| *** yingjun has joined #openstack-searchlight | 00:25 | |
| openstackgerrit | Li Yingjun proposed openstack/searchlight: Fix exceptions error for image plugin https://review.openstack.org/365465 | 00:32 |
|---|---|---|
| openstackgerrit | Li Yingjun proposed openstack/searchlight: to_dict instead of __dict__ for cinder resource https://review.openstack.org/365408 | 00:56 |
| *** yingjun has quit IRC | 01:13 | |
| *** yingjun has joined #openstack-searchlight | 01:19 | |
| openstackgerrit | Li Yingjun proposed openstack/searchlight: to_dict instead of __dict__ for cinder resource https://review.openstack.org/365408 | 02:41 |
| *** shu-mutou-AFK is now known as shu-mutou | 02:55 | |
| *** shu-mutou is now known as shu-mutou-AFK | 04:12 | |
| *** itisha has quit IRC | 05:11 | |
| *** pcaruana has joined #openstack-searchlight | 06:48 | |
| *** tsufiev_ is now known as tsufiev | 08:13 | |
| *** sjmc7 has joined #openstack-searchlight | 09:03 | |
| *** sjmc7 has quit IRC | 09:08 | |
| *** yingjun has quit IRC | 09:34 | |
| *** lei-zh has joined #openstack-searchlight | 09:53 | |
| *** lei-zh has left #openstack-searchlight | 09:53 | |
| *** sjmc7 has joined #openstack-searchlight | 10:04 | |
| *** sjmc7 has quit IRC | 10:08 | |
| *** yingjun has joined #openstack-searchlight | 11:02 | |
| *** sjmc7 has joined #openstack-searchlight | 12:05 | |
| *** sjmc7 has quit IRC | 12:11 | |
| *** pcaruana has quit IRC | 12:50 | |
| *** matt-borland has joined #openstack-searchlight | 13:17 | |
| *** ddieterly has joined #openstack-searchlight | 13:27 | |
| *** yingjun has quit IRC | 13:41 | |
| *** yingjun has joined #openstack-searchlight | 13:41 | |
| *** TravT has joined #openstack-searchlight | 13:45 | |
| *** yingjun has quit IRC | 13:45 | |
| *** yingjun has joined #openstack-searchlight | 13:55 | |
| *** sjmc7 has joined #openstack-searchlight | 14:08 | |
| *** yingjun has quit IRC | 14:08 | |
| *** yingjun has joined #openstack-searchlight | 14:08 | |
| *** yingjun has quit IRC | 14:13 | |
| *** yingjun has joined #openstack-searchlight | 14:36 | |
| *** tyr_ has joined #openstack-searchlight | 14:41 | |
| *** tyr_ has quit IRC | 14:42 | |
| *** matt-borland has quit IRC | 15:17 | |
| *** RickA-HP has joined #openstack-searchlight | 15:22 | |
| *** pcaruana has joined #openstack-searchlight | 15:42 | |
| *** TravT_ has joined #openstack-searchlight | 16:04 | |
| *** david-lyle_ has joined #openstack-searchlight | 16:05 | |
| *** david-lyle_ has quit IRC | 16:05 | |
| *** TravT has quit IRC | 16:08 | |
| *** TravT has joined #openstack-searchlight | 16:10 | |
| *** TravT_ has quit IRC | 16:12 | |
| *** matt-borland has joined #openstack-searchlight | 16:39 | |
| *** bkeller` has quit IRC | 16:56 | |
| *** ddieterly is now known as ddieterly[away] | 17:19 | |
| *** TravT has quit IRC | 17:31 | |
| *** TravT has joined #openstack-searchlight | 17:33 | |
| *** bkeller` has joined #openstack-searchlight | 17:37 | |
| sjmc7 | TravT, david-lyle : i’m coming to the point of punting on the policy-to-rbac work for this release. there’s too much special sauce goes on | 17:48 |
| sjmc7 | it might be more useful to allow the queries to be given by an operator rather than parsing them from policy | 17:48 |
| sjmc7 | as an example, the ‘get_image’ rule in https://github.com/openstack/horizon/blob/master/openstack_dashboard/conf/glance_policy.json belies all the special case code in glance that actually controls whether you can see an image | 17:49 |
