20:04:09 #startmeeting 20:04:10 Meeting started Tue Aug 23 20:04:09 2011 UTC. The chair is jbryce. Information about MeetBot at http://wiki.debian.org/MeetBot. 20:04:11 Useful Commands: #action #agreed #help #info #idea #link #topic. 20:05:05 who's around? 20:05:09 hi 20:05:11 o/ 20:05:13 o/ 20:05:14 o/ 20:05:25 hi jbryce, I'm here about quantum's incubation proposal 20:05:30 hi 20:05:31 not me 20:05:32 ziad 20:05:52 danwent: denied. all done! ;P 20:05:59 :P 20:06:02 aw. 20:06:23 o/ 20:06:33 o/ 20:06:38 ok 20:06:48 lots to cover today: http://wiki.openstack.org/Governance/PPB 20:07:06 #topic keystone update 20:07:17 1. API spec published 20:07:19 zns: can you give us an update on the progress of the api lockdown? 20:07:27 Service (Public) API: https://github.com/openstack/keystone/blob/master/keystone/content/service/identitydevguide.pdf 20:07:27 Admin (Private/Privileged) API: https://github.com/openstack/keystone/raw/master/keystone/content/admin/identityadminguide.pdf 20:07:27 WADLs/XSD all available in the keystone/content folders in the source code 20:07:41 2. I'm working with core teams on integration. Just got of the phone with SandyWalsh. 20:07:41 anything in HTML? :) 20:07:41 3. Issues list import into Launchpad is waiting on Launchpad to do the import. 20:07:57 We're working on refactoring to meet that spec now. 20:08:23 joshuamckenty_, ewanmellor: we just got started; talking about keystone right now 20:08:32 It compiles to HTML. But we don't have it published yet. We can work with Anne on that. 20:08:33 Namaste 20:09:18 anotherjesse: does the published api make you feel better about the external stability of keystone? 20:09:28 jaypipes: i.e. if you download the source from openstack-manuals, there is a webhelp folder with the HTML. 20:09:47 jbryce: browsing it 20:10:22 zns: thanks for the comprehensive update. you were ready! = ) 20:10:31 o/ 20:10:41 jbryce: You guys set a high bar :-) 20:10:49 zns: what is tate of implementation of it? 20:10:59 is the doc what is implemented? 20:11:39 sorry I'm late 20:12:01 We're working on that now. Biggest change is the move from using username as identifier to supporting a UID. But the spec is now much smaller so implementation should be pretty quick. 20:12:23 Wow these docs helps me a lot! 20:12:32 And we need to move the management calls to RAX or OS extensions. 20:13:38 anotherjesse: Not sure I answered your question. What metric would you like? 20:14:20 zns: maybe a simple one - of when you think the core api will be finished implementation (and then maybe for extensions if reasonable to guestimate) 20:15:11 we need a locked version for d4 20:15:42 We should have it working by the end of the week. Code compiles and passes tests now and will continue to do so throughout. What we need to coordinate is changes to the middleware with the other core projects (since the middleware is now in their code). 20:15:48 zns: perhaps I'm missing something, but I'm not seeing API calls for POST /users//roles? How does one add a user to a role through the admin API? 20:16:02 vishy, anotherjesse: is that a component of a core promotion decision? again, the core promotion is really saying it would be a core project for essex, not for diablo. 20:16:59 jbryce: but we can use these to put pressure on them to work faster ;) 20:16:59 jaypipes: if you use our reference implementation, you would either use an extension or keystone-manage. If you're using something else, like Active Directory, then that's managed using the Active Directory tools. We're leaving the management out of the core API... 20:17:24 jaypipes: the extension will be OS-KSADMIN. Separate WADL and XSDs. 20:17:39 zns: KSADMIN? 20:17:47 ah, Keystone... 20:17:47 keith stone? 20:17:49 Keystone Admin extensions. 20:17:59 thought might be a typo for RSADMIN.... 20:18:12 anotherjesse: +1, rename in order 20:18:25 anotherjesse: don't start that meme again! 20:18:35 lol 20:18:38 zns: sorry - haven't slept much 20:18:44 last week we decided to defer a vote and wait for an update on the feedback we'd given. we can either defer again to next week (last chance before 2011-09-05 deadline) or vote today 20:18:51 ok, so jbryce are we voting for promotion again today? 20:19:00 jinx. 20:19:02 We'll have RAX extensions as well. 20:19:31 … to support API key authentication 20:20:12 i'd prefer to vote unless anyone feels strongly they have specific items to block until next week on 20:20:42 indeed (and we have much else to discuss) 20:21:02 #info VOTE: Should Keystone be accepted as a core project for Essex release cycle? 