| *** munimeha1 has quit IRC | 00:09 | |
| *** yamamoto has quit IRC | 00:38 | |
| *** bhavikdbavishi has joined #openstack-meeting-alt | 01:06 | |
| *** lbragstad has quit IRC | 01:07 | |
| *** yamamoto has joined #openstack-meeting-alt | 01:10 | |
| *** yamamoto has quit IRC | 01:21 | |
| *** isq_ has joined #openstack-meeting-alt | 01:23 | |
| *** bhavikdbavishi has quit IRC | 01:24 | |
| *** yamahata__ has quit IRC | 01:24 | |
| *** yamamoto has joined #openstack-meeting-alt | 01:28 | |
| *** hongbin has joined #openstack-meeting-alt | 01:43 | |
| *** gyee has quit IRC | 02:14 | |
| *** markstur has quit IRC | 02:16 | |
| *** betherly has joined #openstack-meeting-alt | 02:38 | |
| *** bhavikdbavishi has joined #openstack-meeting-alt | 02:39 | |
| *** liuyulong has joined #openstack-meeting-alt | 02:42 | |
| *** betherly has quit IRC | 02:43 | |
| *** cloudrancher has quit IRC | 02:54 | |
| *** cloudrancher has joined #openstack-meeting-alt | 02:55 | |
| *** hongbin_ has joined #openstack-meeting-alt | 03:11 | |
| *** hongbin has quit IRC | 03:13 | |
| *** hongbin has joined #openstack-meeting-alt | 03:22 | |
| *** dklyle has joined #openstack-meeting-alt | 03:23 | |
| *** hongbin_ has quit IRC | 03:23 | |
| *** david-lyle has quit IRC | 03:25 | |
| *** iyamahat has quit IRC | 03:28 | |
| *** yamahata has quit IRC | 03:29 | |
| *** betherly has joined #openstack-meeting-alt | 03:33 | |
| *** betherly has quit IRC | 03:38 | |
| *** smyers_ has joined #openstack-meeting-alt | 03:52 | |
| *** smyers has quit IRC | 03:53 | |
| *** smyers_ is now known as smyers | 03:53 | |
| *** dave-mccowan has quit IRC | 03:53 | |
| *** diablo_rojo has quit IRC | 05:05 | |
| *** janki has joined #openstack-meeting-alt | 05:22 | |
| *** hongbin has quit IRC | 05:39 | |
| *** gcb_ has joined #openstack-meeting-alt | 06:06 | |
| *** sridharg has joined #openstack-meeting-alt | 06:11 | |
| *** gcb_ has quit IRC | 06:11 | |
| *** betherly has joined #openstack-meeting-alt | 06:13 | |
| *** betherly has quit IRC | 06:17 | |
| *** liuyulong has quit IRC | 06:24 | |
| *** iyamahat has joined #openstack-meeting-alt | 06:25 | |
| *** apetrich has quit IRC | 06:37 | |
| *** radeks_ has joined #openstack-meeting-alt | 07:04 | |
| *** radeks__ has joined #openstack-meeting-alt | 07:07 | |
| *** radeks_ has quit IRC | 07:09 | |
| *** apetrich has joined #openstack-meeting-alt | 07:24 | |
| *** dpawlik has joined #openstack-meeting-alt | 07:29 | |
| *** rcernin has quit IRC | 07:38 | |
| *** ttsiouts has joined #openstack-meeting-alt | 07:40 | |
| *** jtomasek has joined #openstack-meeting-alt | 07:41 | |
| *** jtomasek has quit IRC | 07:41 | |
| *** jtomasek has joined #openstack-meeting-alt | 07:41 | |
| *** ttsiouts_ has joined #openstack-meeting-alt | 07:58 | |
| *** ttsiouts has quit IRC | 08:01 | |
| *** rdopiera has joined #openstack-meeting-alt | 08:07 | |
| *** iyamahat has quit IRC | 08:14 | |
| *** ttsiouts_ has quit IRC | 08:17 | |
| *** ttsiouts has joined #openstack-meeting-alt | 08:18 | |
| *** ttsiouts has quit IRC | 08:22 | |
| *** liuyulong has joined #openstack-meeting-alt | 08:26 | |
| *** ianychoi has quit IRC | 08:30 | |
| *** ianychoi has joined #openstack-meeting-alt | 08:30 | |
| *** ttsiouts has joined #openstack-meeting-alt | 08:52 | |
| *** lbragstad has joined #openstack-meeting-alt | 09:24 | |
| *** priteau has joined #openstack-meeting-alt | 09:30 | |
| *** tssurya has joined #openstack-meeting-alt | 09:31 | |
| *** e0ne has joined #openstack-meeting-alt | 09:44 | |
| *** kopecmartin|off is now known as kopecmartin | 09:46 | |
| *** derekh has joined #openstack-meeting-alt | 09:51 | |
| *** yamamoto has quit IRC | 09:59 | |
| *** bhavikdbavishi1 has joined #openstack-meeting-alt | 10:08 | |
| *** yamamoto has joined #openstack-meeting-alt | 10:08 | |
| *** yamamoto has quit IRC | 10:08 | |
| *** bhavikdbavishi has quit IRC | 10:09 | |
| *** bhavikdbavishi1 is now known as bhavikdbavishi | 10:09 | |
| *** erlon has joined #openstack-meeting-alt | 10:25 | |
| *** masahito has joined #openstack-meeting-alt | 10:30 | |
| *** ttsiouts has quit IRC | 10:36 | |
