Tuesday, 2020-04-14

*** openstack has joined #openstack-meeting-alt09:56
*** ChanServ sets mode: +o openstack09:56
*** tetsuro has quit IRC09:59
*** masahito has quit IRC10:02
*** ricolin has quit IRC10:09
*** ysandeep is now known as ysandeep|afk10:37
*** maaritamm has quit IRC10:52
*** ysandeep|afk is now known as ysandeep|rover10:53
*** apetrich has quit IRC11:09
*** maaritamm has joined #openstack-meeting-alt11:11
*** apetrich has joined #openstack-meeting-alt11:11
*** priteau has quit IRC11:14
*** andrebeltrami has joined #openstack-meeting-alt11:24
*** apetrich has quit IRC11:34
*** felipe_rodrigues has quit IRC11:37
*** ysandeep|rover is now known as ysandeep|coffee11:39
*** apetrich has joined #openstack-meeting-alt11:41
*** maaritamm has quit IRC11:43
*** maaritamm has joined #openstack-meeting-alt11:46
*** gshippey has joined #openstack-meeting-alt11:48
*** ysandeep|coffee is now known as ysandeep11:51
*** ysandeep is now known as ysandeep|rover11:56
*** vishalmanchanda has quit IRC12:11
*** felipe_rodrigues has joined #openstack-meeting-alt12:13
*** maaritamm has quit IRC12:20
*** maaritamm has joined #openstack-meeting-alt12:21
*** links has quit IRC12:31
*** raildo has joined #openstack-meeting-alt12:39
*** lpetrut has quit IRC12:54
*** lpetrut has joined #openstack-meeting-alt13:01
*** e0ne_ has joined #openstack-meeting-alt13:04
*** e0ne has quit IRC13:05
*** vishalmanchanda has joined #openstack-meeting-alt13:15
*** tmazur has joined #openstack-meeting-alt13:49
*** bcm has quit IRC13:50
*** hrybacki has quit IRC13:50
*** stevthedev has quit IRC13:50
*** walshh_ has quit IRC13:50
*** hrybacki has joined #openstack-meeting-alt13:50
*** walshh_ has joined #openstack-meeting-alt13:50
*** bcm has joined #openstack-meeting-alt13:51
*** stevthedev has joined #openstack-meeting-alt13:51
*** derekh has quit IRC13:56
*** derekh has joined #openstack-meeting-alt13:56
*** derekh has quit IRC13:59
*** derekh has joined #openstack-meeting-alt14:00
*** ttsiouts has quit IRC14:00
*** ttsiouts has joined #openstack-meeting-alt14:04
*** lpetrut has quit IRC14:24
*** maaritamm has quit IRC14:39
*** ysandeep|rover is now known as ysandeep|away14:50
*** raymonddeng has joined #openstack-meeting-alt14:59
*** raymonddeng has quit IRC15:03
*** ricolin has joined #openstack-meeting-alt15:03
*** ricolin_ has joined #openstack-meeting-alt15:03
*** ricolin_ has quit IRC15:03
*** dosaboy_ is now known as dosaboy15:04
*** ttsiouts has quit IRC15:10
*** ttsiouts has joined #openstack-meeting-alt15:11
*** Nizars has joined #openstack-meeting-alt15:13
Nizars#startmeeting keystone15:13
openstackMeeting started Tue Apr 14 15:13:41 2020 UTC and is due to finish in 60 minutes.  The chair is Nizars. Information about MeetBot at http://wiki.debian.org/MeetBot.15:13
openstackUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.15:13
*** openstack changes topic to " (Meeting topic: keystone)"15:13
openstackThe meeting name has been set to 'keystone'15:13
*** maaritamm has joined #openstack-meeting-alt15:14
bnemecI don't think it's keystone meeting time...15:14
gagehugoit's not15:14
gagehugosupposed to be osh meeting15:14
NizarsHaha sorry thought I got really lucky with the timing15:15
NizarsUTC timing error15:15
gagehugo#endmeeting15:15
NizarsIt starts in 1 hour 45 minutes though right?15:15
gagehugoyes15:15
Nizarsthank you15:16
gagehugocan you end the meeting Nizars?15:16
Nizars#endmeeting15:16
*** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings/"15:16
Nizars#endmeeting keystone15:16
openstackMeeting ended Tue Apr 14 15:16:16 2020 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)15:16
openstackMinutes:        http://eavesdrop.openstack.org/meetings/keystone/2020/keystone.2020-04-14-15.13.html15:16
openstackMinutes (text): http://eavesdrop.openstack.org/meetings/keystone/2020/keystone.2020-04-14-15.13.txt15:16
openstackLog:            http://eavesdrop.openstack.org/meetings/keystone/2020/keystone.2020-04-14-15.13.log.html15:16
gagehugothx15:16
NizarsI am terribly sorry for the trouble15:16
gagehugo#startmeeting openstack-helm15:17
openstackMeeting started Tue Apr 14 15:17:12 2020 UTC and is due to finish in 60 minutes.  The chair is gagehugo. Information about MeetBot at http://wiki.debian.org/MeetBot.15:17
openstackUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.15:17
*** openstack changes topic to " (Meeting topic: openstack-helm)"15:17
openstackThe meeting name has been set to 'openstack_helm'15:17
gagehugo#link https://etherpad.opendev.org/p/openstack-helm-meeting-2020-04-14 agenda15:17
lamto/15:18
gagehugoapologies for the late start, this other meeting is taking too long15:18
gagehugoo/15:18
stevthedevgood morning15:18
gagehugo#topic moving to new etherpad15:22
*** openstack changes topic to "moving to new etherpad (Meeting topic: openstack-helm)"15:22
gagehugoSo starting next week, the meeting agenda will be found here15:22
gagehugo#link https://etherpad.opendev.org/p/openstack-helm-weekly-meeting15:22
gagehugoinstead of creating a new etherpad each week15:22
gagehugoI will copy in this years pad agendas from previous meetings into that one15:22
gagehugofor history15:23
gagehugo#topic Reviews15:23
*** openstack changes topic to "Reviews (Meeting topic: openstack-helm)"15:23
gagehugoDon't see any listed atm, if there's something someone wants reviewed, please ping me in the openstack-helm irc channel15:24
gagehugo#topic open discussion15:24
*** openstack changes topic to "open discussion (Meeting topic: openstack-helm)"15:24
gagehugoDoes anyone have anything else they want to discuss, the floor is open15:24
gagehugothanks everyone, again sorry for the late start, have a good rest of the week15:28
gagehugo#endmeeting openstack-helm15:28
*** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings/"15:28
openstackMeeting ended Tue Apr 14 15:28:19 2020 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)15:28
openstackMinutes:        http://eavesdrop.openstack.org/meetings/openstack_helm/2020/openstack_helm.2020-04-14-15.17.html15:28
openstackMinutes (text): http://eavesdrop.openstack.org/meetings/openstack_helm/2020/openstack_helm.2020-04-14-15.17.txt15:28
openstackLog:            http://eavesdrop.openstack.org/meetings/openstack_helm/2020/openstack_helm.2020-04-14-15.17.log.html15:28
stevthedevSee ya15:28
*** gyee has joined #openstack-meeting-alt16:01
*** maaritamm has quit IRC16:09
*** enriquetaso has joined #openstack-meeting-alt16:17
*** maaritamm has joined #openstack-meeting-alt16:32
*** yaawang_ has joined #openstack-meeting-alt16:32
*** yaawang has quit IRC16:33
*** ricolin has quit IRC16:35
*** maaritamm has quit IRC16:45
*** derekh has quit IRC16:54
cmurphy#startmeeting keystone17:00
openstackMeeting started Tue Apr 14 17:00:57 2020 UTC and is due to finish in 60 minutes.  The chair is cmurphy. Information about MeetBot at http://wiki.debian.org/MeetBot.17:00
openstackUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.17:00
*** openstack changes topic to " (Meeting topic: keystone)"17:01
openstackThe meeting name has been set to 'keystone'17:01
vishakhao/17:01
bnemecDeja vu. ;-)17:01
cmurphy#link https://etherpad.opendev.org/p/keystone-weekly-meeting agenda17:01
cmurphysomeone else tried to start our meeting earlier? o.017:01
gagehugoo/17:02
gagehugoyes17:02
*** vishalmanchanda has quit IRC17:04
cmurphy#topic announcements17:05
*** openstack changes topic to "announcements (Meeting topic: keystone)"17:05
cmurphyfeature freeze was last week, we actually got everything in on time without having a ci crisis \o/17:05
cmurphyRC1 will be next week, please help test current master and report/fix bugs asap17:06
cmurphyand please help monitor launchpad for incoming release-critical bugs17:07
vishakha+117:07
cmurphy#topic l1 duty rotation17:08
*** openstack changes topic to "l1 duty rotation (Meeting topic: keystone)"17:08
knikollao/17:09
vishakhaI am on this week bug duty17:09
cmurphythanks vishakha17:09
cmurphygagehugo: was last week, there's a couple bugs linked on the agenda?17:10
gagehugofrom today yeah17:10
gagehugoresponded to one, might just be a install misconfiguration17:10
gagehugoother one haven't yet17:10
cmurphyseems like they need to check their keystone logs17:11
cmurphyhttps://bugs.launchpad.net/keystone/+bug/1872732 seems like a reasonable feature request, not release critical though17:11
openstackLaunchpad bug 1872732 in OpenStack Identity (keystone) "no user limit of ec2 credentials" [Undecided,New]17:11
