| *** ducttape_ has quit IRC | 00:02 | |
| *** jamespage has quit IRC | 00:06 | |
| *** jamespage has joined #openstack-meeting-cp | 00:13 | |
| *** jamespage has quit IRC | 00:17 | |
| *** lamt has quit IRC | 00:35 | |
| *** gouthamr has quit IRC | 00:45 | |
| *** jamespage has joined #openstack-meeting-cp | 00:45 | |
| *** ducttape_ has joined #openstack-meeting-cp | 01:27 | |
| *** ducttape_ has quit IRC | 01:28 | |
| *** harlowja has quit IRC | 03:03 | |
| *** ducttape_ has joined #openstack-meeting-cp | 03:22 | |
| *** ducttape_ has quit IRC | 03:45 | |
| *** ducttape_ has joined #openstack-meeting-cp | 03:47 | |
| *** markvoelker has quit IRC | 03:49 | |
| *** ducttape_ has quit IRC | 03:50 | |
| *** ducttape_ has joined #openstack-meeting-cp | 03:50 | |
| *** markvoelker has joined #openstack-meeting-cp | 04:51 | |
| *** markvoelker has quit IRC | 04:55 | |
| *** noama has quit IRC | 05:28 | |
| *** noama has joined #openstack-meeting-cp | 05:28 | |
| *** dhellmann has quit IRC | 05:39 | |
| *** dhellmann has joined #openstack-meeting-cp | 05:39 | |
| *** coolsvap has joined #openstack-meeting-cp | 06:10 | |
| *** markvoelker has joined #openstack-meeting-cp | 06:51 | |
| *** markvoelker has quit IRC | 06:56 | |
| *** beisner has quit IRC | 07:12 | |
| *** jamespage has quit IRC | 07:32 | |
| *** jamespag` has joined #openstack-meeting-cp | 07:32 | |
| *** beisner has joined #openstack-meeting-cp | 07:44 | |
| *** jamespag` is now known as jamespage | 07:53 | |
| *** markvoelker has joined #openstack-meeting-cp | 08:52 | |
| *** ducttape_ has quit IRC | 08:53 | |
| *** markvoelker has quit IRC | 08:58 | |
| *** skazi has quit IRC | 10:32 | |
| *** markvoelker has joined #openstack-meeting-cp | 10:54 | |
| *** markvoelker has quit IRC | 10:59 | |
| *** ducttape_ has joined #openstack-meeting-cp | 11:02 | |
| *** sdague has joined #openstack-meeting-cp | 11:11 | |
| *** david-lyle has quit IRC | 12:05 | |
| *** david-lyle has joined #openstack-meeting-cp | 12:05 | |
| *** rarcea has joined #openstack-meeting-cp | 12:05 | |
| *** scottda has quit IRC | 12:11 | |
| *** markvoelker has joined #openstack-meeting-cp | 12:55 | |
| *** markvoelker has quit IRC | 13:00 | |
| *** gouthamr has joined #openstack-meeting-cp | 13:45 | |
| *** scottda has joined #openstack-meeting-cp | 13:59 | |
| *** bastafidli has joined #openstack-meeting-cp | 14:04 | |
| *** lamt has joined #openstack-meeting-cp | 14:09 | |
| *** gouthamr has quit IRC | 14:20 | |
| *** gouthamr has joined #openstack-meeting-cp | 14:28 | |
| *** edtubill has joined #openstack-meeting-cp | 14:44 | |
| *** edtubill has quit IRC | 14:44 | |
| *** markvoelker has joined #openstack-meeting-cp | 14:45 | |
| *** edtubill has joined #openstack-meeting-cp | 14:45 | |
| *** bastafidli has quit IRC | 14:55 | |
| *** jaugustine_ has joined #openstack-meeting-cp | 15:24 | |
| *** jaugustine_ is now known as jaugustine | 15:25 | |
| *** itisha has joined #openstack-meeting-cp | 16:31 | |
| *** bastafidli has joined #openstack-meeting-cp | 16:50 | |
| *** ducttape_ has quit IRC | 17:10 | |
| *** ducttape_ has joined #openstack-meeting-cp | 17:10 | |
| *** ducttape_ has quit IRC | 17:15 | |
| *** rarcea has quit IRC | 17:31 | |
| *** ducttape_ has joined #openstack-meeting-cp | 17:34 | |
| *** harlowja has joined #openstack-meeting-cp | 18:31 | |
| *** itisha has quit IRC | 18:52 | |
| *** harlowja has quit IRC | 18:52 | |
| *** bastafidli has quit IRC | 19:03 | |
| *** itisha has joined #openstack-meeting-cp | 19:28 | |
