15:01:32 <d34dh0r53> #startmeeting keystone
15:01:32 <opendevmeet> Meeting started Wed Nov  5 15:01:32 2025 UTC and is due to finish in 60 minutes.  The chair is d34dh0r53. Information about MeetBot at http://wiki.debian.org/MeetBot.
15:01:32 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
15:01:32 <opendevmeet> The meeting name has been set to 'keystone'
15:01:38 <d34dh0r53> Reminder: This meeting takes place under the OpenInfra Foundation Code of Conduct
15:02:21 <d34dh0r53> #link https://openinfra.dev/legal/code-of-conduct
15:03:08 <d34dh0r53> #topic roll call
15:03:13 <gtema> o/
15:03:20 <d34dh0r53> admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek, gmann, zaitcev, reqa, dmendiza[m], dmendiza, mharley, jph, gtema, cardoe, deydra
15:03:26 <d34dh0r53> dmendiza: o/
15:04:14 <opendevreview> Tobias Urdin proposed openstack/keystone master: wip: Allow service user to get credential policies  https://review.opendev.org/c/openstack/keystone/+/966189
15:07:54 <d34dh0r53> #topic review past meeting work items
15:08:47 <d34dh0r53> #link https://meetings.opendev.org/meetings/keystone/2025/keystone.2025-10-15-15.03.html
15:09:38 <gtema> on the working items - are we ready to send out ptg summary?
15:10:32 <d34dh0r53> Yeah, getting close
15:11:00 <d34dh0r53> the only action item was to plan a session with horizon which was done
15:11:14 <d34dh0r53> #topic liaison updates
15:11:17 <d34dh0r53> nothing from me
15:11:42 <gtema> nothing special from me either
15:13:08 <d34dh0r53> #topic specification OAuth 2.0 (hiromu)
15:13:24 <d34dh0r53> #link https://review.opendev.org/q/topic:bp%252Foauth2-client-credentials-ext
15:13:36 <d34dh0r53> #link https://review.opendev.org/q/topic:bp%252Fenhance-oauth2-interoperability
15:13:39 <d34dh0r53> no updates on this one
15:13:48 <d34dh0r53> #topic specification Secure RBAC (dmendiza)
15:14:00 <d34dh0r53> #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_
15:14:06 <d34dh0r53> 2025.2 Release Timeline
15:14:11 <d34dh0r53> Update oslo.policy in keystone to enforce_new_defaults=True
15:14:17 <d34dh0r53> Update oslo.policy in keystone to enforce_scope=True
15:14:47 <gmaan> are those disable in keystone?
15:14:51 <dmendiza[m]> 👋
15:14:51 <dmendiza[m]> Sorry, only half-here
15:16:00 <dmendiza[m]> gmaan there's only one place where they are still set to false
15:16:51 <gmaan> I think I removed but can you please give me link and  I can check
15:16:59 <dmendiza[m]> #link https://opendev.org/openstack/devstack/src/commit/f6d8dab0e885b8de8c0f44388d538da7d4f9b7ec/lib/keystone#L122
15:17:21 <gmaan> oh, for testing
15:17:36 <dmendiza[m]> Yeah, all the gate jobs are running without it
15:17:46 <dmendiza[m]> or most jobs anyway
15:17:47 <gmaan> yes, I am working to enable the things at global level in devstack and also remove it if they are disable like in keystone devstack plugin
15:18:22 <gmaan> because as per goal timeline, I am going to remove this config option 'enforce_scope' from oslo, 'enforce_new_defaults' will stay same
15:18:40 <gmaan> and to remove that scope flag I need to cleanup those configurable bits from testing side also
15:19:11 <gmaan> #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#id5
15:19:49 <gmaan> this ^^ one basically. which we should have done in lthe ast cycle, but I am intentionally lazy in removing the things
15:20:20 <gmaan> so I am thinking to do in this cycle if projects are ok. I will send it on ML also to get lazy consensus
15:25:52 <gtema> next?
