IIRC | 15:11 |
| dmendiza[m] | Yeah, not sure if we need to/should backport it | 15:11 |
| gtema | ok, at least we merge it, just pressed +W | 15:12 |
| gtema | is there anything else in the topic or we can treat it as done? | 15:13 |
| dmendiza[m] | I think we can cross it out now | 15:13 |
| gtema | great, do it while I go to the next topic | 15:14 |
| gtema | #topic Secuirty Compliance Testing (dmendiza) | 15:14 |
| gtema | #link https://review.opendev.org/c/openstack/devstack/+/957969 | 15:14 |
| dmendiza[m] | Trying to remove the cobwebs here ... I rebased the main patch today and will look at the status of it later | 15:15 |
| gtema | ok, that's good. Ping with the changes needing review once they are green. | 15:16 |
| gtema | next up | 15:16 |
| gtema | #topic User Specified Project/User UUIDs (dmendiza, alee) | 15:16 |
| gtema | #link https://review.opendev.org/c/openstack/keystone-specs/+/997320 | 15:16 |
| gtema | I still had no time to re-review any of those deeply | 15:17 |
| gtema | But still worrying whether soft project deletion must be made a mandatory prerequisite for the project spec | 15:17 |
| cardoe | Iām out on PTO. Missing today. | 15:18 |
| gtema | thanks for hint cardoe | 15:18 |
| gtema | ok, moving on | 15:19 |
| gtema | #topic keystone-rs (gtema) | 15:19 |
| gtema | I am still working on ksa + devstack things to prove the spire based mTLS certs working | 15:19 |
| gtema | the PR is passing, so it really works with minor changes in ksa meaning this can be rolled out to the whole openstack just from the keystone project deliverables | 15:20 |
| gtema | of course deployment tools would need to adapt | 15:20 |
| gtema | the PR is still open since I am still polishing setup | 15:21 |
| gtema | in addition just want to log link to the authn/authz vision doc I have written | 15:21 |
| gtema | #link https://openstack-experimental.github.io/keystone/vision.html | 15:21 |
| gtema | I have actually even written the vision on how KMS service can be implemented for OpenStack (deeply integrating on what keystone-rs brings) | 15:22 |
| gtema | that's it on the topic | 15:22 |
| gtema | #topic open discussion | 15:22 |
| gtema | doesn't look like there are any items this week | 15:24 |
| gtema | #topic bug review | 15:24 |
| xek | gtemaI saw your wip spiffs patch | 15:24 |
| xek | I was wondering, maybe you could convert your blog post into a spec? | 15:24 |
| xek | that way you might compel more people to read and review :) | 15:25 |
| gtema | the vision is not the blog post, it's a spec on it's own describing precisely what need to change | 15:25 |
| gtema | or do you mean post it as a spec to keystone-specs? | 15:25 |
| gtema | I actually plan to send a ML pointing to it. It must be discussed widely within the whole community | 15:26 |
| xek | yes, so that we could discuss using the usual process | 15:26 |
| gtema | I'm trying to sync with cardoe whether we address this (as something closely related to what he posted recently) in the keystone PTG or as a separate cross-project thingy | 15:26 |
| gtema | simply keystone-spec is not enough I am afraid - it should go wider than that | 15:27 |
| xek | maybe, I didn't dig into the details yet, from a high level view it's a new way to wire up services | 15:28 |
| gtema | not only, it spawns across the whole openstack control plane | 15:28 |
| gtema | and the vision is expanding over and address system_scope and srbac personas correcting some misalignments | 15:29 |
| gtema | back to spiffe - it's not completely a new way. It's a better way of tokenless auth method | 15:29 |
| gtema | with difference that service do not hold auth token at all, it just uses the mTLS cert for auth | 15:30 |
| xek | š I don't have much to add yet, but I'll be thinking how we could evolve current keystone into something based on more standard approaches | 15:33 |
| gtema | that's exactly what the vision document is talking about | 15:34 |
| gtema | ok, going on | 15:34 |
| gtema | #topic bug review | 15:34 |
| gtema | #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0 | 15:35 |
| gtema | nothing new public | 15:37 |
| gtema | few new bugs for keystoneauth and keystonemiddleware that Greg opened | 15:38 |
| xek | yeah, I think I proposed patches for all of them | 15:39 |
| xek | some are very small simple changes | 15:39 |
| gtema | that's good | 15:39 |
| gtema | and for other projects there are no new bugs | 15:42 |
| gtema | #topic conclusion | 15:42 |
| gtema | thanks for participating | 15:43 |
| gtema | #endmeeting | 15:43 |
| opendevmeet | Meeting ended Wed Sep 16 15:43:59 2026 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:43 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-09-16-15.04.html | 15:43 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-09-16-15.04.txt | 15:43 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-09-16-15.04.log.html | 15:43 |
| opendevreview | Merged openstack/keystone master: Remove disabling the scope enforcement https://review.opendev.org/c/openstack/keystone/+/995413 | 16:12 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!