| *** mhen_ is now known as mhen | 01:08 | |
| *** mhen_ is now known as mhen | 02:05 | |
| opendevreview | Ghanshyam proposed openstack/oslo.policy master: Drop python 3.8 support https://review.opendev.org/c/openstack/oslo.policy/+/931112 | 02:36 |
|---|---|---|
| opendevreview | OpenStack Proposal Bot proposed openstack/keystone master: Imported Translations from Zanata https://review.opendev.org/c/openstack/keystone/+/930663 | 04:22 |
| opendevreview | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Imported Translations from Zanata https://review.opendev.org/c/openstack/keystonemiddleware/+/931127 | 05:06 |
| opendevreview | Takashi Kajinami proposed openstack/keystonemiddleware master: Replace deprecated constant_time_compare https://review.opendev.org/c/openstack/keystonemiddleware/+/931148 | 09:30 |
| greatgatsby | Good day. Is it possible to issue an auth token with a specific duration? I'd like to create, say, a token that's only valid for 30 minutes. | 12:19 |
| gtema | greatgatsby - no, only whatever is default on a provider level | 12:19 |
| gtema | it is possible to revoke token though | 12:19 |
| greatgatsby | gtema: thanks for the quick answer. So it's possible to change the default? Sorry for the basic questions, just started trying to figure this out. | 12:20 |
| greatgatsby | oh I think I found something, I'll do some more googling, thanks a lot! | 12:21 |
| gtema | https://docs.openstack.org/keystone/latest/configuration/config-options.html#token | 12:22 |
| greatgatsby | ah I see, so this is the same token as clients logging in to horizon, for example. Ok, I'll have to give this more thought. Thanks again, appreciate it. | 12:24 |
| gtema | welcome | 12:25 |
| d34dh0r53 | #startmeeting keystone | 15:00 |
| opendevmeet | Meeting started Wed Oct 2 15:00:43 2024 UTC and is due to finish in 60 minutes. The chair is d34dh0r53. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:00 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:00 |
| opendevmeet | The meeting name has been set to 'keystone' | 15:00 |
| d34dh0r53 | #topic roll call | 15:01 |
| d34dh0r53 | admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek, gmann, zaitcev, reqa, dmendiza[m], mharley, jph, gtema, cardoe | 15:01 |
| d34dh0r53 | o/ | 15:01 |
| gtema | o/ | 15:01 |
| d34dh0r53 | #topic review past meeting work items | 15:03 |
| d34dh0r53 | #link https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-09-25-15.01.html | 15:03 |
| d34dh0r53 | no action items from the last meeting | 15:03 |
| d34dh0r53 | #topic liaison updates | 15:03 |
| d34dh0r53 | Thanks for replying to that email gtema (Artem Goncharov) | 15:04 |
| d34dh0r53 | that one had fallen off of my radar :/ | 15:04 |
| gtema | wlcm | 15:04 |
| d34dh0r53 | that's it from VMT, nothing from release management | 15:04 |
| d34dh0r53 | #topic specification OAuth 2.0 (hiromu) | 15:05 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:bp%252Foauth2-client-credentials-ext | 15:05 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:bp%252Fenhance-oauth2-interoperability | 15:05 |
| d34dh0r53 | External OAuth 2.0 Specification | 15:06 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone-specs/+/861554 (merged) | 15:06 |
| d34dh0r53 | OAuth 2.0 Implementation | 15:06 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:bp%252Fsupport-oauth2-mtls | 15:06 |
| d34dh0r53 | OAuth 2.0 Documentation | 15:06 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone/+/838108 (merged) | 15:06 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystoneauth/+/838104 (merged) | 15:06 |
| d34dh0r53 | I saw hiromu pushed an update to the docs | 15:06 |
| d34dh0r53 | which is awesome | 15:07 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone/+/860928 | 15:08 |
| d34dh0r53 | next up | 15:08 |
| d34dh0r53 | #topic specification Secure RBAC (dmendiza[m]) | 15:08 |
| d34dh0r53 | #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_ | 15:09 |