| TravT | sjmc7 not sure I understand fully your second statement | 17:49 |
| sjmc7 | i mean allow an operator to provide a json file with canned RBAC queries | 17:49 |
| sjmc7 | rather than the static ones we do now, with some interpolation from the token credentials | 17:50 |
| TravT | IOW, allow the rbac portion of the query to be pluggable | 17:51 |
| TravT | i agree that in many cases the policy file is a lie | 17:51 |
| sjmc7 | yeah. so you’d have to do the translation yourself but at least it’d be configurable | 17:51 |
| TravT | in glance, with that example. | 17:51 |
| sjmc7 | the policy files are wildly inconsistent in what they attempt to do | 17:51 |
| TravT | the policy file is kind of pre-filter, right? | 17:52 |
| sjmc7 | it’s a shame. i was quite pleased with being able to turn them into queries in some cases, until i tried to use some real ones | 17:52 |
| sjmc7 | for glance it’s just ‘can you use the api' | 17:52 |
| sjmc7 | for others it’s “can you use the api to get this resource”, and for some it’s inbetween - there’s still some in-code filtering | 17:53 |
| sjmc7 | neutron’s is the most comprehensive but has all kinds of special rules they implemented outside of oslo.policy | 17:53 |
| sjmc7 | so i’m voting to knock this on the head for now | 17:54 |
| sjmc7 | it wouldn’t be too much work to do a pluggable option but not sure it’s worth the risk at this stage in the release | 17:54 |
| * david-lyle is confused | 17:55 | |
| david-lyle | the policy files are the way the operator specifies the policy rules they want to enforce | 17:55 |
| sjmc7 | yep | 17:55 |
| david-lyle | so you're proposing adding what instead? | 17:56 |
| sjmc7 | so look at that glance example | 17:56 |
| sjmc7 | who can view a given image? | 17:56 |
| david-lyle | well, it should be limited by policy even if they have a secondary permission construct | 17:57 |
| david-lyle | a dual filter | 17:57 |
| sjmc7 | we already can restrict access to glance images in general in policy | 17:57 |
| TravT | this is why we have the plugin with the multiple levels of filtering already. because it is so complex and because oslo.policy can't be used. | 17:57 |
| TravT | oslo.policy can only express part of the equation | 17:57 |
| sjmc7 | what i was triyng to do was enable policy to influence the filter used to restrict which images you can search on | 17:58 |
| sjmc7 | which is fine if everyone uses ‘admin_or_owner’ and that’s it, but it’s more complicated than that | 17:58 |
| david-lyle | I would have thought policy should be the second layer of filtering on top of the inherent glance filtering | 17:58 |
| sjmc7 | right now we honour ‘get_images' | 17:59 |
| openstackgerrit | Rick Aulino proposed openstack/searchlight: RBAC for network sharing https://review.openstack.org/348701 | 17:59 |
| TravT | what david is mentioning could be done in the post_filter | 17:59 |
| david-lyle | sjmc7: I'm not arguing that any further work could be too much for the current release | 18:00 |
| TravT | nova also essentially has _source exclude policy | 18:00 |
| david-lyle | I would think it is | 18:00 |
| TravT | yeah, it is late in the game for anything terribly earth shattering. | 18:00 |
| sjmc7 | yeah, understood. the *field* filtering i think we could implement from policy | 18:00 |
| sjmc7 | but yeah, i think it’s going to have to wait since i don’t want to break stuff | 18:01 |
| TravT | yeah, time would be better used banging on what we have and defect fixing | 18:02 |