| *** r1chardj0n3s has joined #openstack-meeting-cp | 19:59 | |
| stevemar | o/ | 20:00 |
|---|---|---|
| stevemar | ping ayoung, crinkle, david-lyle, dolphm, dstanek, edtubill, kenji-i, knikolla, lbragstad, r1chardj0n3s, rderose, robcresswell, stevemar | 20:00 |
| edtubill | o/ | 20:01 |
| r1chardj0n3s | o/ | 20:01 |
| lbragstad | o/ | 20:01 |
| stevemar | howdy folks | 20:01 |
| david-lyle | o/ | 20:01 |
| stevemar | do we have a specific meeting tag for this meeting? | 20:01 |
| stevemar | keystone-horizon? | 20:01 |
| crinkle | o/ | 20:01 |
| knikolla | o/ | 20:01 |
| stevemar | horizon-keystone apparently | 20:01 |
| stevemar | #startmeeting horizon-keystone | 20:02 |
| openstack | Meeting started Thu Dec 15 20:02:02 2016 UTC and is due to finish in 60 minutes. The chair is stevemar. Information about MeetBot at http://wiki.debian.org/MeetBot. | 20:02 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 20:02 |
| *** openstack changes topic to " (Meeting topic: horizon-keystone)" | 20:02 | |
| openstack | The meeting name has been set to 'horizon_keystone' | 20:02 |
| r1chardj0n3s | stevemar: I cutnpaste the line from eavesdrop to keep it consistent ;-) | 20:02 |
| stevemar | r1chardj0n3s: that's what i did! | 20:02 |
| r1chardj0n3s | \o/ | 20:02 |
| stevemar | #agenda https://etherpad.openstack.org/p/ocata-keystone-horizon | 20:02 |
| stevemar | not really an agenda | 20:02 |
| stevemar | #link https://etherpad.openstack.org/p/ocata-keystone-horizon | 20:02 |
| stevemar | r1chardj0n3s: mind if i skip your thing til the end? | 20:03 |
| stevemar | (silence means yes in my book!) | 20:03 |
| stevemar | crinkle: you're around, lets talk about your stuff first | 20:04 |
| stevemar | crinkle: i think you had the TODO to re-work https://review.openstack.org/#/c/389337/ | 20:04 |
| r1chardj0n3s | stevemar: yes, please do that thing | 20:04 |
| rderose | o/ | 20:04 |
| stevemar | crinkle: are there any things we should look out for when reviewing it? | 20:04 |
| stevemar | crinkle: looks like a lot of cut-n-paste of the project support | 20:05 |
| crinkle | stevemar: well one thing is that it looks a little messy because i was trying to avoid duplicating code, so looking for feedback on how best to do that | 20:05 |
| stevemar | (not saying thats a bad thing) | 20:05 |
| stevemar | crinkle: is there any UI work needed in the horizon side? i think a drop down no? | 20:06 |
| crinkle | stevemar: yes, i meant to work on that too but didn't get to it yet | 20:07 |
| stevemar | crinkle: s'all good | 20:07 |
| stevemar | no rel note, but it looks like doa doesn't do that | 20:07 |
| stevemar | *throws shade at david-lyle* | 20:07 |
| david-lyle | we put it all in horizon | 20:07 |
| stevemar | documentation is kinda minimal too: http://docs.openstack.org/developer/django_openstack_auth/ | 20:08 |
| david-lyle | the feature add in horizon is the only way it will be visible anyway | 20:08 |
| stevemar | crinkle: looks good to me at a first glance | 20:08 |
| stevemar | david-lyle: ah cool | 20:08 |
| * stevemar tosses a +1 to crinkle | 20:08 | |
| david-lyle | heck stevemar most people don't even know that library exists | 20:09 |
| david-lyle | I will walk through the updated patch | 20:09 |
| crinkle | thanks guys | 20:09 |
| david-lyle | the domain listing seems reasonable | 20:09 |
| david-lyle | backend.py I want to dig into more | 20:09 |
| stevemar | yeah, utils change looks good | 20:10 |
| stevemar | user.py looks like its just calling utils | 20:10 |