20:21:08 +1 20:21:11 +1 20:21:12 +1 20:21:14 +1 20:21:19 +1 20:21:21 +1 20:21:25 +1 20:21:27 +1 20:21:30 +1 20:21:32 +1 20:21:44 well that was easy... 20:21:58 #agreed Keystone will be core for Essex (9 +, 2 abstain) 20:21:59 Cool! 20:22:06 Thanks, guys. 20:22:10 zns: are you off to drink? 20:22:11 congrats zns! 20:22:15 #topic Security Group Proposal take 2 20:22:19 http://wiki.openstack.org/Governance/Proposed/OpenStack%20Security%20Group 20:22:19 zns: now the pain begins. 20:22:24 zns: disneyland! 20:22:24 More like off to work! 20:22:33 zns: I'll be your worst nightmare. 20:22:38 ttx worked with jarret to update with our feedback 20:23:07 ttx: I'll get to practice my French. 20:23:11 the gist is that it is now split into a small vulnerability management team and a larger security testing etc team 20:23:26 basically it keeps the vulnerability treatment team small. Without preventing the set up of a large security interest group. 20:23:36 jbryce: are we discussing it in toto or the 2 parts separately? 20:24:06 notmyname: we can do two parts, if there is a good reason to 20:24:11 if we only want to approve one part that's fine 20:24:24 i would like to discuss both though 20:24:28 I like the first part (management team) and would prefer to defer ont he second 20:24:39 the first part is what's urgent 20:24:51 ok. let's vote on the first part, because i think that's more time sensitive and agreed to already 20:24:58 (in order to have a team responsible for setting up the security info pages. quick) 20:25:07 the first part being the "Vulnerability Management Team" heading on the page 20:25:12 I'm with notmyname 20:25:26 +1 20:25:34 Oh too late 20:25:35 any issue with that first part ? 20:25:44 No, sounds good. 20:25:58 #info VOTE: Should we establish a vulnerability management team? 20:26:04 +1 20:26:04 +1 20:26:05 +1 20:26:05 +1 20:26:06 as defined in that doc? 20:26:11 notmyname: yes 20:26:11 note that core devs will have access to security bugs in LP. 20:26:13 +1 20:26:14 +1 20:26:14 +1 20:26:14 a SMALL vulnerability management team... 20:26:19 +1 20:26:21 +1 20:26:22 +1 20:26:23 -1 … we have no vulnerabilitys 20:26:27 lol :) 20:26:29 joke - +1 20:26:31 +1 20:26:41 Jesse is in rare form! 20:26:49 can we add jesse as a vulnerability? 20:26:55 No 20:26:59 #agreed Establish small vulnerability management team. (11 +) 20:27:15 #action jbryce split out the vulnerability management paragraph into a separate document 20:27:36 does anyone want to discuss the larger concept of the openstack security group now? 20:27:50 that can wait if we have more pressing matters 20:27:52 I see no need 20:27:55 Nor do I. 20:28:03 People can form whatever groups they want. 20:28:09 soren: +1 20:28:12 THere's no need for ppb blessing. 20:28:15 are we fine if jarret moves forward along a path like he laid out there without official sanction 20:28:24 soren: i agree 20:28:24 sure 20:28:27 ok 20:28:42 jbryce: as long as it's not presented as binding for openstack 20:28:45 jbryce: I would like to put a requirement that the website gets updated 20:28:47 notmyname, soren: that's a fair point. 20:28:55 to have a security link at the obttom of openstack pages 20:28:57 I have been concerned that it seems nobody has been primarily tasked with just security auditing AIUI. 20:29:24 #action jbryce to make sure security link makes it into openstack web property footers 20:29:36 #info openstack security group can form informally with interested parties without official sanction 20:29:46 Daviey: nothing stopping a working group from being formed. 20:29:58 Daviey: i think jarret is interested in forming that kind of group 20:29:59 we don't want to set a precedent that any discussion group needs to go through PPB 20:30:08 ttx: +1000 20:30:20 jbryce: Good stuff. 20:30:22 devcamcar: you around? 20:30:52 danwent: still here? 20:30:54 if the group gets any privilege or special power, I see why it needs to be blessed by PPB. If not, then just form it[tm] 20:30:58 ready and waiting :) 20:31:26 ttx: how about a legal working group? 20:31:30 we'll circle back to dashboard if devcamcar is here 20:31:34 #topic Quantum incubation 20:32:04 johnpur: if its decisions are not binding the rest of the community, they can gather and discuss all they want. 20:32:05 http://wiki.openstack.org/Projects/IncubatorApplication/Quantum 20:32:37 quantum would like to become an incubated project 20:32:44 ttx: i see it as an advisory group to ppb and governance issues 20:32:53 since I have been involved with quantum. should I recuse myself? 