Thursday, 2015-12-10

*** markvoelker has quit IRC00:05
*** markvoelker has joined #openstack-meeting-cp01:05
*** markvoelker has quit IRC01:11
*** nikhil_k has joined #openstack-meeting-cp01:54
*** johnthetubaguy has quit IRC01:54
*** nikhil has quit IRC01:56
*** johnthetubaguy has joined #openstack-meeting-cp01:57
*** markvoelker has joined #openstack-meeting-cp03:07
*** markvoelker has quit IRC03:12
*** markvoelker has joined #openstack-meeting-cp05:07
*** markvoelker has quit IRC05:12
*** [1]evgenyf has joined #openstack-meeting-cp06:59
*** markvoelker has joined #openstack-meeting-cp07:08
*** markvoelker has quit IRC07:13
*** dims_ has joined #openstack-meeting-cp07:26
*** markvoelker has joined #openstack-meeting-cp09:09
*** markvoelker has quit IRC09:14
*** markvoelker has joined #openstack-meeting-cp10:25
*** markvoelker has quit IRC10:29
*** [1]evgenyf has quit IRC10:49
*** dims_ has quit IRC11:04
*** markvoelker has joined #openstack-meeting-cp12:26
*** markvoelker has quit IRC12:30
*** [1]evgenyf has joined #openstack-meeting-cp12:40
*** notmyname has quit IRC12:57
*** notmyname has joined #openstack-meeting-cp12:57
*** markvoelker has joined #openstack-meeting-cp13:08
*** dims has joined #openstack-meeting-cp13:43
*** dims has quit IRC13:48
*** dims_ has joined #openstack-meeting-cp13:57
*** nikhil_k is now known as nikhil14:00
*** [1]evgenyf has quit IRC14:25
*** cdent has joined #openstack-meeting-cp14:50
sdaguewho is around for the service catalog meeting?15:02
bknudsonI'll be listening in.15:02
* bknudson lurks15:02
cdento/15:02
sdaguewe seem to be missing annegentle... that will make this a little hard15:03
sdaguebut let me get things rolling15:03
* jroll also lurking15:03
sdague#startmeeting service-catalog-tng15:03
openstackMeeting started Thu Dec 10 15:03:24 2015 UTC and is due to finish in 60 minutes.  The chair is sdague. Information about MeetBot at http://wiki.debian.org/MeetBot.15:03
openstackUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.15:03
*** openstack changes topic to " (Meeting topic: service-catalog-tng)"15:03
openstackThe meeting name has been set to 'service_catalog_tng'15:03
sdague#link Agenda - https://wiki.openstack.org/wiki/Meetings/ServiceCatalogTNG#Service_Catalog_TNG_Meeting15:04
*** breton has joined #openstack-meeting-cp15:04
sdagueok, this is sparse and missing anne, so I'll try to provide some summary kickoff15:04
sdague#topic overview15:04
*** openstack changes topic to "overview (Meeting topic: service-catalog-tng)"15:04
sdague#link https://wiki.openstack.org/wiki/ServiceCatalogTNG15:04
sdaguethere is a service catalog main wiki page with what we are trying to do, which is mostly make the service catalog something that gets more used going forward15:05
sdaguethe cross project spec - https://review.openstack.org/#/c/181393/ has some of the background on weirdnesses we currently have15:05
sdague#topic Realistic Goals for Mitaka15:06
*** openstack changes topic to "Realistic Goals for Mitaka (Meeting topic: service-catalog-tng)"15:06
sdagueanne and I were discussing this the other day, and trying to establish what those goals would be15:06
bknudsonhttps://wiki.openstack.org/wiki/ServiceCatalogTNG#Mitaka_Goals ?15:07
cdent(is it the case that, as usual, swift is special?)15:07
sdagueyes, that's our current best guess of things15:07
sdaguecdent: well, the project_id in swift is semantically meaningful15:08
cdentyeah15:08
sdaguewhich is really not true for other projects15:08
bknudsonhave we identified the projects?15:08
*** agentle has joined #openstack-meeting-cp15:08
bknudsonthat need the project_id removed15:08
agentleo/ sorry I'm late15:08
*** ayoung has joined #openstack-meeting-cp15:09
ayoungMEETING PARTY CRASHER15:09
ayoungSorry15:09
sdaguebknudson: I don't have the complete list, that would be a good thing to capture here. nova, and things that forked out from nova mostly15:09
sdague#action need to capture authoritative list of projects that use project_id15:10
sdaguethat could use a volunteer, if anyone wants to pitch in15:10
ayoungsdague, notmorgan was doing a POC and identified the ones he tripped over15:10
ayoungI think it might be a very short list15:11
sdagueayoung: yes, it's not huge15:11
agentlesdague: I think Thomas Goirand had one, I'll find it15:11
sdagueagentle: great15:11
