| *** bswartz has quit IRC | 00:12 | |
| *** sdague has quit IRC | 00:18 | |
| *** ricolin has joined #openstack-meeting-cp | 00:57 | |
| *** ricolin has quit IRC | 01:15 | |
| *** diablo_rojo_phon has quit IRC | 01:20 | |
| *** diablo_rojo has quit IRC | 02:26 | |
| *** gouthamr has quit IRC | 03:44 | |
| *** ricolin has joined #openstack-meeting-cp | 04:08 | |
| *** ricolin has quit IRC | 05:33 | |
| *** ricolin has joined #openstack-meeting-cp | 05:46 | |
| *** MarkBaker has quit IRC | 06:59 | |
| *** MarkBaker has joined #openstack-meeting-cp | 07:44 | |
| *** MarkBaker has quit IRC | 08:38 | |
| *** MarkBaker has joined #openstack-meeting-cp | 09:43 | |
| *** MarkBaker has quit IRC | 09:44 | |
| *** ricolin has quit IRC | 09:59 | |
| *** sdague has joined #openstack-meeting-cp | 11:06 | |
| *** MarkBaker has joined #openstack-meeting-cp | 11:43 | |
| *** mars has joined #openstack-meeting-cp | 12:15 | |
| *** gouthamr has joined #openstack-meeting-cp | 13:15 | |
| *** gouthamr has quit IRC | 13:42 | |
| *** gouthamr has joined #openstack-meeting-cp | 13:43 | |
| *** kberger has quit IRC | 14:06 | |
| *** kberger has joined #openstack-meeting-cp | 14:06 | |
| *** MarkBaker has quit IRC | 14:23 | |
| *** MarkBaker has joined #openstack-meeting-cp | 15:03 | |
| *** MarkBaker has quit IRC | 15:13 | |
| *** edtubill has joined #openstack-meeting-cp | 15:28 | |
| *** MarkBaker has joined #openstack-meeting-cp | 15:29 | |
| *** MarkBaker has quit IRC | 15:36 | |
| *** rderose has quit IRC | 15:39 | |
| *** diablo_rojo has joined #openstack-meeting-cp | 15:49 | |
| *** MarkBaker has joined #openstack-meeting-cp | 15:56 | |
| *** lamt has joined #openstack-meeting-cp | 16:03 | |
| *** rdotcom has quit IRC | 16:09 | |
| *** MarkBaker has quit IRC | 16:18 | |
| *** MarkBaker has joined #openstack-meeting-cp | 16:31 | |
| *** mriedem has joined #openstack-meeting-cp | 16:53 | |
| *** MarkBaker has quit IRC | 16:56 | |
| ildikov | #startmeeting cinder-nova-api-changes | 17:00 |
|---|---|---|
| openstack | Meeting started Thu Feb 16 17:00:11 2017 UTC and is due to finish in 60 minutes. The chair is ildikov. Information about MeetBot at http://wiki.debian.org/MeetBot. | 17:00 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 17:00 |
| *** openstack changes topic to " (Meeting topic: cinder-nova-api-changes)" | 17:00 | |
| openstack | The meeting name has been set to 'cinder_nova_api_changes' | 17:00 |
| ildikov | scottda DuncanT ameade cFouts johnthetubaguy jaypipes takashin alaski e0ne jgriffith tbarron andrearosa hemna erlon mriedem gouthamr ebalduf patrickeast smcginnis diablo_rojo gsilvis xyang1 raj_singh lyarwood | 17:00 |
| smcginnis | ildikov: Sorry, gotta miss today. Will catch up on logs later today. | 17:00 |
| hemna | yough | 17:00 |
| *** jaugustine has joined #openstack-meeting-cp | 17:01 | |
| breitz | o/ | 17:01 |
| mriedem | o/ | 17:01 |
| ildikov | smcginnis: np | 17:01 |
| ildikov | let's wait a bit, although as we're so close to the PTG we might not have that many attendees today | 17:02 |
| *** jungleboyj has joined #openstack-meeting-cp | 17:03 | |
| ildikov | all right, let's start | 17:03 |
| hemna | on your marks....get set..... | 17:04 |
| ildikov | hemna: :) | 17:04 |
| * jungleboyj is lurking. | 17:04 | |
| ildikov | so we have the spec on the Nova side to capture how to get Nova to work with the new Cinder API | 17:04 |
| ildikov | #link https://review.openstack.org/#/c/373203/ | 17:05 |
| ildikov | it would be great to check on the problematic items in it and figure out the preferred way forward next week | 17:05 |
| hemna | lots of mriedem feedback there. | 17:05 |
| ildikov | we are looking into a few cases, like breitz is working on BfV and I try to look into shelve | 17:06 |
| hemna | the Cinder API is in place, so isn't it just a matter of talking about how to use it and adjusting on v2 vs v3 availability? | 17:06 |
| ildikov | hemna: yep, there's quite some, I hope johnthetubaguy will have some time too to check the comments | 17:06 |
| * jgriffith sneaks in the back of the room | 17:07 | |
| * johnthetubaguy sneaks in too | 17:07 | |
| * scottda sneaks in, hiding behind jgriffith and johnthetubaguy | 17:07 | |