20:33:21 o/ 20:33:59 dendrobates: I don't think so. 20:34:02 dendrobates: I was involved with keystone - and was a harsh critic of acceptance to core (sorry zns - just want it to be ready) 20:34:04 dendrobates: i don't have a problem with your involvement 20:34:19 k 20:34:26 we're happy to answer any questions about quantum 20:34:32 so - just put your opensource hat on and you will be a good person in the conversation 20:35:15 anotherjesse: It's the only hat I own 20:35:21 dendrobates: Can you see a time when quantum is likely to become a required part of openstack networking? 20:35:44 Daviey: I personally don't think it should ever be required 20:36:00 dendrobates / danwent quantum works as well as existing model - but can you just use quantum and not existing models (eg is there the overlap?) 20:36:01 not for simple pilots or testing at least 20:36:10 +1 quantum is really about being able to take advantage of more advanced network functionality. 20:36:32 danwent: so is it an abstraction of swift/router APIs? 20:36:37 dendrobates / danwent if nova devs want to deprecate nova-network what do we lose? 20:36:38 switch 20:36:55 dendrobates: What i am asking is, does it make sense for it to potentially superseed FlatManager and VlanManager ? 20:37:05 (in production enviroments) 20:37:07 dendrobates: what Daviey said 20:37:08 anotherjesse: if you're using quantum, we have a model that works well with the existing nova-manage commands (i.e., when you create a network with nova-manage, we create a quantum network on the backend). But yes, you would either use quantum, or the old bridge model. 20:37:10 anotherjesse: the ability to get test nova without installing quantum 20:37:24 notmyname: not related to swift at all. 20:37:39 danwent: ya, mistype. muscle memory. I meant switch 20:37:40 Daviey: I think that is really a decision for Nova 20:37:45 I think it could 20:38:00 anotherjesse: nova-network still handles some things that are not done by quantum (e.g., deciding which vNICs a VM gets) 20:38:17 dendrobates: for keystone integration we deprecated the existing user system and have a simple "noauth - eg trust whoever the user says they are" 20:38:31 dendrobates: could / should we do something like that for quantum as it matures 20:38:47 in general, I think it would make sense to simplify nova networking in the future, to just support a simple standalone model similar to flatmanager 20:38:49 anotherjesse: true, we did not want to assume that though 20:39:08 notmyname: yes 20:39:23 dendrobates: awesome 20:39:26 model is basically that you can define "networks" that correspond to an L2 domain, and "ports" on those L2 domains. 20:39:43 in the future we will explore L3, but right now the core API is only about L2 connectivity. 20:39:54 dendrobates / danwent: I've struggled to work out how much i should care about Quantum, would it be possible to make better docs (or screencast), and help with the visability of those? 20:39:59 anotherjesse: yes, I think that's the right approach. 20:40:16 Daviey: I have been meaning to do a screencast for some time. 20:40:20 rocking 20:40:29 danwent: PLEASE DO THAT! (screencast) 20:40:45 we're talking about incubation for quantum here, (not core) so the evaluation criteria are really around if we think this has a part as a potential core openstack project, is it at a point that it has code and developers and should start on the path for integration 20:40:48 danwent: we started using / giving feedback on keystone since the beginning - should nova core as part of incubation get serious about using/knowing qauntum? 20:40:52 Daviey: the real pain point is for customers that need to be able use advanced network capabilities, whereas the existing nova networking is pretty tied to basic linux bridge + vlan capabilities 20:41:26 anotherjesse: if quantum gets in incubation before the design summit, we can set up sessions to discover the code base 20:41:36 Quantum has a very healthy and diverse dev community and a good leader in danwent 20:41:47 danwent++ 20:41:58 anotherjesse: so far we've been focused on building the core quantum service, just in the d4 timeline have we started focusing on nova integration in earnest. We've prototyped that with a QuantumManager class that replaces FlatManager, etc. 20:42:21 we're definitely happy for input from any nova team members. 