ayoungit really is only an issue if project_id is in the service catalog itselfm, and not in the URL15:11
sdagueayoung: right, that's what I mean, if project_id is dynamically serviced by the service catalog15:11
ayoungthat we can tell by the SC generated by devstack15:12
ayoungI only ever saw a problem with Nova15:12
ayoungbut I tend to do limited deployments...15:12
sdagueok, so agentle can I sign you up for having the athoritative list by next week?15:13
sdagueor is there someone else that would like to volunteer for that?15:13
sdagueit's probably about 2 hrs worth of work tops15:13
agentlesdague: Yep, by next week thurs.15:14
sdagueagentle: sounds great15:14
sdague#action (annegentle)  capture authoritative list of projects that use project_id in catalog entries15:14
ayounghow definitive tdoes this need to be? Everything in the Big Tent?15:14
agentleayoung: i'll use the list of service catalogs we gathered round the world15:14
agentle#link https://wiki.openstack.org/wiki/API_Working_Group/Current_Design/Service_Catalog15:15
sdagueayoung: as authoritative as we can get it15:15
sdagueok, given that the goals get somewhat duplicated in the next set of topics, lets go through the topics in order15:15
sdague#topic Service Catalog Spec15:15
*** openstack changes topic to "Service Catalog Spec (Meeting topic: service-catalog-tng)"15:15
sdagueagentle: the update was on your plate, what additional things do you need before pushing the next update?15:16
sdagueagentle: ?15:17
agentlesdague: I think we have a response for John er, notmyname, but I might update that vision section for the focus this release15:17
agentlesorry slow typing this morning :)15:17
sdagueagentle: ok, no prob15:17
agentlesdague: I can't get the eavesdrop for the first part, is the focus: project id and?15:18
sdagueagentle: ok, are you able to get things into shape by next meeting?15:18
agentlesdague: ayup15:18
sdague#action (annegentle) update service catalog cross project spec by next meeting15:18
* agentle gets all the actions today15:18
sdaguewell, so far :)15:18
agentleheh15:18
sdague#topic Project Id Optionality in projects15:19
*** openstack changes topic to "Project Id Optionality in projects (Meeting topic: service-catalog-tng)"15:19
sdagueok, so we have the action for anne about building the complete list of services15:19
bknudsonnext step is to get the projects to support no project id15:20
sdaguewe've got a nova functional patch up https://review.openstack.org/#/c/233076/ that's mostly waiting on some refactoring of our in tree testing to get it landable15:20
sdague#action check in on nova patch for next week's meeting15:20
bknudsonthat his a lot of files15:20
sdagueI'm hopeful that is ready to go next week15:20
sdagueit's router changes in 3 files, and microversion bumps15:21
sdaguea microversion bump changes a constant in about 6 places in the tree, it's pretty small change really15:21
bknudsonlooks pretty easy15:22
bknudsondevstack change, too?15:22
sdaguethere is a devstack change to set the catalog as well15:22
agentlesdague: and I wonder what docs will need updating15:22
sdague#link https://review.openstack.org/#/c/233079/15:23
sdaguethat's the devstack change, it works with that nova change15:23
bknudsonthere's a novaclient change, too?15:23
sdaguebknudson: yes, it's already landed15:23
sdagueit was mostly about discovery15:23
ayoungI wonder if this is going to be a problem with Policy enforcement.  If the projectID is dropped from the URL, is it possible that a check will also be dropped?15:23
bknudsonkind of scary, but whatever15:23
sdagueayoung: do you have an example of where such a policy enforcement check is today?15:24
ayoungsdague, I can show you nova's15:24
bknudsonayoung: are you worried the project ID won't be in the context?15:24
sdagueayoung: yeh, link would be great15:24
ayoungso...not sure, but15:24
sdaguethe project_id is still in the context15:24
ayoungthe token has a proj id that is used to generate the url...the url then has a project Id that needs to match that of the resource15:25
ayoungsay...and image or a vm15:25
sdaguethe code in nova litterally only cared about project_id in url for 10 lines of code15:25
sdaguewhere it did a project_id == context.project_id or die15:25
sdagueand the url was fully ignored beyond that15:25
