03:00:43 <Sundar49> #startmeeting openstack-cyborg 03:00:44 <openstack> Meeting started Thu Dec 12 03:00:43 2019 UTC and is due to finish in 60 minutes. The chair is Sundar49. Information about MeetBot at http://wiki.debian.org/MeetBot. 03:00:45 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 03:00:47 <openstack> The meeting name has been set to 'openstack_cyborg' 03:00:52 <Sundar49> Hi all 03:01:13 <chenke> Hi all. 03:01:19 <chenke> info chenke. 03:01:23 <chenke> info# chenke 03:01:25 <Yumeng> #info Yumeng 03:01:34 <Sundar49> Hi chenke, Yumeng 03:01:51 <Yumeng> Hi Sundar49 03:01:52 <Sundar49> Let's give a min for folks to join 03:02:08 <wangzhh> Hi all. 03:02:20 <Sundar49> Hi 03:02:26 <Yumeng> I just added https://wiki.openstack.org/wiki/Cyborg/Policy to the policy page 03:02:57 <Sundar49> Yumeng: nice! 03:03:02 <chenke> good 03:03:30 <wangzhh> Great. 03:03:53 <Sundar49> Good, let's get started 03:04:05 <Sundar49> Agenda: https://wiki.openstack.org/wiki/Meetings/CyborgTeamMeeting#Agenda 03:04:16 <s_shogo> #info s_shogo 03:04:21 <Sundar49> Anything to add? 03:04:58 <Sundar49> #topic Secure_Default_Policies_Popup_Team 03:05:01 <Yumeng> mainly three questions needs to disscuss with you guys. please take a look at the bottom of https://wiki.openstack.org/wiki/Cyborg/Policy 03:05:16 <Sundar49> Yumeng, could you explain to us what's happening in this area? 03:06:54 <Sundar49> What do the terms mean, member vs. reader? 03:08:24 <Sundar49> Yumeng: ^ 03:08:49 <Yumeng> emmm. to be simple. the main problem today is that : 1) admin everywhere 2)insecure custom roles: many policy rules simply use "" as the rule 3)not support read-only 03:10:08 <Sundar49> Our RBAC policies allow for admin and user roles, I think. Are we considering more roles, like member and reader? 03:10:15 <Yumeng> these means sometimes users may have too much or not enough privileges 03:11:34 <Sundar49> Have there been any meetings across the popup team? 03:11:40 <Yumeng> something like that. 1)we need consistent admin over all openstack projects 2) we need to have read-only 03:12:10 <Yumeng> 3) we can have a scoped-RBAC including project-scope and system-scope 03:12:36 <Sundar49> I see. So you could have a project-scope admin? 03:13:37 <Yumeng> yes. project-scope works for most of our current cases. maybe we need consider add system-scope for device related RBAC 03:14:03 <Yumeng> emmm. seems I need to propose a spec to describe this in more details 03:14:11 <Sundar49> Re. the question about cyborg:arq:create, I agree that allowing any user to create an ARQ is too liberal, esp. because the ARQ creator can also program the device. 03:14:29 <Sundar49> Yea, a spec would be welcome 03:15:13 <Yumeng> yes. I have same concerns on cyborg:arq:create 03:15:28 <Sundar49> How do we fix that? 03:16:06 <xinranwang> Hi all, sorry for late 03:16:30 <Yumeng> should we change to admin? 03:17:15 <Yumeng> I was wondering why the initial design was allowing any user? 03:17:25 <Yumeng> Does anyone know that? 03:17:29 <Sundar49> That is too restrictive. We want some auhtorized users to crete, and others should be forbidden. 03:17:46 <Sundar49> I mean: ^ for admin 03:18:53 <Sundar49> Does it make to sense to have granular roles like, device profile reader/writer, ARQ reader/writer etc.? 03:19:32 <Yumeng> sundar49: emmm seems no writer, only reader 03:20:16 <Sundar49> Who can POST device profiles, PATCH arqs, etc.? Apart from admin? 03:21:35 <Sundar49> Yumeng, chenke, xinranwang, wangzhh: ^ 03:22:01 <chenke> I only use admin to create device_profile. 