15:00:55 <redrobot> #startmeeting keystone
15:00:55 <opendevmeet> Meeting started Tue Nov  2 15:00:55 2021 UTC and is due to finish in 60 minutes.  The chair is redrobot. Information about MeetBot at http://wiki.debian.org/MeetBot.
15:00:55 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
15:00:55 <opendevmeet> The meeting name has been set to 'keystone'
15:01:01 <redrobot> #topic Roll Cal
15:01:04 <opendevreview> Merged openstack/python-keystoneclient master: Fix doc error to unblock the gate  https://review.opendev.org/c/openstack/python-keystoneclient/+/813810
15:01:05 <redrobot> *Call
15:01:31 <knikolla> o/
15:01:35 <redrobot> Courtesy ping for ayoung, bbobrov, crisloma, d34dh0r53, dpar, dstanek, gagehugo, hrybacki, knikolla, lamt, lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, spilla, ruan_he, wxy, sonuk, vishakha,Ajay, raildo, rafaelweingartner, xek
15:01:50 <gagehugo> o/
15:02:09 <lbragstad> o/
15:02:39 <redrobot> Hi y'all!
15:02:42 <redrobot> Let's get started
15:02:53 <redrobot> #topic Review Past Meeting Action Items
15:03:10 <redrobot> #link https://meetings.opendev.org/meetings/keystone/2021/keystone.2021-10-26-15.00.html
15:03:17 <redrobot> We didn't have any action items...
15:03:22 <redrobot> ... moving on
15:03:35 <redrobot> #topic Liaison Updates
15:03:40 <redrobot> knikolla anything you want to sahre today?
15:03:44 <redrobot> *share
15:05:41 <knikolla> no, not really
15:06:10 <redrobot> Cool beans
15:06:12 <redrobot> let's move on
15:06:27 <knikolla> that probably says more about my not devoting a lot of time to doing those liaison roles, than anything, though.
15:08:12 <redrobot> Gotcha ... I'll try to keep an eye out on some of that stuff too
15:09:38 <redrobot> #topic OAuth 2.0
15:09:58 <redrobot> #link https://review.opendev.org/c/openstack/keystone-specs/+/813152
15:10:03 <redrobot> thanks for reviewing knikolla
15:10:11 <redrobot> still looking for gagehugo and lbragstad reviews
15:10:18 <lbragstad> ack
15:11:23 <redrobot> Does not look like h_asahina is online so we can move on
15:13:26 <redrobot> #topic Secure RBAC
15:13:31 <redrobot> lbragstad any updates for today?
15:13:48 <lbragstad> just one
15:14:00 <lbragstad> #link https://review.opendev.org/c/openstack/governance/+/815158/ has been taking most if not all of my time upstream
15:14:09 <lbragstad> and it's currently under review and discussion
15:14:20 <lbragstad> any additional input is greatly appreciated
15:14:29 <lbragstad> we will be having a meeting on it tomorrow - gmann set that up
15:14:41 <lbragstad> but - it could affect things in keystone
15:14:47 <lbragstad> and it might lead to another default role
15:15:12 <redrobot> Ah yeah, good to know
15:15:24 <redrobot> Do you have the details for the meeting tomorrow for folks interested in listening in?
15:15:37 <lbragstad> i don't but let me check the mailing list
15:15:45 <lbragstad> gmann sent out a poll last week
15:16:30 <lbragstad> http://lists.openstack.org/pipermail/openstack-discuss/2021-October/025569.html
15:16:54 <lbragstad> http://lists.openstack.org/pipermail/openstack-discuss/2021-November/025619.html
15:16:59 <lbragstad> details ^
15:17:04 <lbragstad> tomorrow @ 15:00 UTC
15:17:04 <redrobot> awesome, thanks lbragstad
15:17:24 <lbragstad> that's all i have unless folks have questions
15:20:53 <redrobot> Looks like we're good on questions
15:20:56 <redrobot> moving on
15:21:11 <redrobot> #topic Open Discussion
15:21:17 <redrobot> Anything else y'all want to talk about right now?
15:28:21 <redrobot> I'll take that as a no
15:28:25 <redrobot> let's move on to bugs
15:28:27 <redrobot> #topic Bug Review
15:28:38 <redrobot> #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0
15:29:00 <redrobot> No new bugs
15:29:31 <redrobot> #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0
15:29:37 <redrobot> and no new client bugs
15:30:17 <redrobot> #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0
15:30:22 <redrobot> and no new middleware bugs
15:32:36 <redrobot> Looking at the newest bugs
15:32:50 <redrobot> #link https://bugs.launchpad.net/keystone/+bug/1947870
15:33:04 <redrobot> > Keystone Kerberos auth broken when delegate to HTTP
15:33:32 <redrobot> We talked about this briefly last week.  Anyone become a Kerberos expert since last week?
15:33:41 <lbragstad> i have not
15:33:52 <lbragstad> i'm still looking for that specific matrix card
15:35:43 <redrobot> heh
15:35:57 <redrobot> #link https://bugs.launchpad.net/python-keystoneclient/+bug/1945785
15:36:10 <redrobot> > Can't find project by project_id
15:39:27 <redrobot> This looks fairly easy to try to recreate
15:40:08 <redrobot> I might try to take a look at this one
15:40:17 <redrobot> seems like good low-hanging-fruit
15:40:40 <redrobot> #link https://bugs.launchpad.net/keystonemiddleware/+bug/1946117
15:40:48 <redrobot> > Unify keystone and keystonemiddleware cache
15:44:15 * redrobot realizes he doesn't know anything about Keystone caching
15:45:14 <lbragstad> i think the benefit of that it that it would allow a token to get cached immediately, and then as soon as someone goes to nova to use that token and create a server - they would see the performance benefit
15:45:34 <lbragstad> the keystone caching implementation is completely separate from ksm i think
15:45:53 <redrobot> It's an intersting bug report.  I wonder why keystone and keystonemiddleware have different code for storing tokens to cache?  Seems like a good place where common code could be used.
15:46:10 <lbragstad> but if the keystone caching implementation for tokens and the caching implementation for ksm could be generalized - they could be shared
15:48:08 <redrobot> Is it typicall that the same cache is used for the keystone service and other services using the middleware?
15:48:27 <lbragstad> i don't think so?
15:49:05 <redrobot> I can see where this would improve performance when they do
15:49:15 <lbragstad> yeah for sure
15:50:30 <redrobot> What do we user for cache?  Memcached?
15:50:40 <lbragstad> yeah
15:52:28 <redrobot> So you'd have to have the same authn/authz for memcached in both services for this to work
15:56:58 <lbragstad> well - we don't implement authn/authz for memcached yet
15:57:15 <lbragstad> i think memcached supports SASL, but we don't support that yet in openstakc
15:57:31 <lbragstad> or the python clients we use don't have support for it yet?
15:59:03 <lbragstad> real quick - we do need to merge https://review.opendev.org/c/openstack/python-keystoneclient/+/784744 to unblock the python-keystoneclient gate
16:02:51 <redrobot> Looks like it's on its way to the merge gate
16:03:11 <redrobot> Aaaand that's all the time we have.
16:03:16 <redrobot> Thanks for joining, everyone!
16:03:18 <redrobot> #endmeeting