| *** tosky has quit IRC | 00:00 | |
| *** k_mouza has joined #openstack-glance | 00:02 | |
| *** k_mouza has quit IRC | 00:07 | |
| *** Underknowledge has quit IRC | 01:23 | |
| *** Underknowledge has joined #openstack-glance | 01:24 | |
| *** rcernin has quit IRC | 02:06 | |
| *** zzzeek has quit IRC | 02:23 | |
| *** zzzeek has joined #openstack-glance | 02:24 | |
| *** rcernin has joined #openstack-glance | 02:38 | |
| *** zzzeek has quit IRC | 02:44 | |
| *** zzzeek has joined #openstack-glance | 02:46 | |
| *** zzzeek has quit IRC | 02:51 | |
| *** zzzeek has joined #openstack-glance | 02:53 | |
| *** zzzeek has quit IRC | 03:13 | |
| *** zzzeek has joined #openstack-glance | 03:15 | |
| *** whoami-rajat has joined #openstack-glance | 04:18 | |
| *** udesale has joined #openstack-glance | 04:22 | |
| abhishekk | lbragstad, I think either jokke or rosmaita can help you with this | 04:48 |
|---|---|---|
| lbragstad | i think i already figured it out - but thanks for the follow up :) | 04:49 |
| lbragstad | it looks like resource types can belong to an owner and then get associated to namespaces of a different owner | 04:50 |
| *** ratailor has joined #openstack-glance | 04:50 | |
| abhishekk | lbragstad, that's cool | 05:03 |
| lbragstad | i just discovered that those aren't filtered at all either | 05:05 |
| lbragstad | if alice and bob are two users with role assignments on separate projects | 05:05 |
| lbragstad | alice can see resource types used for namespaces associated to bob's project | 05:06 |
| openstackgerrit | Lance Bragstad proposed openstack/glance master: Implement secure RBAC for metadef APIs https://review.opendev.org/c/openstack/glance/+/764251 | 05:11 |
| openstackgerrit | Lance Bragstad proposed openstack/glance-tempest-plugin master: WIP: Add protection testing for namespace objects https://review.opendev.org/c/openstack/glance-tempest-plugin/+/776789 | 05:12 |
| lbragstad | that's about as far as i got today | 05:14 |
| *** bhagyashri|ruck is now known as bhagyashri|rover | 05:15 | |
| lbragstad | all the tempest plugin tests pass - but they're not done, yet | 05:15 |
| *** gyee has quit IRC | 05:20 | |
| abhishekk | lbragstad, ack, thank you | 05:35 |
| *** ajitha has joined #openstack-glance | 05:35 | |
| *** m75abrams has joined #openstack-glance | 05:43 | |
| *** ralonsoh has joined #openstack-glance | 06:01 | |
| *** yoctozepto0 has joined #openstack-glance | 06:05 | |
| *** yoctozepto has quit IRC | 06:05 | |
| *** yoctozepto0 is now known as yoctozepto | 06:05 | |
| *** lpetrut has joined #openstack-glance | 07:19 | |
| *** rcernin has quit IRC | 07:22 | |
| *** rcernin has joined #openstack-glance | 07:52 | |
| *** tosky has joined #openstack-glance | 08:38 | |
| *** happyhemant has joined #openstack-glance | 08:48 | |
| *** k_mouza has joined #openstack-glance | 09:31 | |
| *** Underknowledge has quit IRC | 09:37 | |
| *** Underknowledge1 has joined #openstack-glance | 09:37 | |
| *** Underknowledge1 is now known as Underknowledge | 09:37 | |
| *** lpetrut_ has joined #openstack-glance | 09:54 | |
| *** yoctozepto9 has joined #openstack-glance | 09:55 | |
| *** lpetrut has quit IRC | 10:03 | |
| *** yoctozepto has quit IRC | 10:03 | |
| *** m75abrams has quit IRC | 10:03 | |
| *** zzzeek has quit IRC | 10:03 | |
| *** irclogbot_0 has quit IRC | 10:03 | |
| *** yoctozepto9 is now known as yoctozepto | 10:03 | |
| *** udesale_ has joined #openstack-glance | 10:03 | |
| *** zzzeek has joined #openstack-glance | 10:05 | |
| *** udesale has quit IRC | 10:05 | |
| *** irclogbot_0 has joined #openstack-glance | 10:07 | |
| *** k_mouza has quit IRC | 10:21 | |
| *** k_mouza has joined #openstack-glance | 10:54 | |
| *** k_mouza has quit IRC | 10:58 | |
| *** k_mouza has joined #openstack-glance | 10:58 | |
| *** ratailor has quit IRC | 12:24 | |