cdentdeath++15:25
ayoungright. that is important, though.  Still need a check like that, but it is not sufficient15:26
agentleinteresting15:26
sdagueayoung: it's not though, because the acl is enforced on the uuid of the server as well15:26
ayoungI need to think this through...I'll come back15:26
sdagueyou can't just find someone else's uuid of server, put it under your project id, and delete it15:26
ayoungsdague, meaning context.project_iod == server.proejct_id or die?15:27
sdagueso, I'd recommend looking at the nova patch directly if there are concerns there15:27
sdaguebecause I'm pretty sure things are fully covered15:27
sdagueok, lets move on to next topic15:28
ayoungI suspect it is fine, but we should be testing15:28
cdentpresumably there is test coverage for this sort of thing already?15:28
sdaguecdent: there is, we had to change a tempest test though because it was no longer possible to ask for servers by wrong project id when project_id is not in the url15:29
cdent15:29
sdaguewe could determine if there is another test that's appropriate here15:29
sdaguecdent: anything you might want to look at? :)15:30
sdaguegiven you are diving into nova now15:30
ayoungsdague, the token.project_id should be different from the one requested.  Suspect that is already tested15:30
sdagueayoung: yes, already tested15:30
cdentI'm hesitant to make any commitments just yet because I don't know the lay of the land, but this is definitely an area where I'm very interested15:30
cdentSo I'm trying to get myself oriented so I can safely say "yupppers, I'm on that"15:31
sdagueok, no prob15:31
sdague#action nova functional test to ensure we don't loose any safety in removing project_id from url15:32
sdaguewe'll see who ends up with that15:32
sdagueok, really next topic15:32
sdague#topic What URLs are needed15:32
*** openstack changes topic to "What URLs are needed (Meeting topic: service-catalog-tng)"15:32
sdaguethis is part of coming up with a draft schema for the service catalog15:32
cdentI found the mailing list thread on this topic challenging to parse.15:32
sdaguetoday, we have 3 things: publicURL, adminURL, internalURL15:32
notmorgansdague: and unfortunately it's different dependint on the catalog version15:33
ayoungdo we have defintions of what is meant by those?15:33
sdague#link http://lists.openstack.org/pipermail/openstack-operators/2015-December/009061.html15:33
bknudsonI think adminURL was only there for for keystone since we have admin and public APIs15:33
notmorganso really we have 6 iirc. :(15:33
bknudson(in v2)15:33
sdaguethere is an openstack operators thread on this15:33
sdaguenotmorgan: ok, sure, well really we have N15:33
sdaguebecause that's all convention, and not enforced anywhere15:34
ayoungOK.  I know what they are supposed to mean in Keystone.15:34
sdagueand as such gets used wildly inconsistently15:34
bknudsonI think operators like internalURL and publicURL for services. I want my internal users to use internalURL and outside users only have publicURL15:34
sdagueas can been seen by some of the responses there15:34
ayoungTHey are not such horrible ideas, but we should probably taylor the SC to return the right ones15:34
bknudsonmaybe there's a better way to do internal/public access15:35
sdaguebknudson: honestly, it sounded like from that thread a lot of operators don't like the current split15:35
ayoungbknudson, different hostnames is really the best option.15:35
sdaguebluebox uses hosts overrides15:35
ayoungTHat way you can have different interfaces on the same machine handle them15:35
ayoungits a firewall issue15:35
sdagueto always get internal users to the right address15:35
sdaguefor instance15:35
sdagueI would recommend everyone read and comment on the operator thread15:36
ayoungdifferent ports was always sketchy, but that was an impl detail we could work around15:36
bknudsony, putting the knowledge in the network makes sense15:36
bknudsonsince otherwise apps have to provide config options or know where they're running somehow15:36
sdague#action (sdague) revisit operator thread try to reexpress current common themes15:36
ayoungSo, here is what they are supposed to mean, and this is not Keystone specific:15:37
sdagueI think the one thing that did arrise that was new was the desire that services have dedicated urls for them to talk to each other15:37