| stevemar | i'll let david-lyle assess the backend.py bits | 20:10 |
| david-lyle | yup, it changing the logic around domain scoping changes that I want to be sure about | 20:10 |
| stevemar | crinkle: you tried this out i assume? | 20:11 |
| stevemar | you typically do | 20:11 |
| crinkle | stevemar: yes | 20:11 |
| david-lyle | only federated or both? | 20:11 |
| stevemar | crinkle: cool, did you have to modify horizon? | 20:11 |
| crinkle | david-lyle: both | 20:11 |
| crinkle | stevemar: yes it requires horizon changes | 20:11 |
| david-lyle | crinkle: great, just checking, thanks | 20:12 |
| stevemar | crinkle: cool | 20:12 |
| stevemar | sounds like that is moving along nicely, thanks colleen | 20:12 |
| * stevemar forgot to use topic, noob | 20:12 | |
| crinkle | np thanks for reviewing | 20:12 |
| *** gagehugo has joined #openstack-meeting-cp | 20:13 | |
| stevemar | #topic k2k | 20:13 |
| *** openstack changes topic to "k2k (Meeting topic: horizon-keystone)" | 20:13 | |
| stevemar | edtubill: yo | 20:13 |
| edtubill | hey | 20:13 |
| edtubill | so I have these two patches: https://review.openstack.org/#/c/408435/1 (horizon) https://review.openstack.org/#/c/408450/1 (django_openstack_auth) | 20:13 |
| edtubill | They need tests... | 20:13 |
| stevemar | i think you have" https://review.openstack.org/#/q/topic:bp/k2k-horizon | 20:13 |
| edtubill | but it would be cool if david-lyle or stevemar would be able to see if the approach take (at a high level) is okay to do. | 20:13 |
| edtubill | Those two patches are for that bp. | 20:14 |
| stevemar | edtubill: do you need guidance working on how to create more tests? i remember having trouble with that for doa and lhcheng helped me out | 20:14 |
| edtubill | Sure | 20:15 |
| stevemar | david-lyle: do you have time to help edtubill out with the tests? | 20:15 |
| david-lyle | I should | 20:15 |
| stevemar | edtubill: meet your new best friend | 20:15 |
| david-lyle | I'll review the patches this afternoon | 20:15 |
| edtubill | cool :) | 20:16 |
| david-lyle | and we can look at adding tests | 20:16 |
| stevemar | should we go over the patches here like we did with crinkle's? | 20:16 |
| edtubill | please let me know if the approach should be taken a different way. | 20:16 |
| edtubill | I put some comments in the commit message | 20:16 |
| stevemar | we can start with the horizon one, https://review.openstack.org/#/c/408435/1 is much smaller :P | 20:16 |
| david-lyle | I also worry about crinkle and your d-o-a patches stomping on each other | 20:17 |
| edtubill | I'm willing to rebase.. | 20:17 |
| crinkle | me too | 20:17 |
| david-lyle | backend.py is heavily redone in both | 20:17 |
| david-lyle | but we can cross that | 20:17 |
| david-lyle | the horizon patch seems reasonable | 20:19 |
| stevemar | ah i see the "support / current / available" section is like regions: https://review.openstack.org/#/c/408435/1/openstack_dashboard/context_processors.py | 20:19 |
| david-lyle | yes | 20:20 |
| edtubill | I took inspiration from that yes :p | 20:20 |
| stevemar | edtubill: use "depends-on" | 20:20 |
| david-lyle | my only concern is that context_processors is executed on every request, don't want to prematurely optimize, but minimizing logic in there is desirable | 20:21 |
| stevemar | david-lyle: edtubill can you check a config option before executing that code? | 20:21 |
| edtubill | I can add a flag or is there another place that I could potentially put that logic that doesn't run everytime? | 20:22 |