| *** ratailor has joined #openstack-glance | 12:24 | |
| *** ratailor has quit IRC | 12:30 | |
| *** ratailor has joined #openstack-glance | 12:30 | |
| *** ratailor has quit IRC | 12:31 | |
| *** ratailor has joined #openstack-glance | 12:32 | |
| *** ratailor has quit IRC | 12:36 | |
| *** ratailor has joined #openstack-glance | 12:38 | |
| *** ratailor has quit IRC | 12:51 | |
| *** Luzi has joined #openstack-glance | 13:01 | |
| lbragstad | i also noticed that we do leak namespace existence http://paste.openstack.org/show/802999/ | 13:13 |
| lbragstad | which is different from the approach we take with images now that dansmith's patch merged | 13:14 |
| lbragstad | (er - at least isn't possible not that his patch merged) | 13:14 |
| *** lpetrut__ has joined #openstack-glance | 13:14 | |
| *** lpetrut_ has quit IRC | 13:16 | |
| *** tkajinam has quit IRC | 13:36 | |
| *** k_mouza has quit IRC | 13:54 | |
| *** k_mouza has joined #openstack-glance | 13:55 | |
| abhishekk | jokke, rosmaita, dansmith, smcginnis, glance weekly meeting in 5 minutes at #openstack-meeting | 13:56 |
| abhishekk | see you there | 13:56 |
| openstackgerrit | Dan Smith proposed openstack/glance master: Add a test for migration naming and phase rules https://review.opendev.org/c/openstack/glance/+/777413 | 13:56 |
| dansmith | lbragstad: I don't know anything about the metadadef stuff, but that seems to be the same pattern has we had for images yeah | 14:00 |
| *** k_mouza has quit IRC | 14:00 | |
| *** k_mouza has joined #openstack-glance | 14:00 | |
| *** yoctozepto has quit IRC | 14:01 | |
| lbragstad | yeah - i see a lot of the same patterns sprinkled up and down that stack | 14:01 |
| *** yoctozepto has joined #openstack-glance | 14:01 | |
| *** Luzi has quit IRC | 14:28 | |
| *** jv_ has joined #openstack-glance | 14:28 | |
| dansmith | lbragstad: do you have a zuul change to make us run tests with the new rules enabled? | 14:38 |
| *** whoami-rajat has quit IRC | 14:38 | |
| lbragstad | dansmith like this you mean? https://review.opendev.org/c/openstack/glance-tempest-plugin/+/773568/20/.zuul.yaml@30 | 14:39 |
| dansmith | yup | 14:39 |
| lbragstad | the gtp patches depend on the glance series for implementing all this stuff, and i'm primarily relying on the gtp tests to verify all this stuff | 14:41 |
| lbragstad | i can't really unwind what i think the correct behavior is just from the policy unit tests | 14:41 |
| lbragstad | so - i'm taking a pretty blackbox approach | 14:41 |
| *** ratailor has joined #openstack-glance | 14:41 | |
| dansmith | okay, well, I guess my point is, we probably need to have a regular tempest full run against glance with these rules turned on to make sure it continues to run as we expect, right? | 14:42 |
| lbragstad | ideally - yeah... gmann was working on something like that | 14:42 |
| dansmith | okay | 14:43 |
| lbragstad | the glance-functional-protection tests are asserting the new behavior | 14:43 |
| dansmith | if this wasn't experimental I'd be wanting that first, but.. calling it experimental I guess lets us get away with it :) | 14:43 |
| dansmith | lbragstad: right but only that small tempest regex | 14:43 |
| lbragstad | and that invokes these - https://review.opendev.org/c/openstack/glance-tempest-plugin/+/773568/20/glance_tempest_plugin/tests/rbac/v2/test_images.py | 14:44 |
| *** ratailor has quit IRC | 14:44 | |
| *** ratailor has joined #openstack-glance | 14:45 | |
| gmann | dansmith: lbragstad you mean tempest default run on new policy right? | 14:45 |
| dansmith | yes | 14:45 |
| gmann | or keep running on old one | 14:45 |
| gmann | +1, yeah. I am working on trying to move tempest in that direction | 14:45 |
| dansmith | okay | 14:45 |
| lbragstad | i was looking through some of the metadef tempest API tests last night, and they're pretty minimal | 14:46 |