15:26:32 <d34dh0r53> Sorry
15:26:36 <d34dh0r53> Also, half
15:26:37 <d34dh0r53> here
15:26:40 <d34dh0r53> #topic specification Secuirty Compliance Testing (dmendiza)
15:26:47 <d34dh0r53> #link https://review.opendev.org/c/openstack/devstack/+/957969
15:28:12 <gmaan> Yeah have reviewed this series, devstack, tempest, keystone change long back and many times. One thing left and I am waiting is to add depends-on in keystone change so that we can see the result of new test and devstack change
15:28:14 <gmaan> #link https://review.opendev.org/c/openstack/keystone/+/961726
15:28:28 <gmaan> i thin k I commented it many times in devstack as well as in keystone change
15:28:46 <gmaan> but to merge the devstack, tempest change, we need keystone change to test it and green
15:29:39 <gmaan> dmendiza[m]: if you are ok, can you or I can add this change as depends-on in keystone change #link https://review.opendev.org/c/openstack/tempest/+/954029
15:30:13 <gmaan> this tempest change add new test which will be running in keystone new job added in 961726
15:32:13 <gmaan> anyways we can move, I will update the keystone change
15:32:26 <d34dh0r53> thanks gmaan
15:32:33 <d34dh0r53> #topic specification OpenAPI support (gtema)
15:32:45 <d34dh0r53> #link https://review.opendev.org/q/topic:%22openapi%22+project:openstack/keystone
15:32:57 <gtema> I need a go on https://review.opendev.org/c/openstack/keystone/+/965939
15:33:10 <gtema> requirements and python dependency hell broke me AGAIN
15:33:53 <gtema> so now we are again not able to render the openapi docs properly
15:34:44 <gtema> I am ready to give up, this is taking much more energy than it is usable
15:35:53 <gtema> the background for that fix is that I got a report on the rust cli repo for the invalid keystone schema, but the fix cannot be released since that job is now broken
15:36:44 <gtema> thks Dave for review. That's it on the topic, we can move next
15:36:53 <d34dh0r53> cool, thanks
15:37:08 <d34dh0r53> #topic open discussion
15:37:15 <d34dh0r53> drencrom
15:37:19 <d34dh0r53> pep8 (mypy) is broken on 2024.2 branch (see for example https://zuul.opendev.org/t/openstack/build/2fdbd3164c8c4241a5a6edd1895f6d3c)
15:37:41 <gtema> I removed this from agenda - this was fixed to release the fixes few days back
15:38:36 <gtema> unfortunately I missed few minutes to land the fix on 2024.1 before it went unmaintained
15:39:14 <gtema> and now the fix does not work on unmaintained/2024.1 due to other issues, so also here I gave up on trying to fix the world
15:41:31 <d34dh0r53> ahh, my copy hadn't updated
15:41:55 <d34dh0r53> odd issues with my system today, memory leak somewhere
15:42:18 <d34dh0r53> anything else for open discussion?
15:43:09 <gtema> not from me. On Friday during review-a-ton we should discuss the way out of the token caching hell, I mean the bugs related to caching
15:44:15 <d34dh0r53> ack
15:44:24 <d34dh0r53> #topic bug review
15:44:31 <d34dh0r53> #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0
15:45:07 <d34dh0r53> it doesn't look like we have any new bugs in keystone
15:45:28 <gtema> right, the ones there are known
15:45:36 <d34dh0r53> yeah
15:45:39 <d34dh0r53> next up
15:45:41 <d34dh0r53> #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0
15:45:53 <d34dh0r53> nothing new here
15:47:32 <d34dh0r53> #link https://bugs.launchpad.net/keystoneauth/+bugs?orderby=-id&start=0
15:47:50 <d34dh0r53> no new bugs in keystoneauth either
15:48:01 <d34dh0r53> #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0
15:48:21 <d34dh0r53> we do have a new bug in keystonemiddleware
15:48:38 <d34dh0r53> #link https://bugs.launchpad.net/keystonemiddleware/+bug/2130049
15:49:46 <gtema> a broken VMT process - nice
15:50:14 <d34dh0r53> indeed
15:50:36 <gtema> we should than review the fix asap
15:50:51 <opendevreview> Aarni Koskela proposed openstack/python-keystoneclient master: Remove `debtcollector` dependency  https://review.opendev.org/c/openstack/python-keystoneclient/+/966199
15:50:53 <d34dh0r53> yeah, for sure
15:52:34 <d34dh0r53> I'll review it today, Grzegorz Grasza , dmendiza can you please review https://review.opendev.org/c/openstack/keystonemiddleware/+/965170 as well
15:52:54 <d34dh0r53> #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0
15:53:01 <d34dh0r53> no new bugs in pycadf
15:53:14 <d34dh0r53> #link https://bugs.launchpad.net/ldappool/+bugs?orderby=-id&start=0
15:53:20 <d34dh0r53> and ldappool is also good
15:53:28 <d34dh0r53> #topic conclusion
15:53:38 <d34dh0r53> Thanks everyone, also thank you for the great PTG
15:53:51 <gtema> indeed
15:56:01 <d34dh0r53> #endmeeting