15:04:05 <d34dh0r53> #startmeeting keystone
15:04:05 <opendevmeet> Meeting started Wed Dec  4 15:04:05 2024 UTC and is due to finish in 60 minutes.  The chair is d34dh0r53. Information about MeetBot at http://wiki.debian.org/MeetBot.
15:04:05 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
15:04:05 <opendevmeet> The meeting name has been set to 'keystone'
15:04:24 <d34dh0r53> Reminder: This meeting takes place under the OpenInfra Foundation Code of Conduct
15:04:32 <d34dh0r53> #link https://openinfra.dev/legal/code-of-conduct
15:04:40 <d34dh0r53> #topic roll call
15:04:48 <d34dh0r53> admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek, gmann, zaitcev, reqa, dmendiza[m], dmendiza, mharley, jph, gtema, cardoe
15:04:54 <gtema> 0-
15:05:01 <cardoe> o/
15:06:29 <d34dh0r53> #topic review past meeting work items
15:06:47 <d34dh0r53> #link https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-11-20-15.12.html
15:06:57 <d34dh0r53> There was one action item:
15:07:14 <d34dh0r53> d34dh0r53 Update SHA in https://review.opendev.org/c/openstack/releases/+/934599 to HEAD of keystoneauth
15:07:27 <d34dh0r53> This has been done
15:07:38 <d34dh0r53> #topic liaison updates
15:07:51 <d34dh0r53> nothing from VMT nor releases
15:09:13 <d34dh0r53> #topic specification OAuth 2.0 (hiromu)
15:09:14 <d34dh0r53> #link https://review.opendev.org/q/topic:bp%252Foauth2-client-credentials-ext
15:09:15 <d34dh0r53> #link https://review.opendev.org/q/topic:bp%252Fenhance-oauth2-interoperability
15:09:16 <d34dh0r53> External OAuth 2.0 Specification
15:09:18 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone-specs/+/861554 (merged)
15:09:21 <d34dh0r53> OAuth 2.0 Implementation
15:09:25 <d34dh0r53> #link https://review.opendev.org/q/topic:bp%252Fsupport-oauth2-mtls
15:09:30 <d34dh0r53> OAuth 2.0 Documentation
15:09:33 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone/+/838108 (merged)
15:09:38 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystoneauth/+/838104 (merged)
15:09:44 <d34dh0r53> no updates from me on this one
15:09:48 <d34dh0r53> next up
15:09:54 <d34dh0r53> #topic specification Secure RBAC (dmendiza[m])
15:09:58 <d34dh0r53> #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_
15:10:00 <d34dh0r53> 2024.1 Release Timeline
15:10:03 <d34dh0r53> Update oslo.policy in keystone to enforce_new_defaults=True
15:10:05 <d34dh0r53> Update oslo.policy in keystone to enforce_scope=True
15:11:40 <d34dh0r53> dmendiza: you around?
15:13:00 <d34dh0r53> guess not
15:13:02 <d34dh0r53> #topic specification OpenAPI support (gtema)
15:13:04 <d34dh0r53> #link https://review.opendev.org/q/topic:%22openapi%22+project:openstack/keystone
15:13:39 <gtema> after merging some of the latest changes I noticed some jsonschemas became corrupted (the ones which are not attached to api yet)
15:13:53 <gtema> but for the moment I have implemented workaround
15:14:11 <gtema> that tells we need to speed up a bit merging the changes
15:14:31 <gtema> and so the work is in progress. Nothing else about openapi
15:14:53 <d34dh0r53> ack, do any of them need reviews right now?
15:15:07 <gtema> will check today what is up next
15:15:16 <d34dh0r53> ack, thanks gtema (Artem Goncharov)
15:15:23 <d34dh0r53> #topic specification domain manager (mhen)
15:15:26 <d34dh0r53> still unmerged are:
15:15:28 <d34dh0r53> documentation: https://review.opendev.org/c/openstack/keystone/+/928135
15:15:31 <d34dh0r53> tempest tests: https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/924222
15:15:52 <d34dh0r53> dmendiza, Grzegorz Grasza please review these
15:16:15 <dmendiza[m]> 🙋‍♂️
15:16:48 <d34dh0r53> o/ dmendiza
15:17:52 <dmendiza[m]> Ack, will take a look at Domain Manager patches
15:18:08 <d34dh0r53> thanks!
15:18:27 <d34dh0r53> next up
15:18:34 <d34dh0r53> #topic specification Include bad password details in audit messages (stanislav-z)
15:18:37 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone-specs/+/915482
15:18:40 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone/+/932423
15:18:43 <d34dh0r53> 20-Nov update: spec and implementation updated for HMAC-based hashing. Looking for reviews.