| dansmith | I guess tempest needs to care because it creates roles and users? | 14:46 |
| lbragstad | at least from a protection perspective | 14:47 |
| gmann | lbragstad: but I have not started the glance unit test for new policy as i mentioned early. what is the final direction, i think i missed the discussion if that happened. unit tests or glance tempest plugins tests or both ? | 14:47 |
| dansmith | I was mostly thinking that it would mostly be a "create the roles in devstack like the new way" but maybe not | 14:47 |
| lbragstad | dansmith yeah - cmurphy implemented a bunch of stuff for that | 14:48 |
| gmann | yeah devstack keep role creation and tempest use those for tests creads | 14:49 |
| *** ratailor has quit IRC | 14:49 | |
| gmann | we need few of more things for alt project/system reader/member/admin etc which is I am working on and should be ready by next week or so | 14:50 |
| lbragstad | yeah - so the credentials = ['system_admin', 'project_member'] list we use in the new protection tests rely on the new personas | 14:50 |
| gmann | yeah | 14:50 |
| *** zzzeek has quit IRC | 14:51 | |
| lbragstad | sorry - i'm multitasking meeting, i'll find an example | 14:51 |
| lbragstad | https://review.opendev.org/c/openstack/glance-tempest-plugin/+/773568/20/glance_tempest_plugin/tests/rbac/v2/test_images.py#1358 | 14:52 |
| gmann | yeah | 14:52 |
| gmann | and this one for nova hypervisor API to see how it will looks like https://review.opendev.org/c/openstack/tempest/+/740122/10/tempest/api/compute/admin/test_hypervisor.py#29 | 14:52 |
| *** zzzeek has joined #openstack-glance | 14:53 | |
| lbragstad | yeah - so i think they all relies on dynamic credentials, by default | 14:53 |
| gmann | yes, | 14:53 |
| lbragstad | the roles are created in keystone during the bootstrap process, so devstack handles that | 14:53 |
| lbragstad | and the dynamic cred bits handles the users and role assignments | 14:54 |
| *** jmlowe has quit IRC | 14:54 | |
| gmann | only complexity comes on devstack side is - when we enable enforce_scope for any service then all openstack commands used in devstack for that service (for example like nova flavor create) needs to be move to new policy at same time | 14:55 |
| gmann | but while changing it will see how it goes. in my testing patches i faced these things | 14:56 |
| lbragstad | i imagine we're going to hit a few places where we need to update the tests to use the correct client | 14:56 |
| gmann | yeah, that is one thing. use client based on config enforce_scope | 14:57 |
| *** ratailor has joined #openstack-glance | 14:59 | |
| * abhishekk going for dinner break | 15:00 | |
| lbragstad | i do have some questions about the metadef API if folks are going to be around | 15:02 |
| jokke | gmann: lbragstad: are you saying that we loose client backwards compatibility with the RBAC, and not onl to previous version but within the version depending of the config in deployment? :o | 15:03 |
| gmann | jokke: by default no. enforce_scope if default to false and if anyone enable they get new policy | 15:04 |
| gmann | by default old token keep (must keep :)) working | 15:05 |
| jokke | I mean if I have 2 clouds running wallaby, one with old policies, one with new policies, I need to have different clients to talk to those clouds? | 15:06 |
| lbragstad | clients, no? | 15:06 |
| lbragstad | permissions, yes | 15:07 |
| lbragstad | and that depends on the usecase | 15:07 |
| jokke | lbragstad: this was what caused th stroke: 15:56 < lbragstad> i imagine we're going to hit a few places where we need to update the tests to use the correct client | 15:07 |
| lbragstad | for the most part, project-member behavior isn't going to change a whole lot | 15:07 |
| lbragstad | jokke yeah - so there i meant the tempest client | 15:08 |
| lbragstad | which are backed by credentials in tempest | 15:08 |