david-lyleso I can say the HP Public Cloud (RIP) used adminURL for nova at least15:37
ayoungPublic is what users outside the firewall get for normal useage15:37
ayoungadmin is the same, but an higher level of control and security15:37
agentleyes david-lyle same for Rackspace also15:37
david-lylecertain extensions were only enabled when going through adminURL rather than public15:37
ayoungsome deployments want to put that inside dfirewall15:37
ayounginternal is service to service15:37
bknudsonif HPE and RAX both find this useful/necessary then seems like we'd keep it?15:38
ayoungWe don't Need them per-se, as there are other ways to do the same thing, but this was not a horrible approach15:38
sdaguedavid-lyle: for keystone only, right?15:38
david-lyleno for nova15:38
ayoungHowever...we could also deduce which one to return based on the caller15:38
sdaguedavid-lyle: hmmm... it doesn't appear in the catalog that was captured15:39
sdaguehttps://wiki.openstack.org/wiki/API_Working_Group/Current_Design/Service_Catalog#HP15:39
ayoungIE, the nova service user gets the right Keystone URL, and the right Glance url, both internal15:39
agentlesdague: that catalog is the public one not the "I'm a cloud admin" one15:39
sdagueah, ok, so you only get an adminURL if you are an admin?15:39
agentlesdague: I'm not an admin on any cloud to test that theory :)15:39
david-lylethat catalog is not from sufficiently empowered I think15:40
ayoungsdague, so, I'm not certain about that.  It is more likely that is supposed to be location aware15:40
david-lylethat's the end user view15:40
ayoungif you are inside the firewall, and a regular user, I don't know which you would get15:40
sdagueso, maybe we really should step back and describe the personas here15:40
sdagueperhaps that's the next step15:41
notmorgansdague: ++15:41
cdentthat's a good idea15:41
ayoungThe idea is that you want to do more than just Token securet (heh) if you are, say, adding a user.  You only want that done from inside the firewall.  Good concept, don't think the SC is the right way to enforce it15:41
ayoungm,ayeb add user is a bad example, tho9ugh15:41
ayoungmore like adding a service or endpoint15:41
cdentI get the sense that there are some conflicts between the technical goals and the user stories...15:41
sdagueok, anyone interested in starting to hack out the personas? That seems like an etherpad activity.15:41
sdaguecdent: yeh15:42
bknudsonayoung: I think david-lyle says it's not inside/outside firewall at all, but the user's auth.15:42
ayoungbknudson, I said that15:42
ayoungbknudson, it is a case of userauth +  more security15:42
ayoungat least, that was the concept15:42
ayoungwe could do it with just user auth, but that is not sufficient for some people15:42
ayoungthey want to reduce their attack surface15:42
ayoungask gyee, this is his kind of thing 2FA and all that15:43
sdagueyeh, the "more security" seems weird though. If you don't trust keystone to enforce security correctly on 1 url, I'm not sure why 2 makes it better :)15:43
ayoungsdague, cuz tokens suck15:43
ayoungyou want to make it if an admin user loses a token in the wild, the server can't even be reached and it is not attackable for the sensitive operations15:43
sdague#info we need a personas document to really determine what data / urls will be needed in a new catalog15:44
bknudsonI think we'll need more operator feedback into personas15:44
ayoungthis is just the rationalization I have been able to piece together over the years.  I was not there for the initial discussion15:44
notmorganayoung: i also don't think most operators actually do that.15:44
notmorganayoung: HP is one of the few.15:44
ayoungnotmorgan, Heh, neither do I15:44
notmorganayoung: i also think it's a false set of security.15:45
sdagueok, I'm going to move us to open discussion15:45
sdague#topic Open Discussion15:45
*** openstack changes topic to "Open Discussion (Meeting topic: service-catalog-tng)"15:45
sdagueso, a few things quick15:45
ayoungnotmorgan, I'm guessing you would argue "if you need to be inside the firewall, use a CLI with direct access to the machine" is the right approach?15:45
sdague1) volutneers wanted / needed if we are going to make real progress here15:45
