18:02:21 <gmann> #startmeeting policy_popup
18:02:22 <openstack> Meeting started Thu Dec 10 18:02:21 2020 UTC and is due to finish in 60 minutes.  The chair is gmann. Information about MeetBot at http://wiki.debian.org/MeetBot.
18:02:23 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
18:02:25 <openstack> The meeting name has been set to 'policy_popup'
18:02:32 <lbragstad> o/
18:03:25 <gmann> lbragstad: hi
18:03:31 <gmann> let's wait for couple of min
18:04:33 <lbragstad> sounds good
18:06:22 <gmann> lbragstad: seems like two of us, anyways let's start.
18:06:36 <gmann> today agenda #link https://etherpad.opendev.org/p/default-policy-meeting-agenda
18:06:55 <gmann> #topic General doubts about Default policy
18:07:18 <gmann> #link https://bugs.launchpad.net/oslo.policy/+bug/1886857
18:07:19 <openstack> Launchpad bug 1886857 in oslo.policy "Improve documentation of what data is used in checks" [High,In progress] - Assigned to Raildo Mascena de Sousa Filho (raildo)
18:07:47 <gmann> this is pending on raildo side to fix the review comments in #link  https://review.opendev.org/c/openstack/oslo.policy/+/743318
18:08:03 <gmann> Migrate Default Policy Format from JSON to YAML
18:09:01 <gmann> this is ongoing work for this goal #link https://review.opendev.org/q/topic:%22policy-json-to-yaml%22+(status:open%20OR%20status:merged)
18:09:20 <gmann> I am waiting for oslo.upgradechecks update and then release to use it on service side
18:09:30 <lbragstad> nice
18:09:38 <gmann> basically this one- #link https://review.opendev.org/c/openstack/oslo.upgradecheck/+/765631
18:09:47 <gmann> lbragstad: if you can have a look
18:10:18 <lbragstad> sure
18:10:41 <gmann> thanks
18:11:00 <gmann> Need to verify where glance stands as per communit goal (abhishekk)
18:11:07 <lbragstad> gmann which community goal?
18:11:17 <lbragstad> migrating the policy format?
18:11:23 <gmann> this is not clear to me, abhishekk added this item nit sure if he is online now
18:11:48 <lbragstad> he was online a couple of hours ago - but i do know he's about 15 hours ahead of us?
18:11:50 <gmann> not sure if it is policy format or new RBAC one
18:12:17 <gmann> 11.30 ahead, in India time
18:12:29 <lbragstad> ok - so i lied about 15
18:12:36 <lbragstad> definitely not 15 hours :)
18:12:41 <gmann> :)
18:12:53 <gmann> I will try to catch him on glance channel
18:12:58 <lbragstad> ok
18:13:11 <gmann> #topic Review Requests
18:13:28 <gmann> I added your patches in this #link https://review.opendev.org/q/topic:%22secure-rbac%22+(status:open%20OR%20status:merged)
18:13:34 <lbragstad> oh - nice
18:13:35 <lbragstad> thanks
18:13:45 <gmann> i think we can update the topic name also in wiki, it was different
18:13:56 <lbragstad> sorry about that
18:14:33 <gmann> done
18:14:35 <gmann> #link https://wiki.openstack.org/wiki/Consistent_and_Secure_Default_Policies_Popup_Team#Communication
18:14:57 <gmann> lbragstad: your topic name is more closed to work :)
18:15:15 <gmann> any luck on projects side start reviewing or adding tests etc
18:15:24 <lbragstad> getting there
18:15:32 <lbragstad> i know a few projects have looked at the patches i've proposed
18:15:38 <lbragstad> s/i've/we've/
18:15:56 <lbragstad> but - the patches really just group resources and APIs into buckets
18:16:11 <lbragstad> i think most projects have at least something in review
18:16:36 <lbragstad> i'm starting to work back through each project and pick out a few patches to implement testing
18:16:55 <lbragstad> my goal is to have two or three resources/APIs for each series testing the new defaults
18:17:10 <gmann> great, i think this is nice start. I saw your email also but I did not reply yet as I was busy in back to back meeting (usual Thursday :))
18:17:13 <lbragstad> which will include the testing infrastructure/plumbing and the actual test cases
18:17:22 <lbragstad> ++
18:17:34 <lbragstad> so - this week and next week i'm focusing on placement and cinder
18:17:37 <gmann> I will also help in that once I get policy format work done which I am targeting before new year
18:17:42 <gmann> +1
18:17:55 <lbragstad> awesome - yeah, i'll take as much help as possible
18:18:09 <lbragstad> i'm picking placement because it should be a relatively easy one to do
18:18:21 <lbragstad> and cinder because it's probably the next largest API to work on
18:18:36 <gmann> yeah
18:18:55 <lbragstad> timing wize
18:18:57 <lbragstad> wise*
18:19:10 <lbragstad> i've been working on the audits since the PTG (so about a month)?