| d34dh0r53 | 2024.1 Release Timeline | 15:09 |
| d34dh0r53 | Update oslo.policy in keystone to enforce_new_defaults=True | 15:09 |
| d34dh0r53 | Update oslo.policy in keystone to enforce_scope=True | 15:09 |
| TheJulia | ... Hasn't 2024.1 already released.... like *ages* ago? | 15:10 |
| d34dh0r53 | not sure if dmendiza is around | 15:10 |
| d34dh0r53 | yeah, I just noticed that, need to clean up the meeting doc | 15:10 |
| dmendiza[m] | 👋 | 15:10 |
| TheJulia | Yeah, I think some active management of topics is definitely needed | 15:10 |
| d34dh0r53 | ohai dmendiza | 15:10 |
| dmendiza[m] | Hello! | 15:11 |
| * dmendiza[m] catches up | 15:11 | |
| dmendiza[m] | Right, so, I think we've branched 2025.1 now? | 15:11 |
| dmendiza[m] | that is to say, master is now tracking 2025.1 | 15:11 |
| dmendiza[m] | and branched off stable/2024.2 | 15:12 |
| gtema | dmendiza: fyi: in the roll-call there is your xxx[m] nick, maybe because of that you miss the notification | 15:12 |
| dmendiza[m] | I'm on a Matrix client (element) which adds (or added? 🤔) the [m] when bridging to IRC | 15:12 |
| dmendiza[m] | it's there so folks from IRC can ping me. 🤷 | 15:12 |
| gtema | then add both to the roll-call in the agenda | 15:13 |
| dmendiza[m] | that's why you make the big bucks. 😜 | 15:13 |
| d34dh0r53 | I just added it | 15:13 |
| dmendiza[m] | Anyway, yeah, I think that now that we're at the beginning of a new cycle we should make sure we default to enable_new_defaults=True and enforce_scope=True | 15:14 |
| dmendiza[m] | IIRC we had to override the oslo change | 15:14 |
| dmendiza[m] | so no we can remove that override and just consume the defaul True from oslo.policy | 15:14 |
| dmendiza[m] | I'll work on a patch for that. | 15:14 |
| * dmendiza[m] puts his Red Hat on | 15:14 | |
| dmendiza[m] | Looks like domain-manager is moving up in priority at RH. Expect to see me propose changes to domain-manager | 15:15 |
| dmendiza[m] | That's all I've got for now | 15:15 |
| d34dh0r53 | ack, ty dmendiza | 15:16 |
| d34dh0r53 | #topic specification OpenAPI support (gtema) | 15:16 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:%22openapi%22+project:openstack/keystone | 15:16 |
| d34dh0r53 | gtema: changes awaiting review - please please please | 15:16 |
| gtema | yupp - dmendiza left a nit comment on one of the changes (credentials) | 15:17 |
| gtema | I updated that (and needed to rebase), but still - changes are there for review and finally a go | 15:17 |
| d34dh0r53 | ack, any particular order to review thingsf/ | 15:17 |
| d34dh0r53 | *things? | 15:17 |
| gtema | not anymore, mine are independent | 15:18 |
| gtema | ones from Antonia are with some relations (app_creds and next on access rules) | 15:18 |
| gtema | but otherwise - whatever is passing | 15:18 |
| d34dh0r53 | ack | 15:19 |
| d34dh0r53 | thanks gtema (Artem Goncharov) | 15:19 |
| d34dh0r53 | #topic specification domain manager (mhen) | 15:19 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:%22domain-manager%22 | 15:19 |
| d34dh0r53 | tempest core lib patch has been merged, only keystone-tempest-plugin left | 15:19 |
| d34dh0r53 | created a patchset for documentation: https://review.opendev.org/c/openstack/keystone/+/928135 | 15:19 |
| d34dh0r53 | guess mhen_ isn't around | 15:23 |
| d34dh0r53 | or maybe no ping because nick changed | 15:23 |
| gtema | yeah, maybe | 15:24 |
| d34dh0r53 | ok, moving on | 15:25 |
| d34dh0r53 | #topic specification Type annotations (stephenfin) | 15:25 |
| d34dh0r53 | #link https://review.opendev.org/q/project:openstack/keystoneauth+topic:typing | 15:25 |
| d34dh0r53 | This came about from adding type hints to openstacksdk. Since we're based on/heavily use keystoneauth, we need these annotations to be able to type things correctly. After much blood and tears, I now have the thing fully typed (except for tests and fixtures) but have refrained from pushing the full ~50 patch series to avoid overloading CI/humans :) | 15:25 |
