15:08:09 <d34dh0r53> #startmeeting keystone
15:08:09 <opendevmeet> Meeting started Wed Jun  5 15:08:09 2024 UTC and is due to finish in 60 minutes.  The chair is d34dh0r53. Information about MeetBot at http://wiki.debian.org/MeetBot.
15:08:09 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
15:08:09 <opendevmeet> The meeting name has been set to 'keystone'
15:08:33 <d34dh0r53> #topic roll call
15:08:42 <d34dh0r53> admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, knikolla[m], lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek, gmann, zaitcev, reqa, dmendiza[m], mharley, jph, gtema
15:08:58 <xek> o/
15:09:00 <d34dh0r53> apologies for the late start, internal meeting ran over
15:09:03 <gtema> o/
15:10:19 <d34dh0r53> #topic review past meeting work items
15:10:44 <d34dh0r53> #link https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-05-29-15.02.html
15:10:52 <d34dh0r53> No action items from the last meeting, so we'll move on
15:11:03 <d34dh0r53> #topic liaison updates
15:11:12 <d34dh0r53> no updates from VMT or Releases
15:11:48 <d34dh0r53> #topic specification OAuth 2.0 (hiromu)... (full message at <https://matrix.org/_matrix/media/v3/download/matrix.org/fvtpEMahbekNLRCfgoxzSTWG>)
15:12:24 <d34dh0r53> I need to get to rebasing the remaining patches to see if we can finish this up
15:12:53 <d34dh0r53> next up
15:13:12 <d34dh0r53> #topic specification Secure RBAC (dmendiza[m])... (full message at <https://matrix.org/_matrix/media/v3/download/matrix.org/uWeAyJusTMVCvAcmLqLAwxNC>)
15:13:30 <d34dh0r53> dmendiza: are you around? I didn't see you in the roll call
15:14:41 <dmendiza[m]> 🙋‍♂️
15:15:52 <d34dh0r53> guess not, moving on
15:16:17 <d34dh0r53> #topic specification Improve federated users management (gtema)
15:16:17 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone/+/920892
15:16:17 <d34dh0r53> ready for review
15:16:19 <gtema> wait
15:16:39 <gtema> does somebody remember what is the state with SRBAC and Heat - there was something
15:17:10 <dmendiza[m]> gtema (Artem Goncharov): Yeah, there is some workflow in Heat where they send Keystone a domain-scoped token
15:17:39 <dmendiza[m]> policy for that specific API did not allow domain-scoped requests, so the request failed
15:18:45 <gtema> somebody is working on the fix?
15:19:06 <d34dh0r53> I'll give this a review this week, thanks gtema (Artem Goncharov)
15:19:10 <dmendiza[m]> The policy was fixed in this patch:
15:19:12 <d34dh0r53> next up
15:19:16 <dmendiza[m]> #link https://opendev.org/openstack/keystone/commit/dd785ee692118a56ea0e3aaaf7f5bd6c73ea9c91
15:19:24 <d34dh0r53> #topic specification OpenAPI support (gtema)
15:19:24 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone-specs/+/910584
15:19:24 <d34dh0r53> gtema: waiting for reviews
15:19:30 <dmendiza[m]> gtema (Artem Goncharov) ☝️
15:19:57 <gtema> feels like a heavy un-sync between my element and Dave's
15:20:14 <dmendiza[m]> gtema (Artem Goncharov): 💯
15:20:20 <gtema> thks dmendiza
15:20:28 <dmendiza[m]> gtema (Artem Goncharov): pinging Dave Wilde (d34dh0r53) on a different channel
15:21:10 <d34dh0r53> I just found out I'm not seeing any of your messages, going to restart my client, BRB
15:21:19 <bbobrov> (just use irc, duh)
15:21:37 <gtema> nope - that's the problem: IRC bridge
15:21:44 <d34dh0r53> testing?
15:21:50 <bbobrov> d34dh0r53: passed
15:22:04 <dmendiza[m]> Dave Wilde (d34dh0r53): pong
15:22:10 <opendevreview> Artem Goncharov proposed openstack/keystone master: Improve configuration of out-of-tree identity drivers  https://review.opendev.org/c/openstack/keystone/+/920892
15:22:14 <d34dh0r53> hah, wow, really sorry about that
15:22:46 <d34dh0r53> I had an element update waiting for me and I'll bet it had expired my keys
15:23:01 <gtema> Dave Wilde (d34dh0r53): just pushed pep God's fix for the improving out-of-tree driver config (misread email that test failed before)
15:23:33 <gtema> the change itself is not big, added lots of comments and therefore it looks bigger then it is
15:23:50 <d34dh0r53> ok, cool
15:24:03 <gtema> struggled (as usual) convincing all the singletons my test is fine - it's a nightmare
15:24:40 <gtema> anyway - the change is ready for review and no race in tests should be added with the latest patchset
15:24:56 <gtema> tested explicitly with serial=1
15:25:24 <gtema> wrt openapi: waiting for the spec to land
15:26:21 <d34dh0r53> ack
15:26:28 <d34dh0r53> dmendiza: any srbac updates?
15:27:08 <dmendiza[m]> Only the link I shared earlier that allows domain-scoped tokens to /v3/domains
15:27:23 <dmendiza[m]> it was backported back to antelope
15:27:55 <d34dh0r53> ack
15:29:02 <bbobrov> (the one that i wanted reverted i guess)
15:30:37 <d34dh0r53> No, I think it was a different one bbobrov
15:31:41 <bbobrov> https://review.opendev.org/q/I8ee50efc3b4850060cce840fc904bae17f1503a9 ?