20:42:24 dendrobates: for dashboard we thought that having the openstack apis in place was important for incubation 20:42:40 dendrobates: is there anything you think should be done before incubation with quantum? 20:43:00 danwent: to kick the tires do I need anything more than a cluster? 20:43:07 danwent: how autonomous is quantum? is it possible to deploy quantum without nova (or another openstack project)? 20:43:28 yes, I'm interested in the answer to that, too... notmyname's question... 20:43:32 anotherjesse: its pretty simple. for example, you can check out the tutorial demo I sent out to the the list (I will dig up the link) 20:43:43 This is screaming for a "how to test" blog post :) 20:43:45 anotherjesse: I think it is in pretty good shape for incubation 20:43:47 anotherjesse: quantum ui for dashboard is in code review right now 20:43:57 danwent: Anyone driving dashboard integration? 20:43:59 will land probably in next few days 20:44:12 Daviey: ^^^ 20:44:16 bah 20:44:17 Daviey: yes, asomya from my team is leading that 20:44:23 devcamcar: saw that .. jake said it didn't use the extension model at first - is that important? (we can discuss in #dev) 20:44:27 it actually seems like it is pretty mature for just entering incubation 20:44:35 anotherjesse: no 20:44:35 Daviey: yes, mark voelkers team from cisco is working on dashboard integration 20:44:39 jbryce: we held it out early on 20:44:54 jbryce: while the pbb wrestled with the policies 20:45:00 on being stand-alone, yes, quantum is a separate process that can run with nova. but nova is the only openstack service that we have integrated with so far. 20:45:25 danwent: does the api follow a similar rest with openstack auth approach? 20:45:35 Daviey: I actually sent a link out for that to the list last week. will dig it up. 20:45:43 anotherjesse: yes, very much so 20:45:55 other iaas solutions have expressed interest in using quantum as well, so nothing to nova specific has been done 20:46:03 http://wiki.openstack.org/QuantumAPISpec 20:46:10 looks squeeky clean to me - /me is excited to test it out once diablo is shipped 20:46:15 i'm not hearing any huge blockers here and we're running low on time, so unless anyone objects, i'd like to vote 20:46:23 agree 20:46:24 +1 20:46:27 indeed. ++ for wiki API docs. 20:46:29 +1 20:46:31 +1 20:46:31 here's the link to a tutorial based on vish's script: http://wiki.openstack.org/QuantumOVSDemo 20:46:32 #info VOTE: Should Quantum be accepted as an OpenStack Incubation project 20:46:38 +1 20:46:39 +1 20:46:43 +1 20:46:44 +1 20:46:48 -1 20:46:57 +1 20:47:00 +1 20:47:03 notmyname: reason? 20:47:17 +0 20:47:26 I've been burned by sitting on the fence before. I'd prefer not to +0 20:47:33 heh 20:47:38 #agreed Quantum will be accepted for OpenStack incubation (9+, 1 abstain, 1-) 20:47:44 #link Quantum dashboard integration: http://wiki.openstack.org/QuantumClientGUI 20:47:47 notmyname: definitely let me know if you have suggestions for improving the project 20:48:05 great, on behalf of the quantum team, thanks! 20:48:06 thanks danwent, dendrobates 20:48:13 #topic Dashboard core promotion 20:48:22 in 12 min :) 20:48:27 i'll type fast :) 20:48:30 nice 20:48:47 devin would like us to consider promoting Dashboard to a core project for the Essex release cycle 20:49:03 if we can't get through it all today, we have one more week to vote on it before the deadline 20:49:22 but does anyone have any questions objections for devcamcar to start with? 20:49:38 i can give a quick overview of where it's at now as well if that would help 20:49:41 devcamcar: do you know of any other competing dashboard initiatives for openstack? 20:49:42 what's the status of using standard tools/processes? 20:49:53 dendrobates: no 20:49:59 devcamcar: what's the status of using standard tools/processes? 20:50:20 LP, gerrit, etc 20:50:24 notmyname: we use launchpad for release management, bug tracking, blueprints, github for code, but we have not moved to gerrit but plan to do so soon 20:50:38 test coverage? 20:50:50 devcamcar: you already do +1 for code reviews before merge though right? 20:50:51 notmyname: and follow milestones and release dates according to openstack proper 20:50:53 err +2 20:51:02 anotherjesse: yes 20:51:14 jmckenty: test coverage has been -greatly- improved in past few months 20:51:17 devcamcar: I still think the name needs to be cooler for promotion to core 20:51:20 we have coverage reports as well 20:51:27 nova, glance, swift, quantum keystone .. and dashboard? 