*** yarkot has joined #openstack-meeting-cp15:45
notmorganayoung: that is my general view - if it's something that really is *that* sensitive, you probably shouldn't be exposing it via a REST API and it should be CMS15:46
sdaguethe idea is this meeting becomes more of a status check in. less discussion. disucssion should go to the lists.15:46
ayoungsdague, got iot15:46
ayoungit15:46
agentlestand up :)15:47
cdentsdague: keep after me to be an active part of this15:47
agentlethanks cdent15:47
bknudsonI posted a related change to devstack, removing /v2.0 from the identity entry in the catalog: https://review.openstack.org/#/c/255294/15:47
sdaguerelated, notmorgan and I have been working towards having nova know how to talk to glance via service catalog entries15:47
ayoungnotmorgan, I think that makes sense.15:47
sdagueas it's the last service nova talks to with hardcoded values only15:47
ayoungsdague, the MOC guys are working on that too.15:48
sdaguelink https://review.openstack.org/#/q/status:open+project:openstack/nova+branch:master+topic:glance_image_config,n,z15:48
notmorgansdague: actually... i think neutron needs work.15:48
bknudsonwhich version of the service catalog are you using?15:48
bknudsonalso, which endpoint?15:48
ayoungI'll ask them to comment and contriubte15:48
sdagueayoung: MOC?15:48
ayoungMass Open Cloud.  Resourece Federation15:49
sdaguenotmorgan: ok, cool, I thought we had base infrastructure for that15:49
sdagueayoung: ah great15:49
ayoungsay glance and Nova are owned by two different orgs15:49
notmorgansdague: ran into this with my POC15:49
sdagueok, any other related work from people to highlight that we should keep an eye on things?15:49
ayoungsdague, add gsilvis to any reviews you have along those lines15:49
sdagueayoung: ok, will do15:49
sdagueok, anything else, or time to end meeting?15:50
sdaguenext week we'll start with outstanding actions from this week15:50
sdaguethen a 2 week hiatus re:holidays15:50
sdaguethen back with a furry in 201615:50
cdentwhat kind of furry? a teddy bear? reindeer? kitty cat? ;)15:51
sdaguecat bus15:51
cdentYES15:51
bknudsonnew year's resolution will be to fix the service catalog15:51
cdent\o/15:51
sdagueI brought one back for my daughter15:51
sdagueit's awesome15:51
sdagueok, thanks for showing up to our kickoff, see you all next week15:51
sdague#endmeeting15:51
*** openstack changes topic to "cross-project liaisons (Meeting topic: crossproject)"15:51
openstackMeeting ended Thu Dec 10 15:51:54 2015 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)15:51
openstackMinutes:        http://eavesdrop.openstack.org/meetings/service_catalog_tng/2015/service_catalog_tng.2015-12-10-15.03.html15:51
openstackMinutes (text): http://eavesdrop.openstack.org/meetings/service_catalog_tng/2015/service_catalog_tng.2015-12-10-15.03.txt15:51
openstackLog:            http://eavesdrop.openstack.org/meetings/service_catalog_tng/2015/service_catalog_tng.2015-12-10-15.03.log.html15:52
sdagueI guess only last thing, there is no dedicated channel for this effort, please just use #openstack-dev15:52
*** agentle has quit IRC15:55
*** cdent has left #openstack-meeting-cp16:03
*** yarkot has quit IRC16:52
*** david-lyle has quit IRC16:53
*** dims_ has quit IRC17:06
*** dims has joined #openstack-meeting-cp17:12
*** dims has quit IRC17:16
*** dims has joined #openstack-meeting-cp17:17
*** dims has quit IRC17:24
*** dims has joined #openstack-meeting-cp17:47
*** dims has quit IRC17:53
*** dims has joined #openstack-meeting-cp17:57
*** dims has quit IRC18:12
*** dims has joined #openstack-meeting-cp18:36
*** harlowja has quit IRC18:56
*** harlowja has joined #openstack-meeting-cp18:56
*** yarkot has joined #openstack-meeting-cp19:19
*** yarkot has quit IRC20:32
*** dims has quit IRC20:35
*** dims has joined #openstack-meeting-cp20:35
*** yarkot has joined #openstack-meeting-cp20:46
*** dslevin has joined #openstack-meeting-cp21:48
*** yarkot has quit IRC22:12
*** yarkot has joined #openstack-meeting-cp22:13
*** yarkot has quit IRC22:17
*** david-lyle has joined #openstack-meeting-cp22:20
*** dslevin has quit IRC22:42
*** dslevin has joined #openstack-meeting-cp22:43
*** david-lyle has quit IRC22:55
*** dslevin has quit IRC22:55
*** dslevin_ has joined #openstack-meeting-cp23:29
*** dslevin_ has quit IRC23:33

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!