| david-lyle | policy is a quagmire that should wait | 18:03 |
| TravT | said every project ever | 18:03 |
| TravT | ;) | 18:03 |
| sjmc7 | :) | 18:03 |
| openstackgerrit | Steve McLellan proposed openstack/searchlight: WIP Policy rbac DO NOT MERGE https://review.openstack.org/362470 | 18:03 |
| * david-lyle nods | 18:03 | |
| sjmc7 | some of the rules it allows are quite odd | 18:03 |
| david-lyle | well, our use model wasn't what they intended | 18:04 |
| david-lyle | in horizon and searchlight | 18:04 |
| sjmc7 | hahahaha - this one is a sad echo of what could’ve been: "role:admin or (project_id:%(project_id)s and role:projectadmin)" | 18:04 |
| * david-lyle immediately cringes at the hardcoded roles | 18:05 | |
| sjmc7 | the httpcheck would be a really interesting attack vector | 18:05 |
| sjmc7 | ok, gonna leave it on the backburner and go back to mashing | 18:06 |
| sjmc7 | you can discuss it over an octopus in barcelona | 18:06 |
| sjmc7 | on that note, i’m hungry | 18:06 |
| david-lyle | sjmc7: does that mean you'll be dining in barcelona rather than chicago? | 18:06 |
| *** ddieterly[away] has quit IRC | 18:19 | |
| sjmc7 | sadly i likely won’t be included in the ‘you’ | 18:23 |
| *** bkeller` has quit IRC | 18:26 | |
| david-lyle | sjmc7: where do I send my angry letters? | 18:30 |
| *** bkeller` has joined #openstack-searchlight | 18:37 | |
| *** TravT has quit IRC | 18:45 | |
| *** TravT has joined #openstack-searchlight | 18:46 | |
| *** ddieterly has joined #openstack-searchlight | 18:58 | |
| *** sjmc7 has quit IRC | 18:58 | |
| *** pcaruana has quit IRC | 19:11 | |
| openstackgerrit | Merged openstack/searchlight: Fix exceptions error for image plugin https://review.openstack.org/365465 | 19:14 |
| *** bkeller` has quit IRC | 19:17 | |
| *** sjmc7 has joined #openstack-searchlight | 19:19 | |
| openstackgerrit | Merged openstack/searchlight: Use more specific asserts in tests https://review.openstack.org/360909 | 19:34 |
| *** bkeller` has joined #openstack-searchlight | 19:44 | |
| *** TravT has quit IRC | 19:55 | |
| *** bkeller` has quit IRC | 19:58 | |
| *** bkeller` has joined #openstack-searchlight | 20:05 | |
| *** bkeller` has quit IRC | 20:12 | |
| *** TravT has joined #openstack-searchlight | 20:13 | |
| *** bkeller` has joined #openstack-searchlight | 20:18 | |
| *** ddieterly is now known as ddieterly[away] | 20:37 | |
| *** TravT has quit IRC | 20:55 | |
| *** ddieterly[away] is now known as ddieterly | 20:59 | |
| *** matt-borland has quit IRC | 21:18 | |
| *** ddieterly is now known as ddieterly[away] | 21:30 | |
| *** ddieterly[away] is now known as ddieterly | 21:36 | |
| *** bkeller` has quit IRC | 21:52 | |
| *** ddieterly is now known as ddieterly[away] | 22:00 | |
| *** ddieterly[away] is now known as ddieterly | 22:12 | |
| *** ddieterly is now known as ddieterly[away] | 22:17 | |
| *** bkeller` has joined #openstack-searchlight | 22:20 | |
| *** ddieterly[away] is now known as ddieterly | 22:24 | |
| *** ddieterly has quit IRC | 22:43 | |
| *** yingjun has quit IRC | 22:59 | |
| *** yingjun has joined #openstack-searchlight | 22:59 | |
| *** yingjun has quit IRC | 23:04 | |
| *** sjmc7 has quit IRC | 23:10 | |
| openstackgerrit | Rick Aulino proposed openstack/searchlight: Standard error logging https://review.openstack.org/355689 | 23:17 |
| *** ddieterly has joined #openstack-searchlight | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!