cmurphyi saw https://bugs.launchpad.net/keystone/+bug/1871784 come in this week, anyone looked into that?17:12
openstackLaunchpad bug 1871784 in OpenStack Identity (keystone) "create a user use ignore_password_expiry but still has expires_at to db" [Undecided,New]17:12
gagehugolooking17:13
cmurphyi'm not entirely sure what they're asking tbh17:14
gagehugoIm guessing that the password expires at isn't updating when you apply the ignore user option?17:14
gagehugobut im not sure17:15
cmurphysomeone want to get clarification?17:16
vishakhaI will update and clarify17:17
cmurphythanks vishakha17:17
cmurphyi'll take next week17:17
cmurphy#topic review requests17:18
*** openstack changes topic to "review requests (Meeting topic: keystone)"17:18
vishakhaThere's one more bug https://bugs.launchpad.net/keystone/+bug/187275317:18
openstackLaunchpad bug 1872753 in OpenStack Identity (keystone) "Updating EC2 credential blob can lead to a ec2 credential id / credential id mismatch" [Undecided,New]17:18
vishakhaI will try to reproduc17:18
cmurphygreat, thanks vishakha17:18
cmurphysome review requests from vishakha too17:19
vishakha:)17:19
cmurphylooks like the k2k tempest case is ready https://review.opendev.org/#/c/704271/17:20
cmurphyi will take a look at that as well as the doc updates17:20
gagehugovishakha: that bug probably wasn't supposed to be public17:21
gagehugolooks security related17:21
vishakhaThanks cmurphy17:21
vishakhagagehugo: What is to be done in such case?17:22
NizarsIs the keystone ongoing right now? Do i need to type anything to join it?17:23
gagehugousually marked as security related, but this one might not be, its looking like it's more leaving orphaned credentials than anything vulnerability related17:23
gagehugoNizars: you're in it right now17:24
NizarsThank you17:24
knikollaNizars: generally you don't need to type anything to join meetings, except be on the right channel at the right time17:24
NizarsLet me know when I can bring up an issue me and my team are working on.17:24
cmurphyany other review requests before we move to open floor?17:25
cmurphy#topic open floor17:26
*** openstack changes topic to "open floor (Meeting topic: keystone)"17:26
cmurphyNizars: what can we help you with?17:27
NizarsThank you very much. Me and my team, students from Sweden, are working on a horizon plugin for managing role based access management. The blueprint for the project can be found here: https://blueprints.launchpad.net/horizon/+spec/policies-plugin17:28
NizarsIt is a horizon project but we use Oslo and Keystone.17:28
*** e0ne_ has quit IRC17:29
NizarsOn a second thought, I think my questions are more appropriate in the Oslo meeting. My apologies. I pass the floor.17:30
gagehugoDoes it support yaml policies?17:30
*** ttsiouts has quit IRC17:30
bnemecIt's probably appropriate to discuss it here. There are likely more policy-savvy people here than in the Oslo meeting.17:30
NizarsWe are trying to implement a back end that retrieves effective policies both in the code and in file. reading from yaml files is to be implemented but it reads json files.17:31
bnemecMy initial reaction is that I wouldn't recommend writing a completely one-off tool for this.17:32
*** e0ne has joined #openstack-meeting-alt17:32
bnemecThere's quite a lot of subtle behaviors in oslo.policy that would be hard to keep in sync.17:32
NizarsThe problem is that the process of retrieving policies is heavy. It requests all the policies, writes them to a file, then our client loops through the file line by line to find the matching target, instantiates a  model and compliments its document fields such as scopes and operations from a local dict and then sends it to the front end.17:32
NizarsI feel that creating the whole operation ourselves would be better as long as we can create the checks to insure that the user provided rule is acceptable.17:33
*** ttsiouts has joined #openstack-meeting-alt17:33
NizarsWe are trying to look into what those checks are and what they do so that we ensure that they are correct.17:34
NizarsAnother thing that I noticed is that there are style inconsistencies in how the Operations values for policies are written. So we decided to just use our own.17:35