| *** masahito has quit IRC | 10:36 | |
| *** ttsiouts has joined #openstack-meeting-alt | 10:37 | |
| *** ttsiouts_ has joined #openstack-meeting-alt | 10:38 | |
| *** ttsiouts has quit IRC | 10:42 | |
| *** bhavikdbavishi1 has joined #openstack-meeting-alt | 10:44 | |
| *** bhavikdbavishi has quit IRC | 10:48 | |
| *** bhavikdbavishi1 is now known as bhavikdbavishi | 10:48 | |
| *** bhavikdbavishi has quit IRC | 10:52 | |
| *** ttsiouts_ has quit IRC | 11:01 | |
| *** ttsiouts has joined #openstack-meeting-alt | 11:01 | |
| *** ttsiouts has quit IRC | 11:06 | |
| *** yamamoto has joined #openstack-meeting-alt | 11:22 | |
| *** yamamoto has quit IRC | 11:35 | |
| *** e0ne has quit IRC | 11:35 | |
| *** e0ne has joined #openstack-meeting-alt | 11:38 | |
| *** ttsiouts has joined #openstack-meeting-alt | 11:45 | |
| *** bhavikdbavishi has joined #openstack-meeting-alt | 11:54 | |
| *** ttsiouts has quit IRC | 11:54 | |
| *** ttsiouts has joined #openstack-meeting-alt | 11:55 | |
| *** ttsiouts has quit IRC | 11:59 | |
| *** dave-mccowan has joined #openstack-meeting-alt | 12:12 | |
| *** lbragstad has quit IRC | 12:21 | |
| *** lbragstad has joined #openstack-meeting-alt | 12:22 | |
| *** lbragstad has quit IRC | 12:23 | |
| *** ttsiouts has joined #openstack-meeting-alt | 12:23 | |
| *** lbragstad has joined #openstack-meeting-alt | 12:24 | |
| *** lbragsta_ has joined #openstack-meeting-alt | 12:26 | |
| *** lbragsta_ has quit IRC | 12:31 | |
| *** lbragstad has quit IRC | 12:31 | |
| *** lbragstad has joined #openstack-meeting-alt | 12:37 | |
| *** tpsilva has joined #openstack-meeting-alt | 12:44 | |
| *** ttsiouts has quit IRC | 12:49 | |
| *** bhavikdbavishi has quit IRC | 12:50 | |
| *** ttsiouts has joined #openstack-meeting-alt | 12:50 | |
| *** bhavikdbavishi has joined #openstack-meeting-alt | 12:56 | |
| *** jcoufal has joined #openstack-meeting-alt | 13:08 | |
| *** jtomasek_ has joined #openstack-meeting-alt | 13:17 | |
| *** jtomasek has quit IRC | 13:18 | |
| *** liuyulong_ has joined #openstack-meeting-alt | 13:20 | |
| *** ttsiouts has quit IRC | 13:24 | |
| *** ttsiouts has joined #openstack-meeting-alt | 13:25 | |
| *** bhavikdbavishi has quit IRC | 13:29 | |
| *** ttsiouts_ has joined #openstack-meeting-alt | 13:29 | |
| *** ttsiouts has quit IRC | 13:30 | |
| *** priteau has quit IRC | 13:40 | |
| *** priteau has joined #openstack-meeting-alt | 13:44 | |
| *** munimeha1 has joined #openstack-meeting-alt | 13:45 | |
| *** janki has quit IRC | 13:50 | |
| *** raildo_ has joined #openstack-meeting-alt | 14:11 | |
| *** raildo_ has quit IRC | 14:13 | |
| *** raildo has joined #openstack-meeting-alt | 14:13 | |
| *** irclogbot_1 has quit IRC | 14:15 | |
| *** janki has joined #openstack-meeting-alt | 14:29 | |
| *** wxy| has joined #openstack-meeting-alt | 14:30 | |
| *** imus has joined #openstack-meeting-alt | 14:35 | |
| *** bhavikdbavishi has joined #openstack-meeting-alt | 14:43 | |
| *** ttsiouts_ has quit IRC | 14:44 | |
| *** janki has quit IRC | 14:44 | |
| *** ttsiouts has joined #openstack-meeting-alt | 14:44 | |
| *** ttsiouts_ has joined #openstack-meeting-alt | 14:46 | |
| *** hongbin has joined #openstack-meeting-alt | 14:47 | |
| *** ttsiouts has quit IRC | 14:49 | |
| *** ttsiouts_ has quit IRC | 14:50 | |
| *** irclogbot_1 has joined #openstack-meeting-alt | 14:55 | |
| *** dpawlik has quit IRC | 15:04 | |
| *** liuyulong has quit IRC | 15:06 | |
| *** dpawlik has joined #openstack-meeting-alt | 15:40 | |
| *** liuyulong_ has quit IRC | 15:41 | |
| *** dpawlik has quit IRC | 15:45 | |
| *** imus has quit IRC | 15:45 | |
| *** erus has joined #openstack-meeting-alt | 15:46 | |
| *** gagehugo has joined #openstack-meeting-alt | 15:46 | |
| *** imus has joined #openstack-meeting-alt | 15:47 | |
| lbragstad | #startmeeting keystone | 16:00 |
|---|---|---|
| openstack | Meeting started Tue Dec 4 16:00:39 2018 UTC and is due to finish in 60 minutes. The chair is lbragstad. Information about MeetBot at http://wiki.debian.org/MeetBot. | 16:00 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 16:00 |
| *** openstack changes topic to " (Meeting topic: keystone)" | 16:00 | |