| jokke | ah, gotcha | 15:08 |
| lbragstad | so - i was implying we may need to update the clients, and therefor the credentials, for a test to do something | 15:08 |
| jokke | yeap, I intermangling your and gmann's lines together and somehow read that like it needed to happen in devstack, aka reflecting like everyone | 15:10 |
| lbragstad | makes sense | 15:10 |
| jokke | no it really didn't :P | 15:11 |
| jokke | lol | 15:11 |
| lbragstad | well - i can see how you arrived at that conclusion given the context | 15:11 |
| lbragstad | i have some questions about the metadef API, is that an API designed for end users? | 15:11 |
| jokke | yeap | 15:12 |
| jokke | kind of | 15:12 |
| lbragstad | like, should project-members use it? | 15:12 |
| jokke | I think so. Depending of the namespace | 15:12 |
| lbragstad | does depending on the namespace mean depending on if the namespace is public? | 15:12 |
| jokke | like lots of the stuff that gets injected there by default are stuff to make life easier between glance - [nova, conder] | 15:13 |
| jokke | cinder | 15:13 |
| jokke | but the whole idea of the api being available is to make similar correlations available for orchestration to pick right images for the stack, etc. | 15:14 |
| jokke | So you might have metadefs that helps Nova to pick correct host for the image, but you might have metadefs that helps thing X to pick correct image for say LAMP stack heat is spinning up | 15:15 |
| *** jmlowe has joined #openstack-glance | 15:15 | |
| jokke | Honestly, I really don't understand the full extent of it, but IIUC it's more formal way of defining and discovering metadata | 15:17 |
| jokke | and is used quite a bit around | 15:17 |
| lbragstad | ok - interesting... | 15:17 |
| lbragstad | i was playing it with and noticied it's possible to fish private namespace existence out of that API | 15:18 |
| lbragstad | and i'm able to fish resource types associates to private namespaces out of it - even if i don't have role assignment on the project that owns the private namespace | 15:18 |
| lbragstad | and i'm wondering if that's by design? | 15:18 |
| dansmith | being able to test that a namespace exists by name (which I think you showed) seems like a huge deal | 15:19 |
| dansmith | like if we leaked instance names between coke and pepsi, that could have information encoded in the name that would be a problem | 15:20 |
| lbragstad | and the relationship between metadef objects is pretty nested... | 15:22 |
| lbragstad | you can have namespaces -> resource types -> objects -> properties -> tags | 15:22 |
| lbragstad | and i got to namespaces -> resource types in my testing | 15:23 |
| lbragstad | dansmith yeah - that was my reaction, too | 15:24 |
| dansmith | ...yeah :/ | 15:24 |
| lbragstad | my concern is testing the object (and nested object) permutations - because there seems like a lot | 15:24 |
| jokke | lets stop the discussion right here, please open sec bug of it, so we can have a look and decide correct action forward | 15:25 |
| lbragstad | so i wanted to talk about this with the group before i went down a 4k loc binge | 15:25 |
| jokke | better to have sec bug that turns out to be "nothing" than discuss actual vulnerability out in open | 15:26 |
| dansmith | I'm not too overly concerned, TBH given how long this has probably been in place, but doing the paperwork is fine | 15:29 |
| dansmith | we didn't hide the discussion of disclosing image existence a week ago, so.. | 15:30 |
| dansmith | if the name is not scoped per project anyway, does that mean two people in separate tenants can't have a metadef (or whatever) of the same name? | 15:32 |
| jokke | https://specs.openstack.org/openstack/glance-specs/specs/juno/metadata-schema-catalog.html is the spec for it | 15:37 |
| dansmith | ack, will read | 15:37 |
| lbragstad | i'm checking that now | 15:38 |