| ildikov | hemna: switching to v3 is one thing, using the new attach/detach API is another | 17:07 |
| mriedem | i need johnthetubaguy to approve https://review.openstack.org/#/c/424428/ | 17:07 |
| hemna | you know, the kids in the back of the class always get called on first..... | 17:07 |
| ildikov | jgriffith: johnthetubaguy: scottda: I'm not biting ya know ;) | 17:07 |
| jungleboyj | I lurked at the front and haven't been bitten yet. ;-) | 17:08 |
| ildikov | johnthetubaguy: did you have a chance to look into the comments on the Nova spec? | 17:08 |
| ildikov | I guess that's a no :) | 17:10 |
| ildikov | #action homework to all kids in the room to check the spec and comments to have a common ground for discussion next week | 17:11 |
| ildikov | as we have multi-attach as one of the goals here we also need to look into what needs to be done on the Cinder side | 17:12 |
| mriedem | my hope for the PTG session is, | 17:13 |
| ildikov | jgriffith: do you think we need a slot for this next week or it's less difficult than that? | 17:13 |
| mriedem | johnthetubaguy can give us the high-level on th spec since a lot of nova cores won't have read it yet, | 17:13 |
| mriedem | and then we can dig into the sticking points that i've -1ed on the spec, which can lead to discussion about what we need out of the cinder API, if anything | 17:13 |
| ildikov | mriedem: +1 | 17:14 |
| jgriffith | ildikov I think that's up to the Nova reps, IMHO it's not that difficult | 17:14 |
| mriedem | we already have a nova/cinder slot on thursday morning | 17:14 |
| ildikov | mriedem: I will sync up with johnthetubaguy so we have some items on an etherpad as a starting point | 17:14 |
| mriedem | because we have other tihngs than multiattach to talk about | 17:14 |
| jgriffith | I just need solid guidance on the whole api version thing, and I think mriedem 's plan on that may be the best way to go | 17:14 |
| jgriffith | mriedem yes, yes WE do :) | 17:14 |
| ildikov | jgriffith: I meant more how to handle detach on the Cinder side for instance with the different back ends | 17:14 |
| jgriffith | ildikov so that's a Cinder problem only IMO | 17:15 |
| jgriffith | ildikov and I we've pretty much got a design on how that needs to work | 17:15 |
| ildikov | jgriffith: sorry, I meant whether we need a slot on the Cinder agenda or not | 17:15 |
| jgriffith | ildikov oh | 17:15 |
| jgriffith | sorry | 17:15 |
| jgriffith | YES | 17:15 |
| jgriffith | I want to make sure we're all on the same page, and in face2face is the best way to do that | 17:16 |
| jgriffith | and it means I can use a whiteboard :) | 17:16 |
| ildikov | jgriffith: ok, I will add it somewhere on the Cinder etherad then, tnx :) | 17:16 |
| ildikov | jgriffith: lol :) | 17:16 |
| hemna | ildikov, I have my multi-attach patch up in Cinder | 17:17 |
| jungleboyj | jgriffith: Bingo! | 17:17 |
| jgriffith | hemna wait.. what? | 17:17 |
| hemna | https://review.openstack.org/#/c/428365/ | 17:17 |
| hemna | it makes it work :P | 17:17 |
| jgriffith | oh, capabilities clean-slate | 17:17 |
| ildikov | mriedem: my hope is that we don't need to talk that much about the multi-attach parts during the Cinder-Nova session, maybe don't need to talk about it at all | 17:17 |
| jungleboyj | hemna: :-p | 17:17 |
| hemna | jgriffith, yah I think that's what we wanted right ? | 17:17 |
| hemna | at least from the last meeting | 17:18 |
| jgriffith | hemna indeed! | 17:18 |
| jgriffith | thanks! | 17:18 |
| hemna | coolio | 17:18 |
| mriedem | ildikov: we will because only like 1 other person in nova has read john's spec | 17:18 |
| mriedem | john garbutt's i mean | 17:18 |
| mriedem | we have all sorts of issues to work out wrt upgrades, evacuate, live migration, etc | 17:18 |
| ildikov | that's true, although that's more about how to make the new attach/detach calls work | 17:19 |
| mriedem | ildikov: hemna: also in case you haven't noticed yet, i completely molested https://review.openstack.org/#/c/335358/ last night | 17:19 |
| hemna | that sounds dirty | 17:19 |
| ildikov | mriedem: I need to take a few more breaths before going into that... ;) | 17:19 |
| mriedem | hemna: that was the idea :) | 17:20 |
