14:00:04 <abhishekk> #startmeeting glance
14:00:05 <openstack> Meeting started Thu Feb 18 14:00:04 2021 UTC and is due to finish in 60 minutes.  The chair is abhishekk. Information about MeetBot at http://wiki.debian.org/MeetBot.
14:00:06 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
14:00:07 <abhishekk> #topic roll call
14:00:09 <openstack> The meeting name has been set to 'glance'
14:00:14 <abhishekk> #link https://etherpad.openstack.org/p/glance-team-meeting-agenda
14:00:16 <abhishekk> o/
14:00:36 <jokke> o/
14:00:52 <abhishekk> Lets wait couple of minutes for others to join
14:03:04 <abhishekk> Looks like just two of us
14:03:19 <jokke> There's Brian
14:03:24 <abhishekk> yep
14:03:27 <abhishekk> lets start
14:03:41 <abhishekk> #topic release/periodic jobs update
14:03:52 <rosmaita> sorry  i'm late
14:04:01 <abhishekk> no worries
14:04:06 <abhishekk> Final release of non-client libraries - 2 weeks
14:04:20 <abhishekk> One patch is open which seems good to get in
14:04:21 <abhishekk> https://review.opendev.org/c/openstack/glance_store/+/775497
14:05:39 <abhishekk> Before next meeting I will prepare release note patch and then following Monday will propose the release patch
14:06:31 <jokke> kk, lets have a pass over the bugs as well and just make sure we get any criticals/quick ones smacked down before releasing
14:06:53 <abhishekk> dansmith, not able to see the updates as well as topic updates in the heading
14:07:03 <abhishekk> is it same for jokke and rosmaita ??
14:07:23 <jokke> I see 'em
14:07:46 <dansmith> here now
14:07:47 <dansmith> netsplit I guess
14:07:53 <abhishekk> ahh
14:08:13 <abhishekk> jokke, right, good to go through bugs as well
14:08:37 <abhishekk> Milestone 3 - 3 weeks away
14:08:54 <abhishekk> Bunch of patches are open for review
14:09:05 <abhishekk> and not enough time
14:09:16 <abhishekk> we also need to consider delays in gate
14:09:57 <abhishekk> Kindly start reviewing open patches
14:10:12 <abhishekk> Periodic jobs - Couple of failures due to fix merged in glance_store
14:10:21 <abhishekk> Patch to skip test - https://review.opendev.org/c/openstack/glance/+/776406
14:10:43 <abhishekk> We have a fix as well but that will not work unless glance_store is released and available to use
14:11:06 <abhishekk> Everything is described in the commit message and related bug
14:11:32 <jokke> kk
14:11:33 <abhishekk> any questions?
14:12:00 <abhishekk> ok, moving ahead
14:12:08 <abhishekk> #topic Critical reviews
14:12:16 <abhishekk> Glance Secure rbac
14:12:24 <abhishekk> This is a top priority for us
14:12:34 <abhishekk> patches are up, functional tests are up as well
14:13:02 <abhishekk> And I am suggesting that we should get this done as EXPERIMENTAL in this cycle
14:13:32 <abhishekk> There is a way to use deprecated policies
14:14:10 <abhishekk> So we will not mark it stable if and unless everything is working as expected
14:14:49 <jokke> ++
14:14:50 <abhishekk> Any inputs/concerns/suggestions ?
14:15:05 <jokke> Lets take the Experimental into the patches and reviews then
14:15:29 <jokke> should not be a big change and I think at this stage it's good idea
14:16:03 <abhishekk> cool, I will update the patches to mark those as experimental
14:16:19 <abhishekk> lbragstad, may be busy with other work, so I will take this up
14:16:38 <rosmaita> what does this mean from the operator perspective?
14:17:09 <rosmaita> i guess we mention in release notes and say turn on enforce_scope in oslo.policy at your own risk?