| lbragstad | but i'm not sure yet - i'm still poking the metadef api | 15:38 |
| *** ratailor has quit IRC | 15:48 | |
| *** lpetrut__ has quit IRC | 15:51 | |
| dansmith | abhishekk: left you a suggestion on the client patch | 15:59 |
| abhishekk | dansmith, ack, looking | 16:00 |
| dansmith | abhishekk: it's really nice to see that import task status :) | 16:00 |
| abhishekk | :D | 16:00 |
| abhishekk | makes sense | 16:00 |
| abhishekk | dansmith, I think in case of verbose also we should avoid showing image_id | 16:05 |
| dansmith | abhishekk: that's fine, but.. why? you're never running this on more than one image at a time are you? | 16:06 |
| dansmith | but verbose is verbose, I'm fine with being VERY verbose there :P | 16:06 |
| abhishekk | :D | 16:07 |
| openstackgerrit | Luigi Toscano proposed openstack/glance_store stable/stein: zuul: glance_store-src-ceph-tempest replaces a legacy job https://review.opendev.org/c/openstack/glance_store/+/777615 | 16:09 |
| openstackgerrit | Merged openstack/glance master: Expand tasks database table to add more columns https://review.opendev.org/c/openstack/glance/+/763739 | 16:10 |
| abhishekk | \o/\o/ finally | 16:10 |
| dansmith | yay | 16:11 |
| dansmith | I think this is the "monitor for rechecks" query: https://review.opendev.org/q/project:openstack/glance+label:Workflow%253D%252B1+status:open | 16:20 |
| *** jdillaman has quit IRC | 16:25 | |
| abhishekk | Cool, thank you dansmith | 16:37 |
| dansmith | at least in nova, it's about 5h to start running jobs at the moment, so we still have a bit before the bottom RBAC patch will even start in check | 16:41 |
| openstackgerrit | Abhishek Kekane proposed openstack/python-glanceclient master: Get tasks assoiciated with image https://review.opendev.org/c/openstack/python-glanceclient/+/776403 | 16:46 |
| abhishekk | ack | 16:47 |
| lbragstad | jokke are resource types supposed to be cleaned up when the namespace is deleted? | 16:47 |
| abhishekk | dansmith, that was quick | 16:48 |
| dansmith | abhishekk: same to you :) | 16:48 |
| abhishekk | :D | 16:48 |
| abhishekk | I am leaving for the day, will keep eye on rechecks over the weekend | 16:49 |
| abhishekk | good night all | 16:49 |
| abhishekk | o/~ | 16:49 |
| dansmith | If I'm not back on monday, this is why: https://www.weather.gov/pqr/ | 16:49 |
| dansmith | abhishekk: o/ | 16:49 |
| abhishekk | :o, stay safe | 16:50 |
| lbragstad | o/ abhishekk | 16:51 |
| abhishekk | o/~ | 16:51 |
| lbragstad | jokke specifically - this | 16:51 |
| lbragstad | http://paste.openstack.org/show/803011/ | 16:51 |
| lbragstad | is there a different way to forcibly clean up resource types? | 16:55 |
| dansmith | lbragstad: the resource type is created separate from the namespace and presumably could be included in multiple ones right? | 16:55 |
| abhishekk | dansmith, may be I need to add more documentation about command line for task-show API | 16:55 |
| abhishekk | will do that on Monday | 16:55 |
| dansmith | so cleaning up RTs when NSs are deleted would be weird? | 16:55 |
| dansmith | abhishekk: okay, as add-on? I can only think of a couple other sentences to add really | 16:56 |
| lbragstad | maybe? | 16:57 |
| lbragstad | https://docs.openstack.org/api-ref/image/v2/metadefs-index.html?expanded=create-property-detail,create-tag-definition-detail,list-resource-types-detail,create-resource-type-association-detail,list-namespaces-detail,remove-resource-type-association-detail#remove-resource-type-association | 16:57 |
| abhishekk | not api-ref | 16:57 |
| lbragstad | i was looking at that and it's nested under the namespace | 16:57 |
| abhishekk | but I need to explain how command works and what --verbose will show with example somewhere | 16:57 |
| lbragstad | but that's for association, so i suppose it could be shared, but then were is the API to delete the resource type? | 16:57 |