03:22:12 <xinranwang> I think only admin 03:22:36 <Sundar49> admin in project scope? 03:22:58 <chenke> yes. 03:23:02 <wangzhh> emmm Yep. I remembered that we disscussed about it before. And only admin allowed. 03:24:03 <Sundar49> Yumeng: So, the next step is that we need to review this table in the wiki? 03:24:20 <Sundar49> are you included in any meetings they have for this ? 03:26:09 <Sundar49> If anybody has any thoughts, please speak up. 03:27:08 <Sundar49> #topic Devstack components for multi-node 03:27:23 <Sundar49> Shaohe's table: end of https://etherpad.openstack.org/p/cyborg-ptg-ussuri 03:27:59 <Sundar49> Any further comments? 03:28:33 <Sundar49> If not, shall we close this as final? 03:29:09 <chenke> I have one. 03:29:18 <chenke> 9. agent enabled_drivers N Y N 03:29:47 <chenke> agent enabled_drivers? 03:30:36 <Sundar49> chenke, what is the comment? 03:30:38 <chenke> I think cyborg-agent node's conf need this . 03:31:09 <Sundar49> Oh yes, it should be N N Y 03:31:16 <chenke> Ye. 03:31:26 <Sundar49> Please write that in the etherpad 03:31:53 <Sundar49> Thanks, chenke. Anything else? 03:32:21 <Yumeng> Sundar49: not yet. I just talked to zhurong. his idea is that this can be flexible. we can either use admin directly to post ARQ or use any user to make this post request to a system user to help do this post and return results. 03:32:44 <chenke> about 10. api ramdisk_heartbeat_timeout 03:33:07 <chenke> I don't know why we need this 03:33:26 <Yumeng> Sundar49: I will propose a spec today and welcome you guys to disscuss. 03:33:59 <Sundar49> Yumeng: when a user wants to launch a VM with accelerators, he needs the ability to POST and PATCH ARQs, right? Does he have to ask the admin to create the VM? 03:34:20 <Sundar49> Yumeng: ok, we can discuss in the spec 03:35:05 <Sundar49> chenke: I don't see a reason for it either. We can probably drop it. 03:35:25 <chenke> Agree. 03:36:29 <Sundar49> Ok, moving on 03:36:53 <Sundar49> For functional testing, we don't have Li today 03:37:14 <Sundar49> #topic Programming 03:37:34 <Sundar49> API proposal: https://etherpad.openstack.org/p/cyborg-ussuri-programming-apis 03:37:57 <Sundar49> Has anybody reviewed this yet? 03:39:18 <Sundar49> s_shogo, would you like to bring up or discuss your patch? 03:39:53 <s_shogo> Yap,My patch relates the bottom of the proposal, > " Update FPGA user logic (bitstream)" 03:41:16 <Sundar49> My first comment is, it probably needs more validation :) Validation of inputs, Needs some checks: is the bitstream id valid, is the bitstream already programmed, is the deployable in use, etc. 03:41:23 <Sundar49> Also, UT 03:41:43 <s_shogo> There is no specific topic, so 03:42:14 <s_shogo> Thank you Sundar49 , I improve that. 03:42:21 <Sundar49> Thanks 03:43:49 <Sundar49> Before we move onto other things, have you all had a chance to look at the comments in https://review.opendev.org/#/c/692707/6/nova/objects/external_event.py@36 https://review.opendev.org/#/c/631244/51/nova/conductor/manager.py@1578 03:44:16 <Sundar49> This will have impact on Cyborg side too 03:45:01 <chenke> Ok. Will look at it after meeting. 03:45:25 <Sundar49> ok 03:45:36 <Sundar49> #topic Storyboard, specs, patches 03:46:19 <Sundar49> I know there is a long list of specs and patches for me to look at :). Does anybody want to raise anything specific to expedite? 03:47:45 <Sundar49> Very quiet meeting today :) 03:48:11 <Sundar49> Ok, I''m going to keep chugging on Nova side. Please ping me if you have comments/questions/concerns 03:48:40 <Sundar49> Have a good day, everybody! 03:48:50 <Yumeng> bye. see you 03:48:52 <Sundar49> #endmeeting