14:00:04 <mrjoshi> #startmeeting glance
14:00:04 <opendevmeet> Meeting started Thu Feb  1 14:00:04 2024 UTC and is due to finish in 60 minutes.  The chair is mrjoshi. Information about MeetBot at http://wiki.debian.org/MeetBot.
14:00:04 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
14:00:04 <opendevmeet> The meeting name has been set to 'glance'
14:00:04 <mrjoshi> #topic roll call
14:00:04 <mrjoshi> #link https://etherpad.openstack.org/p/glance-team-meeting-agenda
14:00:09 <mrjoshi> o/
14:01:07 <abhishekk> o/
14:01:49 <rosmaita> o/
14:02:11 <mrjoshi> PTL is not around today
14:02:46 <croelandt> o/
14:03:09 <mrjoshi> shall we start?
14:03:42 <croelandt> let's go!
14:03:59 <mrjoshi> #topic release/periodic jobs updates
14:04:11 <mrjoshi> M3 4 weeks from now
14:04:39 <mrjoshi> Periodic jobs are all green
14:05:34 <mrjoshi> moving ahead
14:05:42 <mrjoshi> #topic Ceph capabilities settings for RBD glance_store driver
14:06:47 <abhishekk> rosmaita, ^^
14:07:02 <rosmaita> hi
14:07:23 <abhishekk> I think since we have rbd trash support now we don't need read only permission for volume pool
14:07:26 <rosmaita> just want to point out that email/bug for anyone who wants to answer
14:08:28 <rosmaita> i'm not so sure about that, but i don't know a lot about ceph
14:09:27 <abhishekk> ack, thank you, Same goes with me, I have some supportive knowledge only
14:09:42 <abhishekk> I will check and respond accordingly
14:10:41 <mrjoshi> shall we move ahead?
14:11:02 <abhishekk> yep
14:11:04 <rosmaita> nothing more from me
14:11:23 <mrjoshi> cool, moving ahead
14:11:25 <mrjoshi> #topic What is the purpose of 'metadata_encryption_key' config option
14:11:33 <mrjoshi> abhishekk, ^^
14:11:34 <abhishekk> that is me
14:11:44 <abhishekk> I found it while testing location API work
14:12:21 <abhishekk> I am wondering what is the use case behind this since it is just used while image upload and show case
14:12:33 <abhishekk> location is not encrypted when location add api is used
14:12:49 <abhishekk> So either we should enhance it or remove it
14:13:02 <abhishekk> I will add this topic in upcoming PTG for more discussion
14:13:20 <abhishekk> rosmaita, thank you for some inputs about it
14:13:30 <rosmaita> np
14:13:39 <rosmaita> it doesn't seem to be a useful capability
14:13:45 <croelandt> The scrubber seems to be using it to decrypt the location
14:13:51 <croelandt> but we're removing that so :)
14:14:12 <rosmaita> well, i think the idea was there were some ancient backends where you had username/password in the location
14:14:26 <rosmaita> and people didn't want that stuff sitting around in the database
14:14:44 <rosmaita> but then they were perfectly ok with exposing it on image-show
14:14:54 <croelandt> I see calls to crypt.urlsafe_encrypt, so are we not encrypting the location metadata in some circumstances?
14:14:59 <rosmaita> which seems kind of ... sub-optimal
14:15:07 <croelandt> oooh
14:15:27 <rosmaita> yeah, i think by default we do not do it
14:15:42 <abhishekk> and also threat-modeling is hovering over us, it is not advisable to store the key in config file
14:16:22 <rosmaita> i agree
14:16:28 <abhishekk> So either we remove it or we should enhance it to help us to overcome sec issue
14:16:32 <rosmaita> i think the thing to do is just remove the capability
14:16:56 <rosmaita> because to overcome the sec issue, we'd have to hand out the key to specific users who RBAC said are ok
14:17:15 <rosmaita> i think it would be better to just use RBAC on the locations api directly
14:17:17 <abhishekk> we can use barbican to store the key
14:18:01 <rosmaita> that's true
14:18:17 <abhishekk> for removing it, we need to follow deprecation life cycle
14:18:19 <rosmaita> so i guess the question is whether there's any point keeping the data encrypted in the DB
14:18:51 <abhishekk> we already store some encrypted data for image signature verification
14:19:00 <abhishekk> if i am not wrong
14:19:29 <abhishekk> I guess its more easy to remove it :D
14:19:41 <abhishekk> less code to maintain
14:20:22 <abhishekk> there is also 'digest_algorithm' option which is not used anywhere in glance
14:21:48 <abhishekk> I think I am done, lets decide about it in PTG
14:21:54 <abhishekk> mrjoshi, we can move ahead
14:22:03 <mrjoshi> ok
14:22:08 <mrjoshi> #topic Important Reviews
14:22:29 <mrjoshi> Centralized cache DB - #link https://review.opendev.org/q/topic:%22centralized-cache-db%22
14:22:42 <abhishekk> please  review it
14:23:01 <rosmaita> :D
14:23:08 <abhishekk> documentation part is pending, but end to end code is ready
14:23:24 <mrjoshi> Remove incorrect validation for glance-download import method - #link https://review.opendev.org/c/openstack/python-glanceclient/+/907290 - (Required Backport till Antelope )
14:23:25 <mrjoshi> S3: Do not log access Key - #link https://review.opendev.org/q/I8dc564bed33d6fc71965f4f573ae9109b410b1d4 - (Required Backport till Zed/Yoga )
14:23:25 <mrjoshi> #link https://review.opendev.org/c/openstack/glance_store/+/906484
14:23:27 <abhishekk> from code to tempest to grenade it is there
14:23:43 <rosmaita> nice work
14:24:50 <abhishekk> thank you ;)
14:25:12 <croelandt> ^ There are two patches for that access key security issue in the S3 driver
14:25:15 <abhishekk> I am learning from dansmith :D
14:26:20 <abhishekk> croelandt, I think you can approve them
14:27:25 <mrjoshi> shall we move to open discussion?
14:27:28 <abhishekk> yes
14:27:45 <mrjoshi> moving ahead
14:27:50 <croelandt> abhishekk: yes, apparently we also want to backport them to Z & Y
14:27:59 <abhishekk> rosmaita, thank you for mail, lets wait for couple of weeks
14:28:11 <rosmaita> yes, let's see what happens
14:28:11 <abhishekk> croelandt, we can once these merges
14:28:20 <mrjoshi> #topic Open Discussion
14:28:27 <abhishekk> I need to drop for another meeting
14:28:32 <abhishekk> Thank you!!
14:28:50 <rosmaita> abhishekk: i thought you wanted to talk about launchpad maintenance?
14:28:53 <mrjoshi> launchpad maintainance - https://launchpad.net/glance, https://launchpad.net/glance-store, https://launchpad.net/python-glanceclient
14:28:59 <abhishekk> we can revisit this next week
14:29:08 <rosmaita> works for me!
14:29:11 <abhishekk> thanks
14:29:24 <rosmaita> mrjoshi: thanks for running the meeting
14:29:51 <mrjoshi> shall we wrap up then?
14:30:02 <mrjoshi> rosmaita, thanks!
14:30:11 <rosmaita> i don't have anything more
14:30:23 <mrjoshi> croelandt, ^^
14:31:18 <croelandt> Nothing :)
14:31:22 <mrjoshi> cool, let's wrap up then
14:31:23 <croelandt> thanks for taking care of this meeting
14:31:34 <mrjoshi> no problem :)
14:31:47 <mrjoshi> Thanks everyone for Joining!!!
14:32:12 <mrjoshi> #endmeeting