| openstack | The meeting name has been set to 'keystone' | 16:00 |
| cmurphy | o/ | 16:00 |
| lbragstad | #link https://etherpad.openstack.org/p/keystone-weekly-meeting | 16:00 |
| lbragstad | agenda ^ | 16:00 |
| lbragstad | o/ | 16:00 |
| knikolla | o/ | 16:01 |
| kmalloc | o/ | 16:01 |
| lbragstad | we'll give folks a minute or two | 16:01 |
| * kmalloc drinks coffee | 16:01 | |
| gagehugo | o/ | 16:02 |
| *** wxy| has left #openstack-meeting-alt | 16:02 | |
| lbragstad | alright | 16:03 |
| *** wxy| has joined #openstack-meeting-alt | 16:03 | |
| lbragstad | #topic Welcome Outreachy Interns | 16:04 |
| *** openstack changes topic to "Welcome Outreachy Interns (Meeting topic: keystone)" | 16:04 | |
| lbragstad | cmurphy o/ | 16:04 |
| wxy| | o/ | 16:04 |
| cmurphy | hello | 16:04 |
| cmurphy | So for this outreachy round we have two interns, erus and imus | 16:04 |
| cmurphy | please give them a warm welcome | 16:04 |
| lbragstad | awesome! | 16:04 |
| lbragstad | hi erus and imus | 16:04 |
| imus | hi | 16:04 |
| cmurphy | erus will be working on some federation improvements and imus will be working on the api unit test refactor | 16:05 |
| wxy| | welcome~ | 16:05 |
| gagehugo | hey! | 16:05 |
| kmalloc | woohoo! great to have you all | 16:05 |
| erus | Hi everyone thanks o/ | 16:05 |
| imus | Thanks | 16:05 |
| knikolla | welcome :) | 16:05 |
| * kmalloc cheers for imus and erus | 16:05 | |
| imus | :) | 16:05 |
| cmurphy | that's about all I had for that, glad to have erus and imus on board :) | 16:05 |
| erus | Glad to have the opportunity :) | 16:06 |
| lbragstad | imus erus i'm located in utc-6, don't hesitate to reach out if you have questions | 16:06 |
| erus | Thanks cmurphy | 16:06 |
| kmalloc | we have pretty good coverage | 16:06 |
| *** hongbin has quit IRC | 16:06 | |
| cmurphy | erus: imus: by the way lbragstad is the Project Technical Lead so he knows everything | 16:06 |
| lbragstad | false | 16:06 |
| cmurphy | ;) | 16:06 |
| lbragstad | i "pretend" to know everything | 16:07 |
| erus | Haha | 16:07 |
| lbragstad | but i end up leaning on everyone else when i'm wrong ;) | 16:07 |
| erus | I'm in utc-3 | 16:07 |
| erus | XD | 16:07 |
| lbragstad | erus cool - that sounds good | 16:07 |
| kmalloc | i'll probably be awake later than most folks, hm.. Pacific is UTC-8 now? | 16:07 |
| kmalloc | so i'll be around probably later than most folks. | 16:07 |
| erus | Cool | 16:08 |
| kmalloc | also lbragstad does know everything | 16:08 |
| kmalloc | :P | 16:08 |
| erus | I'm always awake too xd | 16:08 |
| erus | So good to have a mixed utc team :) | 16:08 |
| * kmalloc is just trying to make everyone to not look at git blame and see "Morgan" name on everything | 16:09 | |
| lbragstad | alright - few more things on the agenda | 16:09 |
| lbragstad | #topic Summit recap | 16:09 |
| *** openstack changes topic to "Summit recap (Meeting topic: keystone)" | 16:09 | |
| kmalloc | yeah. it's a great team. i'm super happy we got to add both of you to it (at least for now! hopefully longer after outreachy finishes this cycle) | 16:09 |
| lbragstad | in case you haven't noticed, the foundation has updated all the recorded content from the summit | 16:10 |
| erus | Yeah it would be great! | 16:10 |
| imus | happy to be here and yes hopefully for longer | 16:10 |
| lbragstad | i've put together a short summary of keystone and TC related content https://www.lbragstad.com/blog/openstack-summit-berlin-recap | 16:10 |
| kmalloc | the thumbnail for the talk ayoung, knikolla, and I did is perfect :P | 16:11 |
| lbragstad | does anyone else know of recaps floating around? | 16:11 |
| knikolla | can't imagine it happening accidentally | 16:11 |
| cmurphy | I didn't do one this time | 16:11 |
| lbragstad | ack - just double checking | 16:11 |
| lbragstad | #topic Outstanding Reviews | 16:12 |
| *** openstack changes topic to "Outstanding Reviews (Meeting topic: keystone)" | 16:12 | |
| * kmalloc didn't do a keystone IDP recap... but next summit/ptg expects to. | 16:12 | |
| kmalloc | since we'll be further along | 16:12 |
| lbragstad | kmalloc good idea | 16:12 |