20:51:36 dishrack 20:51:39 anotherjesse: i always have called it dash but that was taken on lp ;) 20:52:06 "dash" is pretty overloaded. 20:52:20 anotherjesse: +1 20:52:31 hud! 20:52:40 windows :-) 20:52:44 Currently the dashboard is OSAPI centric, is anyone (and is it viable) to support ec2 elements? 20:52:47 mrs. dash? 20:52:49 Such as differeing crednetials? 20:52:49 devcamcar: I'm going to owe you a whiskey if I get dashboard voted down due to naming ... 20:52:56 instrumentbræt 20:53:09 (dashboard in Danish) 20:53:25 Daviey: OS API vs EC2 API is more about what the guts of it use to communicate with the nova and glance pieces 20:53:27 trifle 20:53:32 pinch 20:53:34 braet is hard to type 20:53:35 smidge! 20:53:44 amudge? 20:53:51 jmckenty_: You just hit the æ key. Easy. 20:53:53 Daviey: its more about feature support, and OS API has caught up to EC2 API in diablo 20:53:54 soren: you don't even bother to spell your own name properly most of the time! 20:53:59 does this mean we have no more substantive issue to discuss with it? = ) 20:54:01 can we accept but with a new name to be determined later ? 20:54:02 jmckenty_: Or compose+a+e. 20:54:08 devcamcar: But the OSAPI doesn't expose EC2 credentials, (yet) :) 20:54:09 if so - vote 20:54:12 correct 20:54:14 ewanmellor: Fair point :) 20:54:19 � 20:54:21 Daviey: we are still adding those to nova & keystone 20:54:24 Daviey: it will 20:54:29 Ah, good stuff. 20:54:33 #info VOTE: Should Dashboard be promoted to core for Essex release cycle? 20:54:35 Daviey: yes that should be a bug 20:54:39 if there is a ec2 extension in keystone 20:54:40 devcamcar: is there a commitment 20:54:42 +1 20:54:48 +1 20:54:50 to keep dashboard up to partiy with the full OS API? 20:54:55 +1 20:54:57 +1 20:55:00 +1 20:55:01 jmckenty_: that is absolutely the goal 20:55:05 +1 then 20:55:08 +1 20:55:09 +1 20:55:13 with a qualification that dash(board) isn't the name 20:55:21 * vishy hopes that these things becoming core will make them much easier to install 20:55:21 +1 on a better name 20:55:25 -1 20:55:27 swift and dash are too close 20:55:27 anotherjesse: agreed! we will name it while drinking whiskey 20:55:33 * jmckenty_ promises to give vishy his installer 20:55:45 wait 20:55:49 can we call it whiskey? 20:55:50 devcamcar: add a session for boston for naming? 20:55:52 OOH 20:55:53 oo 20:55:53 bourbon 20:55:59 that is genius 20:56:00 haha 20:56:03 bourbon is the official drink of cloud, though 20:56:06 jaypipes: rationale ? 20:56:11 jmckenty_: +1 20:56:16 #agreed Dashboard will be promoted to OpenStack core for Essex release cycle (8+, 2 abstain, 1-) 20:56:24 ttx: same as my rationale for voting -1 for incubation to core :) 20:56:34 ttx: I don't think it's a core project ;) 20:56:42 jaypipes: you hate css ? 20:56:44 ttx: it's awesome, just don't consider it in the same vein. 20:56:49 ttx: just being consistent. 20:56:51 congrats, devin 20:56:56 jaypipes: ack 20:56:58 (whiskey would get confused with wsgi in conversation; bourbon is unambiguous.) 20:57:03 #topic open discussion 20:57:08 bengrue: hehe, good point. 20:57:10 devcamcar: welcome to hell too. 20:57:11 summit registration! 20:57:14 hooray! 20:57:14 anyone want to hit on anything in the last 2 minutes, 30 seconds? 20:57:15 jaypipes: +1 20:57:20 summit registration! 20:57:23 anotherjesse: dude, don't steal my effects :) 20:57:32 ttx: sorry - just excited about http://summit.openstack.org/ 20:57:36 haha 20:57:45 anotherjesse: that's kind of wrong 20:57:46 jbryce: I've got a FITs framework doc coming together 20:57:53 jaypipes: Would it be a fair summary to say that in your terminology "core" means (near) bottom of the stack? 20:57:56 Will have a draft on the wiki for next week 20:57:57 * ttx must resist sudo apache2ctl stop 20:58:07 soren: yes, I guess os. 20:58:08 so. 20:58:15 jmckenty_: cool, sounds good 20:58:21 ttx: There you have it ^ 20:58:24 can we put api discussion on the docket for next time 20:58:27 yes please 20:58:32 +1 for API discussion 20:58:38 jmckenty_: with the FITs - is it online already? 20:58:43 #action jbryce to add API discussion to next week's agenda 20:58:53 google doc, I'll share it when I'm sure it's not inflammatory 20:58:54 :) 20:59:12 jmckenty_: hmm - next month or ? 20:59:29 he said next week 20:59:46 thanks, everyone! 20:59:46 yup 20:59:48 #endmeeting