| david-lyle | I don't know that we have a k2k setting to check, and dynamically is better | 20:23 |
| david-lyle | let me look at it more closely | 20:23 |
| stevemar | any way to check the token in context_processors? | 20:23 |
| edtubill | I could also just look at the available_providers from the session variable and just skip the rest if its an empty list. | 20:23 |
| stevemar | see if service_providers is empty or not | 20:23 |
| david-lyle | your reading a value from the session and then short-circuiting most of the logic if there aren't multiple keystones | 20:23 |
| david-lyle | token is on the session | 20:24 |
| stevemar | david-lyle: rgr | 20:24 |
| stevemar | david-lyle: maybe just "if not available_providers: break" | 20:24 |
| *** stvnoyes has quit IRC | 20:24 | |
| stevemar | or actually "if available_providers" then go into your logic | 20:24 |
| stevemar | skip it otherwise | 20:24 |
| david-lyle | but the provider list is already taken from the session in doa and put separately as a convenience | 20:24 |
| *** stvnoyes has joined #openstack-meeting-cp | 20:25 | |
| david-lyle | stevemar: yeah something like that | 20:25 |
| stevemar | edtubill: commented | 20:26 |
| stevemar | david-lyle: are you expecting tests for that patch? | 20:26 |
| edtubill | cool thx | 20:26 |
| stevemar | david-lyle: and a release note? | 20:26 |
| david-lyle | release note yes, testing that is difficult | 20:27 |
| stevemar | edtubill: know how to create a release note, yes? | 20:28 |
| stevemar | david-lyle: understood | 20:28 |
| edtubill | not really.. | 20:28 |
| edtubill | is there some doc I can read? | 20:28 |
| stevemar | edtubill: http://docs.openstack.org/developer/keystone/developing.html#release-notes | 20:28 |
| stevemar | edtubill: just run... $ tox -e venv -- reno new bp-k2k-horizon | 20:29 |
| david-lyle | we have one similar since lhcheng added it to both | 20:29 |
| edtubill | ok | 20:29 |
| stevemar | you'll see a new file show up in horizon/releasenotes/notes, edit that file | 20:29 |
| *** lamt has quit IRC | 20:29 | |
| stevemar | try to think of it from a consumer perspective | 20:29 |
| stevemar | if you were to use it, what would you want to know, etc | 20:30 |
| stevemar | now... https://review.openstack.org/#/c/408450/2 | 20:30 |
| stevemar | +386, yowza! | 20:30 |
| r1chardj0n3s | needs more code deletion | 20:30 |
| stevemar | edtubill: are you trying to squeeze in a refactor? | 20:31 |
| edtubill | yeah.. I didn't want to rewrite scoping code... | 20:31 |
| stevemar | edtubill: thats totally fair | 20:31 |
| stevemar | edtubill: can i ask that you break the patch up? | 20:31 |
| edtubill | I can undo it if it makes it easier to review and do refactoring later. | 20:31 |
| edtubill | sure. | 20:31 |
| stevemar | one patch to do the split, some stuff from backend.py into base.py (that can land first) | 20:32 |
| stevemar | as long as it's a pure refactor it should be easy to approve and need no tests | 20:32 |
| stevemar | then it'll just be the k2k code to review | 20:32 |
| edtubill | Sure, are you guys okay with the approach of making a new Auth plugin even though it doesn't really get used at Log in time? (although it might in the future) | 20:33 |
| edtubill | The other plugins get used only at log in time. | 20:33 |
| stevemar | i don't think there are any negative impacts there | 20:34 |
| r1chardj0n3s | yep | 20:34 |
| david-lyle | I don't have a reason against right now | 20:35 |
| stevemar | edtubill: need a hand with breaking things up? | 20:35 |