| d34dh0r53 | How do we want to review these? They are generally non-functional changes, though I have reworked some logic (to avoid use of try-except pattern that mypy doesn't like) and added lots of asserts to narrow types (which I will eventually convert to proper exceptions). Can I just let gtema review them and rely on CI? | 15:26 |
| d34dh0r53 | You'll see I've used ruff and ruff-format. I realise this might be somewhat controversial, but it removes significant friction (from having to manually rewrap stuff) when adding annotations at minimal inconvenience to others | 15:26 |
| d34dh0r53 | was a patch added for ruff-format? | 15:26 |
| gtema | Steven pushed new series which I have not had a time to review yet | 15:26 |
| stephenfin | ummm, I think so | 15:26 |
| stephenfin | if I did it's merged | 15:27 |
| d34dh0r53 | it's been added to keystoneauth, I was wondering about keystone | 15:27 |
| gtema | that is not there yet as we discussed | 15:27 |
| stephenfin | Ah, no, not for keystone. I think gtema was handling that? | 15:27 |
| d34dh0r53 | I thought it may have been mentioned last week | 15:27 |
| d34dh0r53 | ack | 15:27 |
| gtema | I wanted that we proceed with openapi changes pending long and afterwards I will do that | 15:27 |
| stephenfin | we did discuss last week. cardoe and yourself were onboard (from reading the scrollback) | 15:28 |
| d34dh0r53 | that's right | 15:28 |
| d34dh0r53 | waiting for openapi changes | 15:28 |
| * d34dh0r53 slaps himself with a trout | 15:28 | |
| gtema | what's with passlib changes? | 15:29 |
| stephenfin | but yeah, for keystoneauth all of the "groundwork" patches are merged and mypy is now running in non-strict mode. The patches that are waiting for review constitute roughly half of the total queue. Once everythign is merged, we should be 100% typed (except for tests and fixtures) | 15:29 |
| d34dh0r53 | sweet | 15:29 |
| stephenfin | *half of the total remaining patches (I have not pushed the other half to prevent swamping the CI) | 15:29 |
| stephenfin | s/prevent/avoid/ | 15:29 |
| d34dh0r53 | 👍️ | 15:31 |
| d34dh0r53 | I'll review those this week as I'm able | 15:31 |
| d34dh0r53 | #topic open discussion | 15:31 |
| d34dh0r53 | farewell passlib #link https://review.opendev.org/q/topic:%22passlib%22 | 15:31 |
| TheJulia | Question, where is the meeting agenda kept? | 15:32 |
| d34dh0r53 | Is this ready gtema (Artem Goncharov) ? | 15:32 |
| gtema | yes Dave Wilde (d34dh0r53) ready | 15:32 |
| d34dh0r53 | TheJulia: https://etherpad.opendev.org/p/keystone-weekly-meeting | 15:32 |
| gtema | TheJulia: agenda link is present in the room description | 15:33 |
| TheJulia | And has there been a review of the keystone-coresec group membership? Can that be taken care of in advance of next week's meeting | 15:33 |
| TheJulia | gtema: ahh, didn't even see it there! Thanks! | 15:33 |
| d34dh0r53 | I will take care of that review this week TheJulia, | 15:33 |
| TheJulia | Okay, thanks. | 15:34 |
| gtema | back to passlib: as discussed last friday: it is ready, is a big "kill-switch", no other way exists, is tested to be backwardscompatible | 15:36 |
| d34dh0r53 | Ok, time for the bandaid rip, I propose that we devote some time in the reviewathon on Friday to do that | 15:37 |
| gtema | oki | 15:37 |
| d34dh0r53 | #action reviewathon discuss and hopefully perform the removal of passlib https://review.opendev.org/q/topic:%22passlib%22 | 15:38 |
| d34dh0r53 | cool, moving on, thanks gtema (Artem Goncharov) | 15:38 |
| d34dh0r53 | #topic bug review | 15:38 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0 | 15:38 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/+bug/2083004 | 15:39 |
| d34dh0r53 | Looks like a wishlist item to me, the solution is to set the cache timeout to a reasonable value for your use case | 15:42 |