bnemecThis is probably where I should mention that I started on a policy validator tool: https://review.opendev.org/#/c/702757/17:35
NizarsThank you so much. I will read up on it.17:35
bnemecIt would be nice if we could keep as much validation logic common as possible.17:35
NizarsI agree, its just that oslo and keystone have been not very easy to work with especially from an api perspective.17:36
Nizarshere is an example of how some operation fields are provided: `['HEAD', 'GET'] /v3/system/groups/{group_id}/roles`17:37
Nizarsmeanwhile others are provided like this: ```PUT /v3/projects/{project_id}/users/{user_id}/roles/{role_id} PUT /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} PUT /v3/domains/{domain_id}/users/{user_id}/roles/{role_id}```17:38
NizarsI also have a question, some keystone policies don't have a project. what does that mean? are they global?17:38
NizarsFor example: `admin_required`17:39
Nizarsit doesn't have 'identity:` before it17:39
Nizarscompared to something like: `identity:check_endpoint_in_project`17:40
bnemecI believe admin_required is internal to the policy. It's not referenced by code, just by other policies.17:40
bnemec(but someone correct me if I'm wrong)17:40
NizarsI see17:40
NizarsThis is how the plugin looks like:17:41
Nizarshttps://i.imgur.com/TMxrv9d.gif17:41
NizarsWe just wrote global when project field is missing for now.17:41
*** e0ne has quit IRC17:42
NizarsThe biggest obstacle right now is just how much work is done by the plugin to retrieve a single policy. Which is the reason why we thought about skipping oslo and keystone and implementing the methods to get the policies ourselves. There is also no direct way for us to check when a new change to policies has been made so we have to keep running that generate method over and over.17:43
bnemecI feel like this might be a complex enough discussion that it's going to be hard to resolve within the meeting.17:44
bnemecWould you be open to writing up a spec against keystone and/or oslo that explains all of the design goals and the problems you're having?17:44
NizarsOur next step is to modify policies, which involves checking for a successful modification. This will require a number of process to be carried out from checking with the enforced, file writing, and retreiving everything again.17:44
* lbragstad is suffering off-by-one errors17:46
bnemecModifying policy through Horizon sounds very problematic to me. You're going to have to essentially build a config management system in the plugin.17:46
bnemecAnd somehow make sure it plays nicely with the operator's existing config management system.17:46
NizarsWe are willing to do that.17:46
gagehugoI assume there will be a policy to modify policies in horizon?17:46
Nizars@gagehugo I am not sure i follow17:47
gagehugoFor our use case, we do not want users modifying policy, so we would disable this17:47
gagehugobut that's just my 2 cents, I think I can see where this can be useful17:48
gagehugobut also my horizon knowledge is quite shallow17:48
NizarsGood point. I will check on that to make sure of who can make those changes in the plugin.17:48
NizarsThank you.17:48
cmurphyagreed with gagehugo, we typically only want cloud operators changing policies and they usually already have access to the files on disk to change them17:49
cmurphybut i can imagine having something to help visualizing them could be helpful in some cases17:49
NizarsOne thing the team has had an issue with was when the policy.json was deleted after creation (for testing) they got locked out of Horizon and had to roll back the server.17:49
gagehugoalso we deploy with read-only fs in most cases, so writing files will not be possible for the most part17:50
gagehugojust one use case here though17:51
cmurphyyeah this wouldn't work with most containerized deployments17:51
gagehugocmurphy: without some modification yeah17:51
NizarsYeah the project aims to simplify the process for those who would need to work on the policies. create back ups, restores, provide a json/yaml text editor with tools tips, auto complete, quick actions and so on. It isn't really made for everyone to work with but I will add those points and raise them in our next meeting.17:51
gagehugoI can see where this would be kinda useful for policy testing17:52