| dansmith | abhishekk: yeah I meant for the shell, but okay | 16:57 |
| abhishekk | Let me see what I can do or how I can do it | 16:58 |
| dansmith | lbragstad: the unable-to-delete part definitely seems wrong | 16:58 |
| dansmith | likely a leaked reference or something | 16:58 |
| abhishekk | as it will be a doc change it will be quick to merge | 16:58 |
| lbragstad | based on what i see and was able to recreate - a regular end users can just create these things, but an admin can't clean them up | 16:59 |
| lbragstad | end user* | 16:59 |
| dansmith | niice | 16:59 |
| lbragstad | looks similar to this | 17:02 |
| lbragstad | https://bugs.launchpad.net/glance/+bug/1545702 | 17:02 |
| openstack | Launchpad bug 1545702 in Glance "Images v2 api metadef vulnerability" [Undecided,New] | 17:02 |
| dansmith | heh | 17:04 |
| dansmith | I think the cat may have exited the bag | 17:04 |
| lbragstad | jokke do you know who uses the metadef API? | 17:19 |
| *** udesale_ has quit IRC | 17:25 | |
| *** k_mouza has quit IRC | 18:05 | |
| *** happyhemant has quit IRC | 18:08 | |
| jokke | lbragstad: I think there is just association between resource type and namespace but no hierarchical relation ... but that's just how I understood the spec | 18:16 |
| lbragstad | jokke is there an API somewhere to clean up resource types? | 18:17 |
| jokke | lbragstad: I think I need to test that, but by the quick look it might be that the associate actually creates the resource type and deassociate removes it. Being basically the bridge between the propertices and namespaces | 18:23 |
| openstackgerrit | Dan Smith proposed openstack/glance master: Add a test for migration naming and phase rules https://review.opendev.org/c/openstack/glance/+/777413 | 18:24 |
| jokke | lbragstad: this based on crossing the spec info and client info | 18:24 |
| lbragstad | i read the API docs and i see the associate and disassociate APIs | 18:24 |
| lbragstad | but i don't think disassociate actually deletes the resource types | 18:25 |
| lbragstad | type8 | 18:25 |
| lbragstad | type* | 18:25 |
| dansmith | I've also confirmed the bug linked above | 18:26 |
| dansmith | where namespaces and associations appear to be unbounded, even for normal users | 18:26 |
| jokke | lbragstad: the client deassociate is actually API DELETE call | 18:26 |
| lbragstad | right | 18:27 |
| lbragstad | it deletes the association, it doesn't delete the resource type | 18:27 |
| lbragstad | from what i can tell | 18:27 |
| lbragstad | so i'm wondering if i'm just missing something | 18:28 |
| jokke | ok, like said I'd need to dig into that as I'm not super familiar how the metadefs work | 18:28 |
| jokke | I just know that it's kind of glue between the services to make meadata discovery and usage easier | 18:28 |
| jokke | And we get handful of patches every cycle people updating the default definitions based on changs that happens in Nova for example. So people do care about them working and being correct | 18:29 |
| lbragstad | jokke do you have a link to a patch for one of those, or where i could find that definition update? | 18:31 |
| jokke | https://review.opendev.org/c/openstack/glance/+/740384 | 18:37 |
| dansmith | from a redhat person, so apparently *we* care :) | 18:38 |
| *** ralonsoh has quit IRC | 19:24 | |
| *** zzzeek has quit IRC | 19:29 | |
| *** zzzeek has joined #openstack-glance | 19:29 | |
| *** jdillaman has joined #openstack-glance | 19:47 | |
| *** ajitha has quit IRC | 20:25 | |
| *** lbragstad_ has joined #openstack-glance | 20:35 | |
| *** mugsie_ has joined #openstack-glance | 20:36 | |
| *** benj_- has joined #openstack-glance | 20:36 | |
| *** zigo_ has joined #openstack-glance | 20:36 | |
| *** aarents has quit IRC | 20:36 | |
| *** benj_ has quit IRC | 20:36 | |
| *** zigo has quit IRC | 20:36 | |