| lbragstad | alright - does anyone have patches up for review that they need eyes on? | 16:12 |
| *** hongbin has joined #openstack-meeting-alt | 16:13 | |
| lbragstad | specification reviews included | 16:13 |
| cmurphy | https://review.openstack.org/615190 | 16:14 |
| kmalloc | https://review.openstack.org/#/c/605043/ | 16:14 |
| cmurphy | https://review.openstack.org/615847 | 16:14 |
| cmurphy | poor ldappool gets no love | 16:14 |
| kmalloc | cmurphy: +2/A on ldappool | 16:14 |
| kmalloc | done | 16:14 |
| kmalloc | the keystoneauth rate-limit patch needs eyes | 16:14 |
| kmalloc | it has a functional cross-over test with SDK, we should eventually have a first-party in-tree test too | 16:15 |
| kmalloc | but i'm ok with it as long as we have eyes on the code | 16:15 |
| cmurphy | also it's not ready yet but i wouldn't mind feedback on https://review.openstack.org/615384 | 16:15 |
| lbragstad | cmurphy ah - i was going to start looking at that earlier today, but saw it was still WIP | 16:15 |
| lbragstad | kmalloc ack - i can take a look today | 16:15 |
| wxy| | cmurphy: the guide is awesome, I'm waiting for the TODO part. :) | 16:16 |
| cmurphy | :) | 16:16 |
| cmurphy | need to find some extra time to get back to it | 16:17 |
| kmalloc | it's amazing how there always seems to be no time | 16:17 |
| lbragstad | fact | 16:17 |
| *** markstur has joined #openstack-meeting-alt | 16:17 | |
| lbragstad | any other reviews people want to draw attention to? | 16:17 |
| lbragstad | #link https://review.openstack.org/#/c/614195/ will unblock some patches for us in keystone | 16:18 |
| lbragstad | same iwth | 16:18 |
| lbragstad | #link https://review.openstack.org/#/c/611443/ | 16:18 |
| lbragstad | i also re-spun all the patches for implementing default roles late last week | 16:19 |
| lbragstad | those should be passing and ready for some eyes | 16:19 |
| lbragstad | #link https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:implement-default-roles | 16:19 |
| lbragstad | and some patches to cleanup the policy.v3cloudsample.json | 16:20 |
| lbragstad | #link https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:clean-up-v3-cloud-sample | 16:20 |
| lbragstad | alright - moving on | 16:21 |
| lbragstad | #topic Renewable Application Credentials | 16:21 |
| *** openstack changes topic to "Renewable Application Credentials (Meeting topic: keystone)" | 16:21 | |
| lbragstad | knikolla o/ | 16:21 |
| knikolla | o/ | 16:21 |
| knikolla | spec is up | 16:21 |
| knikolla | #link https://review.openstack.org/#/c/604201/ | 16:22 |
| kmalloc | hooray! | 16:22 |
| knikolla | i have reworked it a bit from the discussion we had last week | 16:22 |
| * kmalloc quickly +2/+As it before anyone can -1 it :P | 16:22 | |
| knikolla | mainly i kept one list of roles instead of two | 16:22 |
| * kmalloc adds this to a list to review today | 16:22 | |
| kmalloc | knikolla: ok, i'm interested in how that ends up working. | 16:22 |
| knikolla | and added `last_renewed` and `identity_provider` | 16:22 |
| knikolla | to the app cred model | 16:22 |
| kmalloc | hm. | 16:22 |
| kmalloc | but how does it work with knowing if a role is conferred via the IDP vs concretely on creation? | 16:23 |
| lbragstad | i missed that discussion last week, but i'll take a pass at the spec before i start firing off questions | 16:23 |
| knikolla | the entire app cred deactivates when it's not renewed. | 16:23 |
| kmalloc | so we know what roles might change. | 16:23 |
| knikolla | to prevent users from indefinitely logging in even though their account in the idp has been disabled | 16:23 |
| knikolla | (this one was influenced by our cloud admin) | 16:24 |
| kmalloc | or do we not care and just look when the IDP conferred roles change to see if the app cred's roles are valid? | 16:24 |
| kmalloc | so if a role changes and no longer available just invalidate? | 16:24 |
| knikolla | on renew we expand the group membership and see if it has all the roles | 16:24 |
| knikolla | if it doesn't. fail renew | 16:24 |
| knikolla | yup | 16:24 |
| kmalloc | ok. | 16:24 |