| d34dh0r53 | next up | 15:42 |
| gtema | he, what? | 15:42 |
| gtema | I mean the above bug | 15:42 |
| d34dh0r53 | ? what about it? | 15:43 |
| gtema | assignments in Keycloak are not immediately visible in Keystone | 15:43 |
| gtema | that is what disturbs me | 15:43 |
| d34dh0r53 | is that not true in your case? | 15:44 |
| gtema | well, this is a big confusion people have about federation: when they do changes in IdP they expect immediately to see changes reflected on SP | 15:45 |
| TheJulia | Further question for some point during open discussion: Is there an PTG etherpad yet? The linked one in the agenda is for Antelope | 15:45 |
| gtema | in the oidc/oauth2 this will never happen unless user re-logs in | 15:45 |
| d34dh0r53 | TheJulia: yes, I'll fix that link | 15:46 |
| gtema | there are few things you can do here, but it will not happen magically | 15:46 |
| d34dh0r53 | TheJulia: https://etherpad.opendev.org/p/oct2024-ptg-keystone | 15:46 |
| gtema | Dave Wilde (d34dh0r53): since we have federation topic for PTG let's postpone this bug till then | 15:47 |
| d34dh0r53 | ack | 15:48 |
| d34dh0r53 | I agree gtema (Artem Goncharov) | 15:48 |
| d34dh0r53 | that's it for keystone | 15:48 |
| TheJulia | Can it wait 2.5 weeks? | 15:48 |
| d34dh0r53 | #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0 | 15:48 |
| d34dh0r53 | TheJulia: we can add a response to that bug but it's essentially working as designed for now | 15:51 |
| TheJulia | d34dh0r53: that would be ideal since there is no guarantee the subscribers can attend the ptg. Thanks again! | 15:52 |
| d34dh0r53 | 👍️ | 15:52 |
| d34dh0r53 | no new bugs for python-keystoneclient | 15:52 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystoneauth/+bugs?orderby=-id&start=0 | 15:52 |
| d34dh0r53 | nor keystoneauth | 15:53 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0 | 15:53 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystonemiddleware/+bug/2081732 | 15:53 |
| d34dh0r53 | work is done, cores please review the patch that has been proposed to keystonemiddleware | 15:54 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystonemiddleware/+/931148 | 15:54 |
| d34dh0r53 | that does it for keystonemiddleware | 15:55 |
| d34dh0r53 | #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0 | 15:55 |
| d34dh0r53 | no new bugs for pycadf | 15:55 |
| d34dh0r53 | #link https://bugs.launchpad.net/ldappool/+bugs?ordterby=-id&start=0 | 15:55 |
| d34dh0r53 | and ldappool also has no new bugs | 15:55 |
| d34dh0r53 | #topic conclusion | 15:55 |
| d34dh0r53 | please add to the PTG agenda | 15:56 |
| d34dh0r53 | #link https://etherpad.opendev.org/p/oct2024-ptg-keystone | 15:56 |
| d34dh0r53 | that's it from me, thanks everyone! | 15:56 |
| gtema | thanks | 15:57 |
| d34dh0r53 | #endmeeting | 15:57 |
| opendevmeet | Meeting ended Wed Oct 2 15:57:20 2024 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:57 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-10-02-15.00.html | 15:57 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-10-02-15.00.txt | 15:57 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-10-02-15.00.log.html | 15:57 |
| opendevreview | Artem Goncharov proposed openstack/keystone master: Enable JsonSchema validation for `project` https://review.opendev.org/c/openstack/keystone/+/923181 | 16:20 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/keystone master: Fix DB migrations after alembic integration https://review.opendev.org/c/openstack/keystone/+/930589 | 16:48 |
| opendevreview | Takashi Kajinami proposed openstack/keystonemiddleware master: Get rid of pkg_resources https://review.opendev.org/c/openstack/keystonemiddleware/+/931211 | 17:15 |
| opendevreview | Ghanshyam proposed openstack/oslo.policy master: Drop python 3.8 support https://review.opendev.org/c/openstack/oslo.policy/+/931112 | 18:16 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!