14:17:21 <abhishekk> yes
14:17:27 <jokke> rosmaita: that to use this  they need to specifically enable it and for audit purposes it's flagged as experimental for this release
14:17:32 <abhishekk> and report if they found any issues
14:18:10 <rosmaita> ok, that makes sense
14:18:39 <abhishekk> great
14:19:05 <lbragstad> o/ here now if there is anything specific to discuss
14:19:13 <abhishekk> #action abhishekk to update secure-rbac patches to mention Experimental status
14:19:42 <abhishekk> lbragstad, So we are deciding to have secure-rbac as experimental in this cycle
14:19:57 <lbragstad> ok
14:20:21 <abhishekk> will let you know if any specific help is required
14:20:30 <lbragstad> sounds good - thank you for the help
14:20:47 <abhishekk> Thank you for your patience and work
14:21:03 <abhishekk> moving ahead
14:21:04 <abhishekk> Task show API
14:21:18 <abhishekk> #link
14:21:18 <abhishekk> https://review.opendev.org/c/openstack/glance/+/763739 (base patch)
14:21:27 <abhishekk> Needs reviews
14:21:35 <abhishekk> I have also posted client changes for the same
14:21:53 <dansmith> and I posted a tempest test
14:21:59 <abhishekk> #link https://review.opendev.org/c/openstack/python-glanceclient/+/776403
14:22:08 <dansmith> I think I'm mostly good on that series, I guess I have one more PS to look at that I haven't yet
14:22:22 <dansmith> somehow I didn't notice you refreshed it
14:22:24 <abhishekk> #link https://review.opendev.org/c/openstack/tempest/+/775679
14:22:42 <abhishekk> Tempest test for new API ^^
14:22:46 <abhishekk> dansmith, ack
14:23:20 <abhishekk> Distributed image import
14:23:29 <abhishekk> Spec - https://review.opendev.org/c/openstack/glance-specs/+/774097
14:24:08 <abhishekk> Spec was in merged conflict, so please put your vote again
14:24:15 <abhishekk> Implementation https://review.opendev.org/c/openstack/glance/+/770682 (base patch)
14:25:13 <abhishekk> As decided in weekly meeting two weeks before, we are opting for image_property solution this cycle and then make improvements to use location in next cycle
14:25:50 <abhishekk> I am hoping to have everyone on board with approach
14:26:19 <rosmaita> quick question
14:26:33 <abhishekk> shoot
14:26:39 <rosmaita> did we merge dan's patch making os_glance* a restricted namespace for properties?
14:26:46 <abhishekk> yes
14:26:56 <dansmith> and the tempest test for that just merged
14:27:16 <rosmaita> and i thought i saw code somewhere so that some of these are hidden for non-admin user image-show ?
14:27:54 <abhishekk> you might have seen that in implementation patch
14:27:56 <dansmith> https://review.opendev.org/c/openstack/glance/+/769976/12/glance/api/v2/images.py
14:28:02 <dansmith> check hidden_properties there yeah
14:28:24 <rosmaita> ok, cool
14:28:54 <abhishekk> https://review.opendev.org/c/openstack/glance/+/769976/12/glance/api/v2/images.py#1456
14:28:54 <rosmaita> line 1456
14:28:57 <rosmaita> :)
14:29:01 <abhishekk> :d
14:29:10 <dansmith> tests in here: https://review.opendev.org/c/openstack/glance/+/769976/12/glance/tests/unit/v2/test_images_resource.py for that
14:29:43 <abhishekk> there are also other bunch of open reviews
14:30:16 <abhishekk> So requesting everyone to put their reviewers hat on
14:30:56 <abhishekk> that's it for today
14:31:04 <abhishekk> Moving to Open discussion
14:31:10 <abhishekk> #topic Open discussion
14:31:33 <rosmaita> i want to go back to the glance_store change that broke tests
14:31:48 <dansmith> I just discussed that with rajat
14:31:48 <abhishekk> ok
14:31:50 <rosmaita> we have the periodic job that checks glance_store-tips
14:31:53 <dansmith> and I think we have a better plan
14:32:05 <rosmaita> i mean about catching this in the first place
14:32:13 <abhishekk> rosmaita, yes and there only I have  managed to catch this failure
14:32:32 <rosmaita> we have the glance_store tips jobs set up so you can "check experimental" and run them
14:32:32 <abhishekk> https://zuul.openstack.org/build/0875b94694ee4a408e5a210ea720936b
14:33:00 <rosmaita> i guess the problem is that you have to do this on a glance patch, not a glance store patch
14:33:09 <dansmith> right
14:33:16 <abhishekk> right
14:33:22 <dansmith> glance_store could have a glance job that uses it unreleased though
14:33:27 <dansmith> I can write one of those if you want
14:33:28 <rosmaita> but i think the glance_store zuul.yaml can refer to jobs defined in glance zuul.yaml
14:33:33 <dansmith> sure
14:33:51 <rosmaita> yeah, that would be good
14:34:11 <rosmaita> we need to have some glance_store gate that runs against glance master, i think
14:34:25 <dansmith> clearly :)
14:35:34 <jokke> I think hanving glance_store tested has been in general a topic since the lib was broken off from glance
14:36:10 <abhishekk> that reminds me, we also needs to fix broken requirements job on stable branches
14:36:30 <rosmaita> btw, dansmith you should review the glance_store tips jobs in glance zuul.yaml, at some point i was wondering if i had set them up correctly
14:36:41 <jokke> but we do run tempest tests as part of glance_store gating ... I guess that's issue was just something tempest is not testing
14:36:41 <abhishekk> jokke, I think you have enough idea about what to fix
14:37:03 <dansmith> jokke: these were functional tests in glance
14:37:08 <dansmith> so no tempest
14:37:19 <dansmith> we need to run glance's functional against unreleased glance_store
14:39:41 <abhishekk> and we do have job which runs again cinder multi store but this issue was for single store
14:40:08 <dansmith> well, unless that runs with unreleased glance_store it won't matter, and didn't in this case right?
14:40:21 * dansmith looks
14:40:43 <abhishekk> dansmith, hmm
14:40:45 <dansmith> yeah, only released glance_store
14:40:45 <abhishekk> right
14:43:28 <abhishekk> anything else?