| knikolla | on concrete roles, the current logic disables the app cred already if i'm not mistaked. | 16:24 |
| kmalloc | and it is still possible to create an unexpired/non-renewable app cred based upon concrete roles? | 16:24 |
| knikolla | when a concrete role is removed | 16:24 |
| knikolla | yes, if not using a federated token | 16:25 |
| lbragstad | iirc - that's handled with a callback | 16:25 |
| knikolla | if federated token, enforce renewal | 16:25 |
| kmalloc | and it looks like you are limiting an app cred to roles from a single IDP | 16:25 |
| kmalloc | just from your description | 16:25 |
| knikolla | because roles are in the token | 16:25 |
| kmalloc | since the app-cred (not the roles) are linked to the IDP | 16:25 |
| knikolla | through groups | 16:25 |
| * kmalloc is ok with this. | 16:25 | |
| knikolla | and user will present the token to get an app cred | 16:25 |
| knikolla | can't really have a token with roles from multiple idps | 16:26 |
| kmalloc | and the IDP still configures the refresh window/period then | 16:26 |
| kmalloc | knikolla: true. | 16:26 |
| kmalloc | we might need to revisit that with full IDP/autoprovision | 16:26 |
| knikolla | yes, there is a default ttl for backwards compat with existing idps in the db, configurable | 16:26 |
| kmalloc | but for now, this is a good starting place | 16:26 |
| kmalloc | knikolla: perfect. | 16:26 |
| knikolla | also the idp of the app cred changes if the user comes in through a different idp to renew but has same roles | 16:27 |
| knikolla | and the ttl changes based on the last idp to renew | 16:27 |
| kmalloc | hm. | 16:27 |
| kmalloc | so, a new app cred is implicitly created if a renew is done via a different idp? | 16:28 |
| kmalloc | or just idp updatE? | 16:28 |
| knikolla | kmalloc: no, just the idp associated with it changes for calculating the expiration. | 16:28 |
| kmalloc | because that sounds... broken | 16:28 |
| kmalloc | i'll review the spec | 16:29 |
| kmalloc | i want to think on that | 16:29 |
| *** tetsuro has joined #openstack-meeting-alt | 16:29 | |
| kmalloc | i am not sure i want to see app-creds change owning idp. $securityconcerns$ | 16:29 |
| knikolla | ++, i don't feel strongly about it. | 16:29 |
| knikolla | this was mostly for UX. | 16:29 |
| knikolla | the roles are immutable either way. | 16:30 |
| kmalloc | i might ask a lot more ux related questions on that front | 16:30 |
| knikolla | can't add or remove after expiration. | 16:30 |
| knikolla | creation* | 16:30 |
| kmalloc | but i have security concerns, i'll comment on the spec | 16:30 |
| knikolla | ok, cool. | 16:30 |
| kmalloc | can be not-in-meeting :) | 16:30 |
| knikolla | i'll be around office hours for all questions | 16:30 |
| * kmalloc nods. | 16:30 | |
| lbragstad | thanks knikolla | 16:30 |
| lbragstad | anything else on this? | 16:31 |
| knikolla | i think that's all i had, i'll be around in the office hours to discuss in more detail. | 16:32 |
| knikolla | please review the spec | 16:32 |
| lbragstad | sounds good | 16:32 |
| lbragstad | #topic admin role deletion | 16:32 |
| *** openstack changes topic to "admin role deletion (Meeting topic: keystone)" | 16:32 | |
| lbragstad | cmurphy again | 16:32 |
| cmurphy | hi | 16:32 |
| cmurphy | so a customer of ours had an outage where an inexperienced administrator accidentally deleted the admin role via horizon | 16:33 |
| kmalloc | eek | 16:33 |
| kmalloc | like... EEEEEK | 16:33 |
| cmurphy | it's pretty destructive since usually service users use the admin role too | 16:33 |
| knikolla | hmmm... do we want to take the next steps and make default roles immutable? | 16:33 |
| kmalloc | knikolla: no. | 16:33 |
| cmurphy | so my team mate was inquiring if this is something we can deal with upstream somehow | 16:34 |
| knikolla | thought so | 16:34 |
| kmalloc | i could see a "resource option" for immutable though | 16:34 |
| lbragstad | cmurphy is there a particular solution your team is looking for? | 16:34 |
| knikolla | like a "lock" | 16:34 |
| kmalloc | but not inherently immutable | 16:34 |
| kmalloc | as in, something that could be toggled. | 16:34 |
| lbragstad | are they looking for a "confirm delete" workflow? | 16:34 |