| ildikov | mriedem: I haven't check all the comments yet, but frankly I hope I don't need to write a spec to clean up some mess in the soon to be old flow | 17:20 |
| jungleboyj | *smh* | 17:20 |
| ildikov | *checked | 17:20 |
| ildikov | mriedem: we can live without that patch, but I think it will make it even harder to have a clean new attach flow | 17:21 |
| mriedem | ildikov: it's gotten much more complicated than i originally though, and it's an api behavior change, so i think a short spec just to get other nova cores on the same page might be prudent | 17:21 |
| mriedem | ildikov: but we could hold off on that until next week | 17:21 |
| mriedem | i think it's the correct long-term direction, to reserve in the API, | 17:22 |
| mriedem | but the mechanics are difficult | 17:22 |
| ildikov | mriedem: API behavior change in case of failure you mean? | 17:22 |
| mriedem | ildikov: no, that we reserve the volume in the API now | 17:22 |
| mriedem | rather than not at all for BFV | 17:22 |
| mriedem | it's an internal change, but it might be noticeable | 17:22 |
| ildikov | mriedem: so with the new flow we will have attachment-create for reserve and that's how the PoC is implemented today | 17:23 |
| mriedem | i just want more people (like dansmith and jaypipes) in the know on that idea | 17:23 |
| ildikov | mriedem: it was a BfV case where we didn't, but for everything else I think the volume was always reserved in the API | 17:23 |
| jgriffith | le sigh | 17:24 |
| ildikov | mriedem: so that patch is about to remove check_attach as the functionality is in the current reserve_volume | 17:24 |
| mriedem | yes i know | 17:24 |
| mriedem | i'm aware :) from the molesting, remember? | 17:24 |
| ildikov | mriedem: and it turned out that reserve as a matter of fact is missing from BfV, not all the cases but one or maybe two | 17:25 |
| mriedem | in the case that we are given a volume, that's the change | 17:25 |
| mriedem | if nova creates the volume during BFV, there is no reserve to be done | 17:25 |
| mriedem | but you'll see more comments about that inline | 17:25 |
| ildikov | mriedem: if you would've molested my patch about 9 months ago, I wouldn't have reacted like this ;) | 17:26 |
| ildikov | mriedem: ok, I will check all the comments in line and we can have a 10 minutes chat about it next week | 17:27 |
| ildikov | mriedem: and I hope a Launchpad blueprint will do as a "worst case scenario" | 17:27 |
| ildikov | mriedem: does it sound ok? | 17:27 |
| mriedem | we can talk about the spec next week, a bp doesn't give the level of detail or doc artifact that a spec does for a big change | 17:29 |
| mriedem | before any of that though, we can talk about the general idea with the nova group | 17:29 |
| mriedem | that's the main thing i want | 17:29 |
| mriedem | more visibility | 17:29 |
| ildikov | so this started as a bug fix and I'm happy to quick update the whole core team about it next week in like 3 minutes and then talk about it at most 7 so we can move to the more complex things like migrate or evacuate or upgrade | 17:30 |
| ildikov | or we can add a separate slot for it next week to not eat up the time of the Cinder-Nova slot with this marginal item | 17:31 |
| ildikov | mriedem: is there 10 minutes in the Nova agenda for this? | 17:31 |
| mriedem | ildikov: it's going to take however long it's going to take | 17:32 |
| mriedem | i don't want to get into a fight about what you consider a 10 minute issue | 17:33 |
| mriedem | this is not a trivial change | 17:33 |
| mriedem | and if we screw it up we'll have volumes left in attaching state | 17:33 |
| mriedem | that the admin will have to reset on the cinder side | 17:33 |
| ildikov | mriedem: sure, my point was more to have it on the pure Nova agenda so we can discuss the interaction related things on the joint session | 17:33 |
| mriedem | it's related to cinder so we can talk about it at that time | 17:33 |
| mriedem | can we move on? | 17:33 |
| mriedem | i'm trying to get ocata GA'ed today | 17:34 |
| ildikov | mriedem: ok, let's not go down the rabbit hole of how much it's related to what | 17:35 |
| ildikov | hopefully next week face2face will make this easier | 17:35 |
