| opendevreview | Merged openstack/glance master: Drop tag assertion from README https://review.opendev.org/c/openstack/glance/+/834334 | 08:53 |
|---|---|---|
| pranali | gmann, removing deprecated ``enforce_secure_rbac`` option after switching to new defaults, https://review.opendev.org/c/openstack/glance/+/873372 is causing failure for other existing tempest jobs | 14:15 |
| pranali | as the rbac conf options are not enabled in those | 14:15 |
| pranali | https://storage.gra.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_e28/873372/5/check/tempest-integrated-storage-import/e2801d5/testr_results.html | 14:16 |
| pranali | and of course passing for the new job added in the parent patch | 14:16 |
| pranali | so should skip adding the new job in the parent patch 872522 and enable the conf options for all tempest jobs ? or | 14:17 |
| pranali | we should keep the parent patch as it is and remove the enforce_secure_rbac option in next cycle ? | 14:17 |
| pranali | *should we | 14:19 |
| pranali | dansmith ^ | 14:19 |
| abhishekk | IMO adding new job just for few moments does not makes sense to me, I think either remove the config option in next cycle or just migrate existing jobs to use new defaults instead of adding new job | 14:37 |
| dansmith | yeah we need to keep the config for at least a couple cycles after switching the default to new, IMHO | 14:41 |
| dansmith | switching the default it when most people will even realize this is a thing, and won't have noticed before | 14:41 |
| dansmith | they will have to rejigger their roles and users to make that work across all their services.. so just yanking out the rug is not likely to be very popular | 14:42 |
| abhishekk | ++ | 14:43 |
| pranali | yeah that's right.. | 14:46 |
| pranali | so could please give your vote to https://review.opendev.org/c/openstack/glance/+/872522 so that we can have it in m3 :) | 14:47 |
| croelandt | pranali: Shouldn't we abandon https://review.opendev.org/c/openstack/python-glanceclient/+/773532 ? | 14:52 |
| abhishekk | pranali, also I think without changing default value of the config option I think you should add those values in the job it self | 14:56 |
| abhishekk | because now as you have enforced the values in the code our functional and unit tests will enforce rbac policies and CI jobs (except new one) will be legacy policy enforcement | 14:56 |
| abhishekk | but this is my opinion though | 15:01 |
| abhishekk | croelandt, yes | 15:03 |
| abhishekk | that needs to be abandoned | 15:03 |
| croelandt | I'll do that and look at the patch for which you pinged me on Slack :) | 15:03 |
| abhishekk | thanks :D | 15:03 |
| pranali | abhishekk, yeah that makes sense but let's see what gmann says on this because for nova those values are enforced | 15:17 |
| abhishekk | ack | 15:17 |
| gmann | dansmith: but this is about glance extra config enforce_secure_rbac not the oslo one. that was deprecated in wallaby and duplicate of olso config options which we are enabling by default | 15:19 |
| gmann | pranali: existing jobs running on old defaults should not be impacted, let me check the failure | 15:19 |
| abhishekk | gmann, earlier glance use to have authentication layer where we used to have additional checks other than old policies | 15:23 |
| abhishekk | since we have removed that and old policy was open to all that single test related to image sharing is affecting the old jobs | 15:24 |
| gmann | abhishekk: this one ? https://review.opendev.org/c/openstack/glance/+/873372/5/glance/api/v2/image_members.py#b76 | 15:24 |
| abhishekk | yeah | 15:24 |
| abhishekk | line #92 to be specific | 15:25 |
| gmann | abhishekk: pranali: replied it should pass test now. https://review.opendev.org/c/openstack/glance/+/873372/5/glance/api/v2/image_members.py#b99 | 15:29 |
| gmann | basically we are keeping the old policy but they are disabled by default. but they can be enabled by operator so we should have that old check but with oslo conjfig option checks | 15:30 |
| abhishekk | gmann, ack | 15:30 |
| gmann | dansmith: do you think replacing the glance specific config with oslo config create the upgrade impact. glance specific config option is duplicate of oslo one and was marked deprecated-for-removal since wallaby https://review.opendev.org/c/openstack/glance/+/873372/5/glance/api/v2/image_members.py#b99 | 15:31 |
| gmann | pranali: sorry I did not look into that specific glance code in my early review | 15:34 |
| gmann | dansmith: if we do that in any cycle, it will be same impact. I am thinking to clearly mentioning that this glance specific deprecated config option is removed now and use olso one for the same purpose | 15:37 |
| gmann | which pranali already added https://review.opendev.org/c/openstack/glance/+/873372/5/releasenotes/notes/remove-enforce-secure-rbac-ec9a0249870460c2.yaml | 15:38 |
| dansmith | sorry in a call | 15:38 |
| gmann | k. not urgent | 15:42 |
| gmann | for now | 15:42 |
| dansmith | gmann: ah, no, no need to keep the glance specific one I think, I just thought this was talking about both because of the need for the jobs | 15:51 |
| pranali | gmann, ack, Thanks I will update the patch accordingly | 15:54 |
| gmann | k | 15:57 |
| opendevreview | Pranali Deore proposed openstack/glance master: Enabled new defaults and scope checks by default https://review.opendev.org/c/openstack/glance/+/872522 | 18:10 |
| opendevreview | Pranali Deore proposed openstack/glance master: Remove deprecated ``enforce_secure_rbac`` option https://review.opendev.org/c/openstack/glance/+/873372 | 18:10 |
| abhishekk | dansmith, if you are around, do you think this needs to be removed? | 18:24 |
| abhishekk | https://review.opendev.org/c/openstack/glance/+/873372/5/glance/tests/functional/v2/test_images_api_policy.py#b220 | 18:24 |
| abhishekk | no hurry, please add comment on the patch | 18:26 |
| dansmith | abhishekk: replied, but it seems like. the test is still valid.. the error message just might be different now | 18:35 |
| abhishekk | dansmith, ack, thank you! | 18:35 |
| opendevreview | Merged openstack/glance master: Further robustification of format_inspector https://review.opendev.org/c/openstack/glance/+/864129 | 23:34 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!