| openstackgerrit | Michał Piotrowski proposed openstack/monasca-thresh master: Create Docker image and build in Zuul https://review.opendev.org/649298 | 06:51 |
|---|---|---|
| *** openstackgerrit has quit IRC | 07:03 | |
| *** openstackgerrit has joined #openstack-monasca | 07:03 | |
| openstackgerrit | Merged openstack/monasca-notification master: Blacklist bandit and update sphinx requirement https://review.opendev.org/659115 | 07:03 |
| openstackgerrit | Dobroslaw Zybort proposed openstack/monasca-notification master: Fix statsd enable option in docker env https://review.opendev.org/656261 | 07:05 |
| *** pcaruana has joined #openstack-monasca | 07:13 | |
| *** witek has joined #openstack-monasca | 07:21 | |
| openstackgerrit | Merged openstack/monasca-notification master: Fix statsd enable option in docker env https://review.opendev.org/656261 | 08:52 |
| openstackgerrit | Merged openstack/monasca-persister master: Add tests for influxdb/alarm_state_history_repository.py https://review.opendev.org/655699 | 08:55 |
| openstackgerrit | Michał Piotrowski proposed openstack/monasca-agent master: Create Docker image from Monasca repos https://review.opendev.org/659508 | 09:39 |
| openstackgerrit | Merged openstack/monasca-common master: Dropping the py35 testing https://review.opendev.org/652418 | 09:46 |
| openstackgerrit | Dobroslaw Zybort proposed openstack/monasca-notification master: Fix loading of notification plugins https://review.opendev.org/656762 | 09:54 |
| openstackgerrit | Dobroslaw Zybort proposed openstack/monasca-notification master: Fix app_repo in Docker with new git url https://review.opendev.org/658761 | 09:56 |
| openstackgerrit | Arseni Lipinski proposed openstack/python-monascaclient master: Change links to opendev and links usage https://review.opendev.org/659074 | 09:59 |
| openstackgerrit | Arseni Lipinski proposed openstack/python-monascaclient master: Change links to opendev and links usage https://review.opendev.org/659074 | 10:19 |
| *** pcaruana has quit IRC | 10:27 | |
| openstackgerrit | Merged openstack/monasca-notification master: Fix loading of notification plugins https://review.opendev.org/656762 | 11:11 |
| openstackgerrit | Arseni Lipinski proposed openstack/python-monascaclient master: Change links to opendev and links usage https://review.opendev.org/659074 | 11:20 |
| openstackgerrit | Arseni Lipinski proposed openstack/python-monascaclient master: Change links to opendev and links usage https://review.opendev.org/659074 | 11:27 |
| *** pcaruana has joined #openstack-monasca | 11:37 | |
| openstackgerrit | Dobroslaw Zybort proposed openstack/monasca-persister master: Add tests for cassandra/alarm_state_history_repository.py https://review.opendev.org/653703 | 11:38 |
| witek | adriancz: Dobroslaw: sc: could we please merge these: https://review.opendev.org/#/q/status:open+topic:convert_readme | 12:01 |
| witek | without them creating releases on Pike and Queens is not possible | 12:01 |
| witek | we'll need this one as well: https://review.opendev.org/651611 | 12:02 |
| adriancz | @witek merged | 12:53 |
| witek | thanks, I hope CI won't get out of line | 12:55 |
| openstackgerrit | Michał Piotrowski proposed openstack/monasca-ui master: Unit tests fail https://review.opendev.org/651512 | 12:58 |
| openstackgerrit | Michał Piotrowski proposed openstack/monasca-ui master: Unit tests fail https://review.opendev.org/651512 | 13:09 |
| mkarpiarz | If I add a role from the "read_only_authorized_roles" list to a regular user on a tenant which the monasca-agent writes metrics to | 13:36 |
| mkarpiarz | (i.e. the one specified by "project_name" in the collector's config) | 13:36 |
| mkarpiarz | then this user can see metrics of other users, even in different tenants. This includes the admin user. | 13:38 |
| mkarpiarz | Is this expected behaviour? | 13:40 |
| witek | no, only own tenant should be allowed | 13:41 |
| mkarpiarz | Thought so, as the situation I described pretty much breaks multitenancy. :/ | 13:42 |
| mkarpiarz | This is my setup: my admin user has "admin" role in its own admin tenant, | 13:44 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-common master: Upgrade Python and Alpine https://review.opendev.org/659566 | 13:45 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-common master: Change links usage https://review.opendev.org/659073 | 13:45 |
| mkarpiarz | this regular user has "_member_" role in its own tenant (which is different than the admin's tenant) | 13:46 |
| mkarpiarz | Now, I'm "_member_" role and the read-only role to both users on the tenant monasca-agent writes metrics to | 13:48 |
| mkarpiarz | and when I run `monasca metric-list` as the regular user, I can see metrics of the admin user as well. | 13:49 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-common master: Upgrade Alpine version https://review.opendev.org/659566 | 13:51 |