| cmurphy | lbragstad: no we're not advocating anything specific, just make it harder to footgun like this | 16:34 |
| cmurphy | i suggested maybe just make a "are you sure?" thing in horizon but that doesn't help if you accidentally do this with the cli | 16:35 |
| lbragstad | yeah... | 16:35 |
| cmurphy | which is a likely scenario in bad scripts | 16:35 |
| kmalloc | i think a resource option with an immutable flag (or locked, whatever UX is best) would be great... this is a lot mroe work though since horizon doesn't understand Resource Options | 16:36 |
| kmalloc | also, *wince* soft delete(s) in general make recovery easier. | 16:36 |
| lbragstad | hmm | 16:37 |
| kmalloc | if we implement a resource option for roles, i'd like to see the "cannot be changed/deleted" added to other resources as well via the same mechanism | 16:37 |
| lbragstad | to be consistent with other resources, we could implement enabled/disabled for roles and have the default behavior for deleting a role be to disable it first | 16:38 |
| cmurphy | lbragstad: the problem with that is it's not backwards compatible | 16:38 |
| *** tetsuro has quit IRC | 16:38 | |
| kmalloc | cmurphy: ++ | 16:38 |
| lbragstad | true | 16:38 |
| kmalloc | we could add an opt-in "this is locked" | 16:38 |
| kmalloc | we cannot change basic delete behavior | 16:38 |
| kmalloc | (in v3) | 16:38 |
| cmurphy | but adding it as a resource option might work, but it would only be useful if the default behavior of bootstrap is to set that flag | 16:38 |
| kmalloc | cmurphy: i'm ok with making that the default behavior | 16:39 |
| kmalloc | or at least bootstrap to add that as an option | 16:39 |
| kmalloc | --make-created-roles-immutable | 16:39 |
| knikolla | we can also add keystone doctor checks | 16:39 |
| knikolla | your admin role is not locked, an admin might accidentally delete it | 16:39 |
| kmalloc | for the transition period | 16:39 |
| *** tetsuro has joined #openstack-meeting-alt | 16:39 | |
| kmalloc | so 1) add Resource Option | 16:39 |
| kmalloc | 2) opt-in via bootstrap (doctor check saying "OMG LCOK THIS") | 16:40 |
| *** rdopiera has quit IRC | 16:40 | |
| kmalloc | 3) default behavior in bootstrap to set flag | 16:40 |
| kmalloc | with an opt-out flag. | 16:40 |
| knikolla | ++ | 16:40 |
| kmalloc | over... a release barrier between 2/3 | 16:40 |
| cmurphy | sounds good to me | 16:40 |
| lbragstad | cool - does someone want to write this up? | 16:40 |
| cmurphy | i'll bring this back to my teammate to see what they think | 16:40 |
| cmurphy | i can write it up as a backlog spec | 16:40 |
| kmalloc | cmurphy: ++ | 16:40 |
| lbragstad | awesome | 16:40 |
| cmurphy | probably won't have time to implement it this cycle | 16:40 |
| lbragstad | how high of a priority is this for your team? | 16:41 |
| kmalloc | we have some need to do resource opptions for projects this cycle | 16:41 |
| kmalloc | so it would be not a lot of work to add that construct to roles | 16:41 |
| kmalloc | at the same time. | 16:41 |
| cmurphy | lbragstad: well the customer recovered from it and the admin is now educated so not very high priority any more :) | 16:41 |
| lbragstad | ack | 16:41 |
| kmalloc | i also would like to lean on this before we expose the root-domain, so we can limit update and auto-set the immutable flag otherwise | 16:42 |
| cmurphy | ++ | 16:42 |
| lbragstad | at least until the next customer hits it | 16:42 |
| kmalloc | rather than needing to exempt it from delete/update/etc apis | 16:42 |
| lbragstad | makes sense | 16:42 |
| lbragstad | cool - so long as we get the approach written down, that'll be a good start | 16:43 |
| knikolla | ++ | 16:43 |
| kmalloc | and later today (once I get my new monitor) i can start hacking on code/specs again for things this cycle | 16:43 |
| lbragstad | anything else here? | 16:43 |
| kmalloc | i can lump in resource option additions for roles | 16:43 |
| kmalloc | and we can add the immutable work as a followup | 16:43 |
| knikolla | kmalloc: uuu new monitor, nice | 16:44 |
| * kmalloc is planning to expand resource options as a default for all resources | 16:44 | |