15:18:54 <d34dh0r53> Stanislav Zaprudskiy: any updates?
15:19:29 <gtema> I guess our reviews are missing
15:20:20 <d34dh0r53> indeed
15:20:58 <gtema> sadly I had no time to look at it so far
15:21:15 <d34dh0r53> nor me
15:21:29 <d34dh0r53> we can dedicate some time during the reviewathon this week
15:22:04 <d34dh0r53> #action reviewathon look at the Bad Password spec https://review.opendev.org/c/openstack/keystone-specs/+/915482
15:22:09 <d34dh0r53> next up
15:22:17 <d34dh0r53> #topic open discussion
15:22:19 <d34dh0r53> new gate (un)blocker
15:22:22 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone/+/936721
15:23:02 <gtema> last week I identified (after working on pagination) that I accidentally introduced new blocker with the change in devstack that got merged
15:23:35 <d34dh0r53> ack, I just reviewed it
15:23:53 <d34dh0r53> dmendiza: can you push the go button on https://review.opendev.org/c/openstack/keystone/+/936721
15:24:05 <gtema> this change fixes that. Point is that 1st I introduced new wsgi module, 2nd devstack switched to using that, 3rd - there are no federation jobs running in devstack changes so I missed breaking federation tests
15:24:11 <gtema> thks
15:24:34 <dmendiza[m]> lgtm
15:25:36 <d34dh0r53> 👍️
15:25:39 <d34dh0r53> next up
15:25:42 <d34dh0r53> pagination (gtema)
15:25:45 <d34dh0r53> #link https://review.opendev.org/q/topic:%22pagination%22+project:openstack/keystone
15:25:49 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone/+/933598 must be merged before next work can be started
15:26:08 <gtema> right, so last week I have figured out that the change was already paginating domains
15:26:17 <gtema> because domains are, well, projects
15:26:43 <gtema> so I fine-tuned the change to explicitly tell that and added sufficient unit tests for the changed API
15:26:48 <d34dh0r53> ahh
15:27:10 <d34dh0r53> is the zuul failure still unrelated?
15:27:17 <gtema> this is the one from above
15:27:21 <gtema> the federation stuff
15:27:28 <gtema> once that is merged should be fine
15:27:32 <d34dh0r53> ack
15:27:54 <d34dh0r53> I'll try to review pagination this week
15:28:01 <gtema> awesome, thanks
15:28:15 <d34dh0r53> anything else for open discussion?
15:28:24 <gtema> not from me
15:29:18 <d34dh0r53> #topic bug review
15:29:22 <d34dh0r53> #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0
15:29:43 <d34dh0r53> #link https://bugs.launchpad.net/keystone/+bug/2089051
15:29:56 <d34dh0r53> gtema (Artem Goncharov): have you seen this one?
15:30:11 <d34dh0r53> it looks like Takashi is working on it, but wanted you to see it
15:30:16 <gtema> I think I have seen that report
15:30:28 <d34dh0r53> not sure if it coincides with what you're working on
15:31:14 <gtema> to some extend it does, but not heavily
15:31:18 <d34dh0r53> ok
15:31:20 <d34dh0r53> next up
15:31:23 <d34dh0r53> #link https://bugs.launchpad.net/keystone/+bug/2089403
15:32:01 <gtema> we identified that working on openapi
15:33:13 <gtema> if you remember we have this one change removing "experimental" label from the unified limits api
15:33:23 <gtema> and this is one interesting gotcha there
15:33:28 <d34dh0r53> indeed
15:33:46 <d34dh0r53> based on the test that is expected behavior though, which is interesting
15:34:34 <gtema> yeah, I think people have overseen that
15:36:08 <d34dh0r53> ok, we at least need documentation
15:37:31 <d34dh0r53> that does it for keystone
15:37:33 <d34dh0r53> next up
15:37:41 <d34dh0r53> #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0
15:37:57 <d34dh0r53> no new bugs in python-keystoneclient
15:38:20 <d34dh0r53> #link https://bugs.launchpad.net/keystoneauth/+bugs?orderby=-id&start=0
15:38:29 <d34dh0r53> looks like keystoneauth is good
15:38:33 <d34dh0r53> #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0
15:38:43 <d34dh0r53> as is keystonemiddleware
15:38:47 <d34dh0r53> #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0
15:38:53 <d34dh0r53> pycadf is good
15:38:59 <d34dh0r53> #link https://bugs.launchpad.net/ldappool/+bugs?orderby=-id&start=0
15:39:06 <d34dh0r53> so is ldappool
15:39:09 <d34dh0r53> #topic conclusion
15:39:33 <d34dh0r53> That's all I have, thanks everyone!
15:39:36 <gtema> thks
15:39:39 <d34dh0r53> #endmeeting