15:32:20 <d34dh0r53> Yeah
15:32:54 <bbobrov> yes, it is the one
15:33:58 <bbobrov> i don't know. I managed to work around this in our cloud, so i am not broken any more. But i still think that this change breaks API stability and should not have been merged like that.
15:34:06 <dmendiza[m]> Yeah, IIRC, your disagreement was about the filtering, not necessarily the policy?
15:34:35 <bbobrov> yes, it was about the filtering, but filtering got backported too
15:35:46 <bbobrov> i am not broken with the change. I know a company that will get broken with this. Maybe they will come with a bugreport later.
15:40:25 <d34dh0r53> Sorry, was looking for your comment, and I just found it, I thought it was a -1
15:42:10 <bbobrov> yeah, i should have put a -1
15:42:47 <d34dh0r53> I would argue that the previous behavior was a bug and this fixes it, but my gut feeling is that 'domain' means different things to different people.  Let's see if a bug is filed.
15:43:40 <d34dh0r53> I think the only spec we haven't visited yet is
15:43:54 <d34dh0r53> #topic specification OpenAPI support (gtema)
15:43:54 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone-specs/+/910584
15:43:54 <d34dh0r53> gtema: waiting for reviews
15:44:02 <d34dh0r53> Grzegorz Grasza:
15:44:10 <d34dh0r53> can you take a look at that one?
15:46:51 <d34dh0r53> moving on
15:46:56 <d34dh0r53> #topic open discussion
15:47:04 <d34dh0r53> passlib update... (full message at <https://matrix.org/_matrix/media/v3/download/matrix.org/enFOUAKlodnKOxTDbwCwmyOA>)
15:47:20 <d34dh0r53> no update, I need to propose a patch to pin upper-constraints
15:47:25 <d34dh0r53> next up
15:47:37 <d34dh0r53> domain manager (mhen)... (full message at <https://matrix.org/_matrix/media/v3/download/matrix.org/ttlvUIIdMfZZgFLPrzPZbnRG>)
15:48:26 <d34dh0r53> dmendiza or Grzegorz Grasza can y'all please take a look at this one?
15:49:01 <gtema> yes, pls pls pls
15:49:10 <bbobrov> there is also this - https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/900545
15:49:32 <bbobrov> which was blocked for me (thanks!) and which should not be blocked any more
15:52:44 <d34dh0r53> ack, I'll unblock that one
15:52:46 <d34dh0r53> thanks bbobrov
15:52:51 <d34dh0r53> domain list scoping fix (mhen)... (full message at <https://matrix.org/_matrix/media/v3/download/matrix.org/kgigdMYKyYbaZFuKdYDXyewK>)
15:52:52 <d34dh0r53> next up
15:53:17 <d34dh0r53> We just talked about that
15:53:32 <d34dh0r53> finally in open discussion we have
15:53:43 <d34dh0r53> Enforcing scope in keystone breaks heat (and probably magnum) (tkajinam)... (full message at <https://matrix.org/_matrix/media/v3/download/matrix.org/GTlTzihMFAAlDTiTFGJHvjTl>)
15:53:50 <dmendiza[m]> I think this is just about the test, not the patch
15:54:00 <dmendiza[m]> oh whoops, a second too late haha
15:54:55 <d34dh0r53> no worries dmendiza we can go back ^Z ^Z
15:58:01 <dmendiza[m]> Yeah, I want to say the only question we had was whether to merge that patch to tempest-plugin with the test for that endpoint
15:58:29 <dmendiza[m]> IIRC, the test that is there now only tests on the domain for the user making the request and that patch has a cross-domain test ...
15:58:43 <dmendiza[m]> I don't have a preference either way
16:00:53 <d34dh0r53> I think we should merge 900545 then
16:01:26 <d34dh0r53> and I think the only two remaining on the last point are whether or not https://review.opendev.org/c/openstack/keystone/+/916707 needs backports and https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/919405 needs reviews from dmendiza and Grzegorz Grasza.
16:01:36 <d34dh0r53> Let's quickly go through bug review
16:01:41 <d34dh0r53> #topic bug review
16:01:58 <d34dh0r53> #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0
16:02:04 <d34dh0r53> no new bugs for keystone
16:02:18 <d34dh0r53> #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0
16:02:36 <d34dh0r53> python-keystoneclient is good
16:03:01 <d34dh0r53> #link https://bugs.launchpad.net/keystoneauth/+bugs?orderby=-id&start=0
16:03:06 <d34dh0r53> nothing new in keystoneauth
16:03:20 <d34dh0r53> #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0
16:03:27 <d34dh0r53> keystonemiddleware is also good
16:03:37 <d34dh0r53> #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0
16:03:49 <d34dh0r53> no new bugs in pycadf
16:04:01 <d34dh0r53> #link https://bugs.launchpad.net/ldappool/+bugs?orderby=-id&start=0
16:04:06 <d34dh0r53> and ldappool is also clean
16:04:12 <d34dh0r53> #topic conclusion
16:04:35 <d34dh0r53> nothing from me, thanks all, apologies for the late start and missing messages :/
16:04:52 <d34dh0r53> #endmeeting