| edtubill | I think I remember how to break things up. | 20:35 |
| stevemar | edtubill: ping me if you need a hand | 20:36 |
| edtubill | okay will do. | 20:36 |
| stevemar | alright, next topic | 20:36 |
| *** kbyrne has quit IRC | 20:36 | |
| stevemar | #topic v3 policy is terribad | 20:36 |
| *** openstack changes topic to "v3 policy is terribad (Meeting topic: horizon-keystone)" | 20:36 | |
| edtubill | Also a quick note, last time I used federation I get errors at viewing instances... am I the only one seeing this error? | 20:36 |
| stevemar | o_O | 20:37 |
| edtubill | I'll wait to ask this question later :p | 20:37 |
| stevemar | probably gonna need more data than that :) | 20:37 |
| stevemar | this topic relates to line 47 on https://etherpad.openstack.org/p/ocata-keystone-horizon | 20:37 |
| stevemar | i have a feeling this will involve keystone fixing something | 20:37 |
| stevemar | does anyone have any background on https://bugs.launchpad.net/oslo.policy/+bug/1547684 ? | 20:38 |
| openstack | Launchpad bug 1547684 in oslo.policy "Attribute error on Token object when using domain scoped token" [Undecided,New] | 20:38 |
| stevemar | ayoung had a comment: that had https://review.openstack.org/#/c/165908/ merged, everything would be good | 20:38 |
| r1chardj0n3s | no further background from me beyond that error, I'm afraid | 20:39 |
| stevemar | looks like policy is just terrible: https://launchpadlibrarian.net/242578504/policy_token.py | 20:39 |
| stevemar | i can look into this, if no one else has any insight | 20:40 |
| stevemar | removing token.is_admin_project:True seems to solve the issue | 20:41 |
| stevemar | looking at: https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json | 20:41 |
| stevemar | i love how you publish something that is unusable | 20:42 |
| stevemar | we* | 20:42 |
| r1chardj0n3s | :-) | 20:42 |
| stevemar | i think "token.is_admin_project:True" is just wrong | 20:42 |
| stevemar | should it be "target.token.is_admin_project:True" ? | 20:43 |
| stevemar | let me go talk to some people | 20:43 |
| stevemar | next topic | 20:43 |
| stevemar | #topic Visualisation of policy / role | 20:43 |
| *** openstack changes topic to "Visualisation of policy / role (Meeting topic: horizon-keystone)" | 20:43 | |
| stevemar | r1chardj0n3s: ^ | 20:43 |
| r1chardj0n3s | ohai | 20:43 |
| stevemar | r1chardj0n3s: did you rub the sleep out of your eyes yet? | 20:43 |
| r1chardj0n3s | so this came up earlier this week that some way of visualising policy and RBAC controls would be super helpful, especially in the face of ... rather opaque at times policy files :-) | 20:44 |
| r1chardj0n3s | I was wondering whether there'd been any prior art on this? | 20:44 |
| stevemar | r1chardj0n3s: kinda like how network topologies are visualized? | 20:45 |
| david-lyle | visualize what aspect? | 20:45 |
| r1chardj0n3s | I guess so, kinda. Being able to say "hey, what exactly can this role do, based on policy?" | 20:45 |
| stevemar | it also stinks that policy is file based | 20:45 |
| stevemar | hmm | 20:46 |
| stevemar | get the roles from the token, and try enforcing all entries in all policies? | 20:47 |
| david-lyle | yeah but targets come into play too | 20:47 |
| r1chardj0n3s | possibly just one role at a time, but yeah, some sensible way of dealing with targes too | 20:47 |
| stevemar | r1chardj0n3s: you'd get back something like "identity:create_region" passes and another thing doesn't | 20:47 |
| r1chardj0n3s | yeah | 20:48 |