18:19:26 <lbragstad> and i expect testing implementation to take much longer than that
18:20:28 <gmann> yeah, as per my experience in nova, 70% of the time was in righting the tests as we did not have good coverage for policy testig
18:20:34 <lbragstad> but, once the tests are up, we should be good for people to consider reviewing the patches and merging them
18:20:39 <lbragstad> right - exactly
18:20:41 <gmann> true
18:20:44 <lbragstad> that was my experience in keystone, too
18:20:54 <gmann> it will give them more confidence on the changes
18:21:11 <gmann> Also on tempest testing support side I am still not able to debug why nova os-hypervisor test did not work with new scope token #link  https://review.opendev.org/c/openstack/devstack/+/616415
18:21:37 <gmann> I will try to dig into this next week or so
18:21:56 <lbragstad> ok
18:22:47 <gmann> anything else on review side ?
18:23:31 <lbragstad> i don't have anything
18:24:02 <gmann> #topic Open Floor
18:24:10 <gmann> nothing in open discussion too.
18:24:18 <lbragstad> sfinucan brought up a good question here https://review.opendev.org/c/openstack/placement/+/760235/2/placement/policies/base.py
18:24:39 <lbragstad> i've been proposing the common personas as constants on some policy file
18:24:42 <lbragstad> in each project
18:24:57 <lbragstad> and he asked why they aren't registered rule defaults
18:25:36 <gmann> ah good point.
18:25:44 <lbragstad> i thought i'd ask here
18:25:54 <lbragstad> i think i'm indifferent
18:25:54 <raildo> hey, sorry to be late
18:26:03 <gmann> that will give us easy to remove 'system:all' thing when enforce_scope is true by default
18:26:10 <lbragstad> +1
18:26:15 <lbragstad> that's a good point
18:26:34 <lbragstad> i also thought it would be nice to have them documented in the default policy documentation
18:26:36 <gmann> raildo: no worries.
18:27:18 <gmann> lbragstad: +1, I thought of moving these common rules and stanza in oslo policy side and then from there projects can use it consistently ?
18:27:32 <lbragstad> that's what i started thinking of next
18:27:38 <lbragstad> we'd need to a new version of oslo.policy
18:27:48 <lbragstad> and i'm wondering if that's a good idea or not
18:27:49 <gmann> raildo: we mainly discussed on these https://review.opendev.org/q/topic:%22secure-rbac%22+(status:open%20OR%20status:merged)
18:28:08 <lbragstad> oslo.policy is pretty generic - and this would be a openstack-specific personas
18:28:16 <gmann> lbragstad: good point. but with policy format work everyone needs to move to 3.6.0 latest version
18:28:57 <gmann> lbragstad: how about with openstack_common_personas.py
18:29:18 <lbragstad> yeah
18:29:28 <lbragstad> i mean - policy.py includes keystone scopes
18:29:31 * lbragstad shrugs
18:29:55 <lbragstad> i guess i can see it both ways
18:30:02 <raildo> gmann, lbragstad yeah, I started to reviewing lance's patches, seems to be my christmas gift haha
18:30:15 <raildo> lbragstad, thank you for all this hard work dude!