| witek | how many agents do you have? | 13:51 |
| mkarpiarz | Only one | 13:51 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-common master: Upgrade Python version https://review.opendev.org/659567 | 13:51 |
| witek | where do you get the measurements in admin project from? | 13:52 |
| mkarpiarz | Access logs suggest this regular user sends a call to `GET /v2.0/metrics` without specifying tenant_id. | 13:52 |
| witek | tenant_id parameter is optional, project information should be extracted from the token | 13:53 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-common master: Upgrade Alpine version https://review.opendev.org/659566 | 13:53 |
| mkarpiarz | So to which project is the user token scoped then? | 13:55 |
| mkarpiarz | I'd say to the one they share and not to their "private" ones. | 13:56 |
| *** pcaruana has quit IRC | 13:56 | |
| mkarpiarz | My admin user gets metrics from the same agent that gathers metrics for the regular user. | 13:57 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-common master: Upgrade Alpine version https://review.opendev.org/659566 | 13:57 |
| mkarpiarz | Is this wrong? Do I need as many agents as I have users? | 13:58 |
| witek | only libvirt and ovs plugins send measurements to multiple projects | 13:58 |
| mkarpiarz | Yes, I'm using the libvirt plugin. | 13:59 |
| mkarpiarz | So regular users shouldn't have access to metrics from this plugin at all then? | 14:00 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-common master: Upgrade Alpine version https://review.opendev.org/659566 | 14:00 |
| witek | OK, then you POST two sets of measurements, to admin project and user project | 14:00 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-common master: Change links usage https://review.opendev.org/659073 | 14:01 |
| witek | when you GET measurements you have to authorize the request with project scoped token | 14:01 |
| witek | and you should get measurement only for that project | 14:01 |
| mkarpiarz | OK, yes, this does work as expected when I add this read-only role to this regular user's tenant | 14:09 |
| mkarpiarz | and then scope my token to this user's private tenant. | 14:09 |
| mkarpiarz | In this situation I only get metrics from this tenant and not the admin one. | 14:10 |
| witek | can you authorize the request with unscoped token? | 14:10 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-common master: Change links usage in Dockerfile https://review.opendev.org/659073 | 14:12 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-common master: Change repository links usage in Dockerfile https://review.opendev.org/659073 | 14:13 |
| mkarpiarz | Yes, I can. Still only see this user's metrics. | 14:15 |
| mkarpiarz | So what should I do to if I want to share Grafana dashboards with this user? | 14:17 |
| witek | don't understand | 14:17 |
| mkarpiarz | In this shared project (both my users are still _member_s in there) I have a datasource configured to use Keystone auth | 14:19 |
| openstackgerrit | Michał Piotrowski proposed openstack/monasca-ui master: Fix failing unit tests https://review.opendev.org/651512 | 14:20 |
| mkarpiarz | and if I try to get metrics from the API, it returns a 401 | 14:21 |
| mkarpiarz | "GET /v2.0/metrics/statistics?statistics=avg&name=vm.cpu.utilization_perc&start_time=2019-05-15T14%3A20%3A44.962Z&period=300&alias=%40resource_id&group_by=%2A&end_time=2019-05-16T14%3A20%3A44.962Z HTTP/1.1" 401 86 126088 "-" "monascaclient/1.14.0 keystoneauth1/3.13.1 python-requests/2.21.0 CPython/2.7.5" | 14:22 |
| witek | are you using forked Grafana? | 14:23 |
| mkarpiarz | I can check how this request scopes the token, but I suspect it uses this shared tenant, as this is the one I'm now in Grafana. | 14:23 |
| mkarpiarz | $ grafana-server -v | 14:25 |
| mkarpiarz | Version 4.1.0-pre1 (commit: unknown-dev) | 14:25 |
| witek | that's probably the forked one with Keystone auth | 14:25 |
| witek | the user should scoped to the project selected in Grafana | 14:26 |
| witek | project - organisation | 14:26 |
| mkarpiarz | That's my understanding as well. | 14:27 |
| mkarpiarz | I'm currently in the shared project/org, because I can't share datasources and dashboards when in the "@Default" org. | 14:29 |
| mkarpiarz | Not sure why, but this is not something I can do it seems. | 14:30 |
| mkarpiarz | I have a datasource and dashboard set as admin@Default, but I can't see them when I log in as myuser@Default. | 14:31 |
| mkarpiarz | One would think this should work, right, as both users are in the same domain. | 14:32 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-common master: Change repository links usage in Dockerfile https://review.opendev.org/659073 | 14:32 |