gagehugowhich is lacking for us currently17:52
NizarsThe goal is to be done by 31st of may but we have june to working on it. I plan to stay active on it after that.17:53
cmurphyNizars: thanks for sharing, it's a really interesting idea17:53
NizarsI am finally glad I am getting some communication on the irc channels.17:53
cmurphylike bnemec said we'd recommend trying to reuse as much of oslo.policy as you can for validation rather than reimplement a new thing17:53
NizarsTHank you17:53
cmurphyNizars: if you need any more help you can reach us in #openstack-keystone or #openstack-oslo you don't need to wait for a meeting17:54
NizarsI will look into it and prepare a document describing the problems we have for the next time we meet.17:54
cmurphysounds good17:55
bnemecCool, I know this sort of functionality is something that has been discussed quite a bit in the past too.17:55
NizarsFinal quick questions. How do we get the blueprint approved and how/when do we move the code to gerrit? it is currently on my private github.17:55
Nizarshttps://github.com/nizos/horizon-policies-plugin17:55
cmurphyyou'll have to talk to the horizon team about that17:56
NizarsThis is the wiki page for our project:17:56
Nizarshttps://wiki.nordix.org/display/RE/OpenStack+Policies17:56
NizarsOk, thank you!17:56
cmurphyany other topics for open floor?17:57
cmurphyokay thanks everyone17:59
cmurphy#endmeeting17:59
*** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings/"17:59
openstackMeeting ended Tue Apr 14 17:59:33 2020 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)17:59
openstackMinutes:        http://eavesdrop.openstack.org/meetings/keystone/2020/keystone.2020-04-14-17.00.html17:59
openstackMinutes (text): http://eavesdrop.openstack.org/meetings/keystone/2020/keystone.2020-04-14-17.00.txt17:59
openstackLog:            http://eavesdrop.openstack.org/meetings/keystone/2020/keystone.2020-04-14-17.00.log.html17:59
NizarsThank you17:59
*** ttsiouts has quit IRC18:00
*** ttsiouts has joined #openstack-meeting-alt18:02
*** maaritamm has joined #openstack-meeting-alt18:29
*** ttsiouts has quit IRC18:35
*** e0ne has joined #openstack-meeting-alt18:52
*** e0ne has quit IRC19:02
*** rdopiera has quit IRC19:03
*** gshippey has quit IRC19:03
*** ttsiouts has joined #openstack-meeting-alt19:10
*** ttsiouts has quit IRC19:15
*** e0ne has joined #openstack-meeting-alt19:22
*** e0ne has quit IRC19:40
*** ttsiouts has joined #openstack-meeting-alt19:45
*** maohongbo1 has joined #openstack-meeting-alt19:50
*** maohongbo has quit IRC19:52
*** maohongbo1 is now known as maohongbo19:52
*** maaritamm has quit IRC19:58
*** maaritamm has joined #openstack-meeting-alt19:59
*** tobberydberg_ has quit IRC20:17
*** ttsiouts has quit IRC20:19
*** tobberydberg has joined #openstack-meeting-alt20:22
*** tobberydberg has quit IRC20:30
*** tobberydberg has joined #openstack-meeting-alt20:36
*** tobberydberg has quit IRC20:37
*** tobberydberg has joined #openstack-meeting-alt20:42
*** tobberydberg has quit IRC20:43
*** tobberydberg has joined #openstack-meeting-alt20:45
*** tobberydberg has quit IRC20:45
*** tobberydberg has joined #openstack-meeting-alt20:46
*** tobberydberg has quit IRC20:46
*** tobberydberg has joined #openstack-meeting-alt20:46
*** tobberydberg has quit IRC20:47
*** tobberydberg has joined #openstack-meeting-alt20:47
*** tobberydberg has quit IRC20:47
*** maaritamm has quit IRC20:49
*** tobberydberg has joined #openstack-meeting-alt20:51
*** maohongbo1 has joined #openstack-meeting-alt20:51
*** maohongbo has quit IRC20:53
*** maohongbo1 is now known as maohongbo20:53
*** tobberydberg has quit IRC20:55
*** raildo has quit IRC21:10
*** ttsiouts has joined #openstack-meeting-alt21:22
*** ccamacho has quit IRC21:36
*** maohongbo has quit IRC21:54
*** maohongbo has joined #openstack-meeting-alt21:55
*** ttsiouts has quit IRC21:56
*** slaweq_ has quit IRC22:18
*** ttsiouts has joined #openstack-meeting-alt22:30
*** ttsiouts has quit IRC22:34
*** ttsiouts has joined #openstack-meeting-alt22:42
*** ttsiouts has quit IRC22:47
*** ircuser-1 has joined #openstack-meeting-alt23:19
*** ttsiouts has joined #openstack-meeting-alt23:22
*** ttsiouts has quit IRC23:56

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!