| ildikov | I think we are mainly clear on what needs to be discussed next week | 17:37 |
| mriedem | yes i hope so, i need other cores in the know about this, but we've all been heads down on getting ocata out the door and the things that were priorities for that release | 17:37 |
| * jungleboyj mic comes from the ceiling "Let's Get Ready to RRRRRRRRUMBLE!!!!!!!!!!" | 17:37 | |
| ildikov | mriedem: sure, I get that part | 17:38 |
| ildikov | mriedem: jgriffith: do you have any items in mind we would need to touch on today in prep for next week? | 17:38 |
| mriedem | what else do we need to discuss in this meeting? | 17:38 |
| jgriffith | ildikov nah, nothing worth going in to here | 17:39 |
| ildikov | I will add the multi-attach slot to the Cinder etherpad and sync up with johnthetubaguy about having the summary up for the spec and prepare a short draft agenda of items we need to to touch on | 17:39 |
| ildikov | I will also add the remove check_attach topic to the Cinder-Nova slot | 17:39 |
| ildikov | I think these are the main big items | 17:40 |
| johnthetubaguy | yeah, got dragged into other things today, but was hoping to do the cinder spec today/yesterday | 17:40 |
| ildikov | please shout now if I missed anything | 17:40 |
| ildikov | johnthetubaguy: if there isn't one yet we can create an etherpad for the cross-porject slot and add some notes there for people who're not aware of the whole spec (yet) | 17:41 |
| mriedem | there isn't a xp etherpad, it's just in https://etherpad.openstack.org/p/nova-ptg-pike | 17:42 |
| ildikov | mriedem: I will create one then if you don't mind and will add the link to the Nova and Cinder etherpads too | 17:44 |
| mriedem | that's fine | 17:44 |
| ildikov | mriedem: cool, tnx | 17:45 |
| ildikov | ok, if nothing else we can wrap up here | 17:45 |
| ildikov | thanks everyone | 17:46 |
| ildikov | safe travels! :) | 17:46 |
| ildikov | see you next week! :) | 17:46 |
| ildikov | #endmeeting | 17:47 |
| *** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings" | 17:47 | |
| openstack | Meeting ended Thu Feb 16 17:47:19 2017 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 17:47 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/cinder_nova_api_changes/2017/cinder_nova_api_changes.2017-02-16-17.00.html | 17:47 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/cinder_nova_api_changes/2017/cinder_nova_api_changes.2017-02-16-17.00.txt | 17:47 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/cinder_nova_api_changes/2017/cinder_nova_api_changes.2017-02-16-17.00.log.html | 17:47 |
| *** mriedem has left #openstack-meeting-cp | 17:47 | |
| *** diablo_rojo has quit IRC | 18:24 | |
| *** jaugustine__ has joined #openstack-meeting-cp | 18:27 | |
| *** jaugustine has quit IRC | 18:28 | |
| *** jaugustine__ is now known as jaugustine | 18:28 | |
| *** rdopiera has joined #openstack-meeting-cp | 19:07 | |
| *** edtubill has quit IRC | 19:30 | |
| *** diablo_rojo has joined #openstack-meeting-cp | 19:48 | |
| *** MarkBaker has joined #openstack-meeting-cp | 19:57 | |
| *** gagehugo has joined #openstack-meeting-cp | 19:57 | |
| robcresswell | #startmeeting keystone_horizon | 20:00 |
| openstack | Meeting started Thu Feb 16 20:00:00 2017 UTC and is due to finish in 60 minutes. The chair is robcresswell. Information about MeetBot at http://wiki.debian.org/MeetBot. | 20:00 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 20:00 |
| *** openstack changes topic to " (Meeting topic: keystone_horizon)" | 20:00 | |
| openstack | The meeting name has been set to 'keystone_horizon' | 20:00 |
| lbragstad | o/ | 20:00 |
| robcresswell | o/ | 20:00 |
| david-lyle | o/ | 20:00 |
| lbragstad | robcresswell wow - nice timing, you started the meeting exactly as my client hit 14:00:00 | 20:00 |
| robcresswell | lbragstad: I do my best | 20:01 |
| lbragstad | agenda #link https://etherpad.openstack.org/p/ocata-keystone-horizon | 20:01 |
| rdopiera | o/ | 20:01 |
| * lbragstad bets robcresswell is a fan of automation | 20:01 | |
| robcresswell | lbragstad: I actually just happened to be looking at my client :p | 20:01 |
| robcresswell | Sorry to disappoint | 20:01 |
| lbragstad | lol | 20:01 |