| stevemar | yeah, its not easy, but it sounds do-able | 20:48 |
| david-lyle | without attaching to resources I'm not sure how useful it will be | 20:48 |
| stevemar | was there some desire to see this from an operator? | 20:48 |
| david-lyle | or is this a tool for operators who are defining policy? | 20:48 |
| r1chardj0n3s | yeah, this is something coming from operators | 20:49 |
| david-lyle | what was the specific ask? | 20:49 |
| r1chardj0n3s | I don't have any more on the specifics, sorry | 20:49 |
| stevemar | r1chardj0n3s: unfortunately, editing the policy won't be easy :) | 20:49 |
| r1chardj0n3s | I was mostly wondering whether anyone had done any sort of visualisation like this before | 20:49 |
| david-lyle | if only policy was centralized ... | 20:49 |
| * stevemar throws a fish at david-lyle | 20:50 | |
| * david-lyle claps like a seal | 20:50 | |
| stevemar | lol | 20:50 |
| stevemar | r1chardj0n3s: okay, get back a bit more data i guess? | 20:50 |
| stevemar | sounds a bit hand-wavey right now | 20:50 |
| david-lyle | tough to know of prior art without undestanding the type of visualization | 20:51 |
| r1chardj0n3s | yep, given the answer to my question seems to be "no... we think" then I'll go back for more detail on what's actually desired | 20:51 |
| stevemar | cool | 20:51 |
| stevemar | sounds like we're all wrapped up for this week | 20:51 |
| stevemar | #topic open discussion | 20:51 |
| *** openstack changes topic to "open discussion (Meeting topic: horizon-keystone)" | 20:51 | |
| stevemar | cancel next week obvs | 20:51 |
| r1chardj0n3s | yep, and week after, probably | 20:52 |
| stevemar | i mean, i like you people, but not that much | 20:52 |
| stevemar | r1chardj0n3s: yes | 20:52 |
| r1chardj0n3s | coolo | 20:52 |
| stevemar | any last qs? | 20:52 |
| stevemar | thanks everyone! | 20:53 |
| r1chardj0n3s | narf | 20:53 |
| stevemar | have a great weekend, do that last minute shopping | 20:53 |
| r1chardj0n3s | thanks stevemar | 20:53 |
| david-lyle | thanks | 20:53 |
| stevemar | #endmeeting | 20:53 |
| *** openstack changes topic to " (Meeting topic: cinder-nova-api-changes)" | 20:53 | |
| openstack | Meeting ended Thu Dec 15 20:53:25 2016 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 20:53 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/horizon_keystone/2016/horizon_keystone.2016-12-15-20.02.html | 20:53 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/horizon_keystone/2016/horizon_keystone.2016-12-15-20.02.txt | 20:53 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/horizon_keystone/2016/horizon_keystone.2016-12-15-20.02.log.html | 20:53 |
| *** r1chardj0n3s has left #openstack-meeting-cp | 20:53 | |
| *** bastafidli has joined #openstack-meeting-cp | 20:59 | |
| *** jaugustine has quit IRC | 21:19 | |
| *** jgriffith is now known as jgriffith_AutoAw | 21:40 | |
| *** jgriffith_AutoAw is now known as jgriffith | 21:52 | |
| *** edtubill has quit IRC | 21:55 | |
| *** gouthamr has quit IRC | 22:16 | |
| *** _ducttape_ has joined #openstack-meeting-cp | 22:20 | |
| *** ducttape_ has quit IRC | 22:23 | |
| *** _ducttape_ has quit IRC | 22:24 | |
| *** bastafidli has quit IRC | 22:28 | |
| *** gagehugo has left #openstack-meeting-cp | 22:29 | |
| *** jgriffith is now known as jgriffith_AutoAw | 22:47 | |
| *** jgriffith_AutoAw is now known as jgriffith | 22:47 | |
| *** markvoelker has quit IRC | 23:13 | |
| *** itisha has quit IRC | 23:22 | |
| *** harlowja has joined #openstack-meeting-cp | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!