| kmalloc | even if it's unused. | 16:44 |
| kmalloc | silly not to | 16:44 |
| kmalloc | that way it's trivial to add this type of stuff when needed. | 16:44 |
| * kmalloc is done with this topic. | 16:45 | |
| lbragstad | #topic identity provider proxy diagram | 16:45 |
| *** openstack changes topic to "identity provider proxy diagram (Meeting topic: keystone)" | 16:45 | |
| kmalloc | ok so this is VERY rough | 16:45 |
| kmalloc | and early on | 16:45 |
| kmalloc | https://usercontent.irccloud-cdn.com/file/Au4e3DXb/Keystone%20IDP%20(initial)%20Diagram.png | 16:45 |
| kmalloc | this will get massively refined and have a DB schema diagram added as well as a UI site-map-y target diagram | 16:46 |
| cmurphy | #link https://usercontent.irccloud-cdn.com/file/Au4e3DXb/Keystone%20IDP%20(initial)%20Diagram.png IdP diagram | 16:46 |
| kmalloc | and this one will be split into a single diagram per-workflow | 16:46 |
| kmalloc | it doesn't show autoprovisioning | 16:46 |
| kmalloc | with that said, this is starting to show what the target of Keystone should be | 16:46 |
| kmalloc | and takes an initial stab at data-flows. | 16:47 |
| *** gyee has joined #openstack-meeting-alt | 16:47 | |
| kmalloc | please forgive the fact i did this at like... 3am in the morning | 16:47 |
| cmurphy | i like the icons | 16:47 |
| kmalloc | once i iterate a bit more we'll land this in a common/official place | 16:48 |
| cmurphy | suitcase == assignment | 16:48 |
| kmalloc | cmurphy: :) | 16:48 |
| *** iyamahat has joined #openstack-meeting-alt | 16:48 | |
| *** munimeha1 has quit IRC | 16:48 | |
| kmalloc | draw.io is pretty badass with the icons it has | 16:48 |
| kmalloc | and i'll render this as an .svg for our official space so we can iterate on it as things change within keystone | 16:48 |
| kmalloc | any questions/concerns.... happiness? | 16:49 |
| knikolla | seems fairly standard federation | 16:50 |
| kmalloc | yeah. it's just trying to give us an explicit target to reference | 16:50 |
| lbragstad | what's the difference between black highlight and white highlighting in the flows? | 16:50 |
| kmalloc | lbragstad: just so you could see the different ones | 16:50 |
| kmalloc | lbragstad: grouping | 16:50 |
| kmalloc | i will split those into separate diagrams down the line | 16:50 |
| lbragstad | ok | 16:50 |
| kmalloc | so non-openstack SPs, OpenStack SPs, Keystone Crud as an SP, and JS-UI | 16:51 |
| kmalloc | those will be data flow, and indicate autoprovision where needed. | 16:51 |
| kmalloc | i hope this is helping folks see what is in my head (as early as it is) | 16:51 |
| kmalloc | and each will be it's own diagram | 16:52 |
| lbragstad | ok | 16:52 |
| lbragstad | kmalloc how do you want feedback, just pings for now? | 16:52 |
| knikolla | devil will be in the details | 16:53 |
| kmalloc | lbragstad: yeah | 16:53 |
| kmalloc | since this is a first pass, it's just a "hey, everyone happy with the start of this direction?" | 16:53 |
| lbragstad | ok | 16:54 |
| lbragstad | i'll pick through this a bit more | 16:54 |
| lbragstad | thanks for putting this together kmalloc | 16:54 |
| kmalloc | expect it is missing most of the stuff still | 16:54 |
| kmalloc | :) | 16:54 |
| lbragstad | anything else on this? | 16:54 |
| kmalloc | it will get better with iterations | 16:54 |
| kmalloc | nothing else. i'm done | 16:54 |
| lbragstad | #topic open discussion | 16:54 |
| *** openstack changes topic to "open discussion (Meeting topic: keystone)" | 16:54 | |
| lbragstad | there has been a trend for people to just hold meetings in their respective IRC channels | 16:55 |
| lbragstad | how do people here feel about that? | 16:55 |
| cmurphy | -1 | 16:55 |
| cmurphy | it's nice to have it in a shared channel because we tend to pull in people from other projects randomly | 16:56 |
| lbragstad | true | 16:56 |
| cmurphy | also we get enough traffic in the main channel that i think it's better to split out the meeting so that people asking questions dont' feel like they have to wait for the meeting to be over | 16:56 |
| lbragstad | ok - that's fair | 16:57 |