18:30:21 <gmann> +1.
18:30:27 <lbragstad> s/christmas gift/lump of coal/
18:30:28 <lbragstad> ?
18:30:57 <raildo> lol
18:31:09 <gmann> lbragstad: i can push the common personas thing in olso.policy if fine. after my lunch
18:31:19 <lbragstad> gmann sure - that sounds good
18:31:25 <lbragstad> to recap
18:31:28 <gmann> we should give more gifts to raildo :)
18:31:58 * raildo has enough gifts for now
18:32:11 <lbragstad> the main benefits would be 1.) it's a common place for common persona definitions 2.) they're included in default policy documentation rendered in each project
18:33:13 <gmann> yeah
18:33:39 <lbragstad> the only downside i can think of is that it's a another layer of indirection to figure out what rule:system_admin means
18:35:35 <gmann> I think name itself if self explainer but we can add good documentation for that so that generated policy sample etc have it clear
18:35:51 <raildo> lbragstad, well, I believe that if we properly document this common persona on oslo.policy and point for the team's docs for it would be enough
18:37:39 <lbragstad> yeah - i think that's fair
18:37:49 <lbragstad> having a common definition is a good reason
18:38:16 * lbragstad has to update a lot of patches
18:38:50 <gmann> ah that is true. may be during tests addition time we can update
18:39:11 <lbragstad> right - they have to be updated eventually
18:39:39 <lbragstad> so - we'll have to bump the oslo.policy requirement to 3.6.1 then?
18:39:47 <gmann> yeah
18:40:08 <lbragstad> ok - makes sense
18:40:59 <gmann> I think i forgot to record AI, let's do
18:41:26 <gmann> #action gmann to check with abhishekk on glance point in meeting agenda
18:41:40 <gmann> raildo: to update https://review.opendev.org/#/c/743318/
18:41:48 <gmann> #action raildo to update https://review.opendev.org/#/c/743318/
18:41:53 <raildo> ack, I'll have it asap
18:42:09 <raildo> it updated*
18:42:41 <gmann> #action gmann to push common persona on oslo policy and release 3.6.1 and lbragstad to review that
18:42:56 <gmann> anything else I missed ?
18:42:57 <lbragstad> i need to review https://review.opendev.org/c/openstack/oslo.policy/+/743318 too
18:43:09 <gmann> ah right
18:43:35 <gmann> #action All will review and help on https://review.opendev.org/q/topic:%22secure-rbac%22+(status:open%20OR%20status:merged)
18:44:17 <gmann> anything else for today ?
18:44:30 <lbragstad> i plan to have placement done by next week
18:44:48 <lbragstad> rosmatia is going to meet with me early next week to go through the best approach for protection testing in cinder
18:45:02 <gmann> #action lbragstad to finish placement as first
18:45:11 <gmann> great
18:45:19 <lbragstad> next thursday is my last day of the year
18:45:27 <lbragstad> so - i hope to have something in review for cinder by then
18:45:39 <lbragstad> as far as the testing strategy goes
18:45:40 <gmann> ok
18:45:52 <gmann> so should we cancel the next meeting which is on 24th Dec ?
18:46:15 <lbragstad> i probably won't make it on that day
18:46:36 <lbragstad> but i can read scroll back
18:46:57 <gmann> raildo: how ab out you?
18:47:05 <raildo> gmann, I'll not be able to make the 24th dec meeting
18:47:39 <gmann> ok, let's cancel then. I will update on ML too
18:47:49 <gmann> let's close for today
18:47:58 <gmann> thanks lbragstad raildo for joining
18:48:09 <lbragstad> thanks gmann
18:48:14 <raildo> gmann, lbragstad thanks!
18:48:16 <gmann> #endmeeting