| witek | I'm afraid I cannot help here, perhaps Dobroslaw can help on Monday | 14:33 |
| mkarpiarz | OK, I'm going to follow API calls more closely then and see where they lead me. | 14:37 |
| mkarpiarz | Thanks for your time, @witek! | 14:37 |
| witek | you're welcome | 14:37 |
| *** pcaruana has joined #openstack-monasca | 14:37 | |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-api master: Fix app_repo in Docker with new url https://review.opendev.org/658759 | 14:47 |
| *** UdayTKumar has joined #openstack-monasca | 14:50 | |
| openstackgerrit | Arseni Lipinski proposed openstack/python-monascaclient master: Change links to opendev and links usage https://review.opendev.org/659074 | 14:54 |
| *** chaconpiza has quit IRC | 15:00 | |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-api master: Change app_repo https://review.opendev.org/658759 | 15:10 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-api master: Change links to opendev and their usage https://review.opendev.org/658759 | 15:14 |
| openstackgerrit | Witold Bedyk proposed openstack/monasca-log-api master: Blacklist bandit 1.6.0 https://review.opendev.org/659598 | 15:24 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-log-api master: Change repository links usage in Dockerfile https://review.opendev.org/658757 | 15:32 |
| *** witek has quit IRC | 15:35 | |
| *** pcaruana has quit IRC | 15:47 | |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-agent master: Change repository links usage in Dockerfile and build image https://review.opendev.org/658754 | 15:52 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-notification master: Change repository links usage in Dockerfile and build image https://review.opendev.org/658761 | 15:59 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-common master: Change repository links usage in Dockerfile and build image https://review.opendev.org/659073 | 16:00 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-log-api master: Change repository links usage in Dockerfile and build image https://review.opendev.org/658757 | 16:00 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-api master: Change repository links usage in Dockerfile and build image https://review.opendev.org/658759 | 16:02 |
| openstackgerrit | Arseni Lipinski proposed openstack/python-monascaclient master: Change repository links usage in Dockerfile and build image https://review.opendev.org/659074 | 16:02 |
| *** witek has joined #openstack-monasca | 16:03 | |
| openstackgerrit | Witold Bedyk proposed openstack/monasca-log-api master: Blacklist bandit and update sphinx requirement https://review.opendev.org/659598 | 16:03 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-api master: Change repository links usage in Dockerfile and build image https://review.opendev.org/658759 | 16:04 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-agent master: Change repository links usage in Dockerfile and build image https://review.opendev.org/658754 | 16:05 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-common master: Change repository links usage in Dockerfile https://review.opendev.org/659073 | 16:06 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-log-api master: Change repository links usage in Dockerfile and build image https://review.opendev.org/658757 | 16:07 |
| openstackgerrit | Arseni Lipinski proposed openstack/monasca-notification master: Change repository links usage in Dockerfile and build image https://review.opendev.org/658761 | 16:07 |
| openstackgerrit | Arseni Lipinski proposed openstack/python-monascaclient master: Change repository links usage in Dockerfile and build image https://review.opendev.org/659074 | 16:09 |
| openstackgerrit | Witold Bedyk proposed openstack/monasca-api master: Add support for using Falcon 2.0.0 https://review.opendev.org/659264 | 16:21 |
| *** witek has quit IRC | 16:30 | |
| -openstackstatus- NOTICE: Gerrit is being restarted to add gitweb links back to Gerrit. Sorry for the noise. | 17:36 | |
| *** pcaruana has joined #openstack-monasca | 17:39 | |
| *** trident has quit IRC | 18:51 | |
| *** trident has joined #openstack-monasca | 18:52 | |
| *** pcaruana has quit IRC | 19:52 | |
| *** trident has quit IRC | 20:59 | |
| *** trident has joined #openstack-monasca | 21:00 | |
| openstackgerrit | Joseph Davis proposed openstack/monasca-persister master: Fix a typo and add troubleshooting in tools README https://review.opendev.org/659681 | 22:40 |
| openstackgerrit | Joseph Davis proposed openstack/monasca-persister master: Fix a typo and add troubleshooting in tools README https://review.opendev.org/659681 | 22:47 |
| *** UdayTKumar has quit IRC | 22:48 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!