| *** stephenfin has quit IRC | 20:36 | |
| *** BLZbubba has quit IRC | 20:36 | |
| *** melwitt has quit IRC | 20:36 | |
| *** gregwork has quit IRC | 20:36 | |
| *** mugsie has quit IRC | 20:36 | |
| *** melwitt has joined #openstack-glance | 20:36 | |
| *** benj_- is now known as benj_ | 20:37 | |
| *** jmccrory_ has joined #openstack-glance | 20:37 | |
| *** tosky_ has joined #openstack-glance | 20:37 | |
| *** jmccrory has quit IRC | 20:37 | |
| *** jmccrory_ is now known as jmccrory | 20:38 | |
| *** felixhuettner[m] has quit IRC | 20:39 | |
| *** zzzeek has quit IRC | 20:40 | |
| *** jrosser has quit IRC | 20:40 | |
| *** tosky has quit IRC | 20:40 | |
| *** trident has quit IRC | 20:40 | |
| *** ricolin has quit IRC | 20:40 | |
| *** jrosser has joined #openstack-glance | 20:40 | |
| *** jokke has quit IRC | 20:40 | |
| *** zzzeek has joined #openstack-glance | 20:41 | |
| *** tosky_ is now known as tosky | 20:42 | |
| *** lifeless_ has joined #openstack-glance | 20:42 | |
| *** fnordahl has quit IRC | 20:42 | |
| *** trident has joined #openstack-glance | 20:42 | |
| *** dasp has quit IRC | 20:43 | |
| *** lifeless has quit IRC | 20:43 | |
| *** lbragstad has quit IRC | 20:43 | |
| *** dasp has joined #openstack-glance | 20:45 | |
| openstackgerrit | Merged openstack/glance master: Properly handle InvalidScope exceptions https://review.opendev.org/c/openstack/glance/+/774309 | 20:48 |
| dansmith | rosmaita: smcginnis: I just had to fix a pep8 fail on the latest version of this, which was +W before, if someone could re-ack it for me: https://review.opendev.org/c/openstack/glance/+/777413 | 21:04 |
| rosmaita | dansmith: in a meeting, will look quickly | 21:07 |
| rosmaita | i mean later | 21:07 |
| dansmith | rosmaita: ack thanks | 21:10 |
| *** rcernin has quit IRC | 21:12 | |
| openstackgerrit | Lance Bragstad proposed openstack/glance-tempest-plugin master: WIP: Add protection testing for namespace objects https://review.opendev.org/c/openstack/glance-tempest-plugin/+/776789 | 21:12 |
| *** felixhuettner[m] has joined #openstack-glance | 21:17 | |
| *** k_mouza has joined #openstack-glance | 21:25 | |
| *** k_mouza has quit IRC | 21:31 | |
| dansmith | rosmaita: thankyasir | 21:38 |
| rosmaita | np | 21:38 |
| *** rcernin has joined #openstack-glance | 22:09 | |
| *** rcernin has quit IRC | 22:15 | |
| *** rcernin has joined #openstack-glance | 22:15 | |
| openstackgerrit | Lance Bragstad proposed openstack/glance master: Update default policies for task API https://review.opendev.org/c/openstack/glance/+/763208 | 22:26 |
| lbragstad_ | dansmith abhishekk quick stab at updating the task API to explicitly call out it's admin only for the time-being | 22:26 |
| *** lbragstad_ is now known as lbragstad | 22:26 | |
| lbragstad | i don't see a tempest client for the tasks API - so we might need to add one of those if we want to test this in the protection job | 22:27 |
| lbragstad | also - i noticed the tasks_api_access pretty much protects that API | 22:28 |
| lbragstad | the rest of the policies are there, but they don't do much by default because they default to open | 22:29 |
| lbragstad | so - in the worst case, an operator could configure it to be different from the tasks_api_access policy and notice weird behavior | 22:29 |
| lbragstad | and the modify_task policy isn't reachable i don't think | 22:30 |
| lbragstad | anywho - i put all that in the review | 22:30 |
| dansmith | ack yeah, will have to look at that next week | 22:31 |
| lbragstad | ++ | 22:32 |
| *** tkajinam has joined #openstack-glance | 22:58 | |
| dansmith | all the pending stuff is in the gate and not failing at the moment | 23:23 |
| * dansmith holds breath | 23:23 | |
| *** k_mouza has joined #openstack-glance | 23:33 | |
| *** k_mouza has quit IRC | 23:34 | |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!