| lbragstad | anything else for open discussion? | 16:57 |
| kmalloc | -1 | 16:58 |
| kmalloc | same reason supplied as cmurphy | 16:58 |
| *** cloudrancher has quit IRC | 16:59 | |
| lbragstad | alright - with that, we're about out of time | 16:59 |
| lbragstad | thanks for attending | 16:59 |
| lbragstad | #endmeeting | 16:59 |
| *** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings/" | 16:59 | |
| openstack | Meeting ended Tue Dec 4 16:59:46 2018 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 16:59 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/keystone/2018/keystone.2018-12-04-16.00.html | 16:59 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/keystone/2018/keystone.2018-12-04-16.00.txt | 16:59 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/keystone/2018/keystone.2018-12-04-16.00.log.html | 16:59 |
| *** cloudrancher has joined #openstack-meeting-alt | 17:00 | |
| *** wxy| has quit IRC | 17:01 | |
| *** e0ne has quit IRC | 17:13 | |
| *** ccamacho has quit IRC | 17:15 | |
| *** dpawlik has joined #openstack-meeting-alt | 17:15 | |
| *** sridharg has quit IRC | 17:22 | |
| *** kopecmartin is now known as kopecmartin|off | 17:26 | |
| *** cloudrancher has quit IRC | 17:32 | |
| *** jcoufal has quit IRC | 17:32 | |
| *** cloudrancher has joined #openstack-meeting-alt | 17:33 | |
| *** jcoufal has joined #openstack-meeting-alt | 17:37 | |
| *** bhavikdbavishi has quit IRC | 17:41 | |
| *** derekh has quit IRC | 17:46 | |
| *** cloudrancher has quit IRC | 17:49 | |
| *** cloudrancher has joined #openstack-meeting-alt | 17:49 | |
| *** iyamahat has quit IRC | 17:49 | |
| *** rdopiera has joined #openstack-meeting-alt | 17:52 | |
| *** cloudrancher has quit IRC | 17:59 | |
| *** cloudrancher has joined #openstack-meeting-alt | 18:00 | |
| *** iyamahat has joined #openstack-meeting-alt | 18:03 | |
| *** iyamahat_ has joined #openstack-meeting-alt | 18:06 | |
| *** iyamahat has quit IRC | 18:09 | |
| *** e0ne has joined #openstack-meeting-alt | 18:13 | |
| *** yamahata has joined #openstack-meeting-alt | 18:20 | |
| *** e0ne has quit IRC | 18:30 | |
| *** erus has quit IRC | 18:49 | |
| *** betherly has joined #openstack-meeting-alt | 18:54 | |
| *** betherly has quit IRC | 18:58 | |
| *** jcoufal has quit IRC | 19:01 | |
| *** diablo_rojo has joined #openstack-meeting-alt | 19:01 | |
| *** diablo_rojo has quit IRC | 19:01 | |
| *** diablo_rojo has joined #openstack-meeting-alt | 19:01 | |
| *** e0ne has joined #openstack-meeting-alt | 19:03 | |
| *** erlon has quit IRC | 19:09 | |
| *** tssurya has quit IRC | 19:12 | |
| *** dpawlik has quit IRC | 19:30 | |
| *** dpawlik has joined #openstack-meeting-alt | 19:31 | |
| *** rdopiera has quit IRC | 19:38 | |
| *** erlon has joined #openstack-meeting-alt | 19:53 | |
| *** e0ne has quit IRC | 19:58 | |
| *** tetsuro has quit IRC | 20:29 | |
| *** cloudrancher has quit IRC | 20:37 | |
| *** cloudrancher has joined #openstack-meeting-alt | 20:37 | |
| *** dpawlik has quit IRC | 21:01 | |
| *** tpsilva has quit IRC | 21:32 | |
| *** radeks__ has quit IRC | 21:47 | |
| *** raildo has quit IRC | 22:02 | |
| *** slaweq has quit IRC | 22:20 | |
| *** erlon has quit IRC | 22:33 | |
| *** dave-mccowan has quit IRC | 22:33 | |
| *** rcernin has joined #openstack-meeting-alt | 22:34 | |
| *** slaweq has joined #openstack-meeting-alt | 22:37 | |
| *** slaweq has quit IRC | 22:42 | |
| *** rcernin_ has joined #openstack-meeting-alt | 22:45 | |
| *** rcernin has quit IRC | 22:45 | |
| *** slaweq has joined #openstack-meeting-alt | 22:53 | |
| *** priteau has quit IRC | 23:03 | |
| *** masahito has joined #openstack-meeting-alt | 23:04 | |
| *** slaweq has quit IRC | 23:10 | |
| *** masahito has quit IRC | 23:10 | |
| *** rcernin_ has quit IRC | 23:12 | |
| *** rcernin has joined #openstack-meeting-alt | 23:13 | |
| *** pbourke has quit IRC | 23:55 | |
| *** pbourke has joined #openstack-meeting-alt | 23:56 | |
| *** hongbin has quit IRC | 23:57 | |
| *** lhinds has quit IRC | 23:57 | |
| *** haleyb has quit IRC | 23:57 | |
| *** lhinds has joined #openstack-meeting-alt | 23:58 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!