14:43:39 <jokke> yeah any test job that is not part of the glance_store [check, gate, tips] is just taking the g_s from pypi
14:44:51 <abhishekk> I think only tips jobs are running on glance_store master
14:45:12 <rosmaita> i think that's right
14:45:15 <abhishekk> every other check/gate downloads it fron pypi
14:45:33 <dansmith> yeah, but we can tell a job to get it from master
14:45:44 <jokke> well the glance_store check andgate jobs are for sure running against master, gerrit ain't pushing these patches on the lib pulled from pypi
14:46:26 <abhishekk> yes that is correct
14:46:37 <dansmith> zuul can run glance jobs against glance_store master with a patch applied if you tell it to
14:46:42 <abhishekk> use_from_lib?
14:46:49 <rosmaita> i just remembered the problem with the tips job for glance_store, it fails after something bad has already merged into glance_store
14:46:51 <dansmith> in zuulv2, required_projects
14:47:11 <rosmaita> which i guess is helpful as an advance warning before we release glance_store
14:47:20 <dansmith> rosmaita: this is why the glance_store should run glance master with the proposed patch against glance_store, even for functional tests since they depend on it
14:47:20 <abhishekk> ++
14:47:39 <rosmaita> i agree
14:47:57 <jokke> dansmith: last time it was discussed, it was generally frowned upon to test with unreleased dependencies. That's why those tips jobs were created so we can get heads up when something is breaking before release
14:48:02 <rosmaita> gorka has cinderlib's tox.ini set up to always run against cinder master, maybe we need to do that here
14:48:05 <jokke> and hard gate breakages
14:48:11 <dansmith> jokke: I'm talking about testing glance_store that way not glance
14:48:37 <dansmith> glance should probably *also* have a job that runs against the glance_store master, but it needs to test against released for sure
14:49:15 <jokke> dansmith: yeah, I was writing nd missed your note of specially referring to running glance functional as part of g_s
14:49:52 <jokke> the problem with that is, that any change that needs coordination (as in we need something merged to store and then to glance) will be in deadlock
14:50:06 <abhishekk> rosmaita, So I have one question about rbac
14:50:16 <jokke> that's why we have the tip jobs so we can catch these before release time
14:50:29 <abhishekk> to mark it as experimental I need to do it in every policy that we are defining right?
14:50:34 <abhishekk> jokke, ^
14:50:48 <dansmith> we should never have something merge to glance_store that needs a matching thing to land in glance at the same time, or vice versa
14:50:55 <abhishekk> or justt a releasenote will do?
14:51:01 <rosmaita> abhishekk: i am not sure about the logistics of that
14:51:35 <abhishekk> rosmaita, ack
14:51:48 <rosmaita> is the situation that the known-good-policies (that is, the old ones) will be marked as deprecated, but we want the new ones to be considered experimental?
14:52:10 <rosmaita> so we want people in wallaby to use the deprecated ones, but to be ready for the change
14:52:24 <abhishekk> I think that's what we want
14:53:10 <rosmaita> i think then we need to make it clear in the release notes, and also what the oslo.policy config on the glance-api nodes needs to be
14:53:19 <rosmaita> i think the defaults will be fine
14:53:27 <rosmaita> but should call them out
14:53:33 <jokke> abhishekk: easiest way to do that is to add deprecated config option in glance that set to false (by default) overwrites the oslo_policy config. flag that config option enabling Experimental policy feature and allow the oslo_policy to be configured with the new enforcement
14:53:35 <rosmaita> we need to check with lbragstad about this, htough
14:54:09 <abhishekk> jokke, ack
14:54:51 <jokke> abhishekk: then once we flag that stable, we can flip it true by default and remove the config option on the following cycle once we don't want people to use the old policy code at all anymore
14:55:17 <rosmaita> jokke: that sounds like a good plan
14:56:11 <abhishekk> jokke, ack, will work on this solution
14:57:03 <jokke> that way you don't need to do it on every individual policy
14:57:23 <rosmaita> yeah, you don't want to have to annotate every policy
14:57:27 <abhishekk> one question
14:57:35 <abhishekk> that flag is by default false in oslo policy
14:57:50 <abhishekk> so do we need to overwrite it in glance?
14:58:10 <rosmaita> i think we do, it gives us a failsafe
14:58:25 <abhishekk> cool
14:58:26 <rosmaita> so mostly we'll be overwriting False with False, but what the heck
14:58:44 <jokke> abhishekk: yes because we want to have the experimental feature enablement being very clear decision. Not just that flipping some other config option suddenly turn experimental feature on too
14:59:08 <abhishekk> ok
14:59:32 <rosmaita> i agree with jokke about this
14:59:40 <abhishekk> will ping you if have any doubts
15:00:07 <abhishekk> that's all, time's up
15:00:10 <abhishekk> thank you all
15:00:15 <abhishekk> have a nice weekend
15:00:23 <abhishekk> #endmeeting