| robcresswell | So I wanted to kick these off again and keep using the meeting slot; if we dont use the hour, thats obviously not a problem | 20:02 |
| robcresswell | Last cycle was really, really helpful for Horizon in solving some key issues, and helpful for me personally in understanding how the **** domains work | 20:02 |
| *** lamt has quit IRC | 20:03 | |
| robcresswell | The first thing to do is probably review the etherpad and cross off work that is completed | 20:03 |
| robcresswell | There are also some outstanding patches in Horizon that im not entirely sure of, so would be good to discuss now or in the future meetings. | 20:03 |
| lbragstad | i spent some time trying to do that last week | 20:03 |
| robcresswell | Ah nice, thanks | 20:04 |
| robcresswell | Anything anyone would like to start with? | 20:05 |
| robcresswell | Working through then... | 20:05 |
| robcresswell | #link https://review.openstack.org/#/c/339487/ | 20:05 |
| robcresswell | This got flagged again today as a potential solution to a problem someone was having in the horizon channel | 20:06 |
| lbragstad | is cmurphy around? | 20:06 |
| robcresswell | I've not looked at it yet, david-lyle, cmurphy, thoughts? | 20:06 |
| *** ayoung has quit IRC | 20:07 | |
| david-lyle | i haven't reviewed that yet | 20:07 |
| david-lyle | but not sure user | 20:07 |
| david-lyle | s | 20:07 |
| david-lyle | argh | 20:07 |
| robcresswell | Ah you -1'd it a while back | 20:07 |
| robcresswell | Just wondered if you'd seen it recently, but np | 20:07 |
| david-lyle | not sure user's domain id is the right policy target even if one is warranted | 20:08 |
| *** lamt has joined #openstack-meeting-cp | 20:08 | |
| david-lyle | should be the domain I'm auth'd into | 20:08 |
| david-lyle | I believe | 20:08 |
| lbragstad | so the domain of the project you've scoped your token to, or the domain scope of your token? | 20:08 |
| david-lyle | but our cross-domain user support is woefully inadequate in general | 20:09 |
| david-lyle | domain scope for identity operations | 20:09 |
| david-lyle | what we really need is to figure out the cross-openstack answer for what can I do | 20:10 |
| david-lyle | because our policy implementation is limited to what we've seen, but you could add random required policy targets in your policy files and Horizon wouldn't handle them unless it's something we populate by default | 20:11 |
| lbragstad | yeah | 20:11 |
| robcresswell | capabilities API? | 20:12 |
| lbragstad | thought be the ideal solution I would think | 20:12 |
| lbragstad | that would be* | 20:12 |
| * lbragstad can't type | 20:12 | |
| david-lyle | but we have the several releases until we get that even being optimistic | 20:13 |
| david-lyle | so we'll do what we can | 20:13 |
| robcresswell | Yeah, I know Nova have mentioned it a few times too. | 20:13 |
| robcresswell | Right | 20:13 |
| lbragstad | fwiw - there is going to be a time slot dedicated to capabilities during the Arch WG sessions on tuesday | 20:13 |
| * robcresswell loses track of the WG's | 20:14 | |
| lbragstad | #link https://etherpad.openstack.org/p/ptg-architecture-workgroup | 20:14 |
| lbragstad | I don't believe they have time slots allocated yet | 20:14 |
| lbragstad | but it's in their list of topics | 20:14 |
| robcresswell | Okay, lets keep an eye on that | 20:15 |
| david-lyle | ah, I see that patch is targeting the sample v3 example policy, should still be scoped domain not user domain I think | 20:15 |
| robcresswell | So, the domain of the project, is that? | 20:16 |
| lbragstad | yeah - because technically there is nothing stopping a user in one domain from having role assignments on other domains | 20:16 |
| lbragstad | well - that's tricky too because it depends | 20:17 |
| david-lyle | cross-domain user support should be added to the etherpad | 20:17 |
| david-lyle | it blocked part of cmurphy's patch to doa | 20:17 |
| lbragstad | as a user of keystone, i can explicitly ask for a token scoped to a specific domain that I have a role on, or I can ask for a token scoped to a project in some random domain | 20:17 |
| david-lyle | but I only have permission based on the scope of my current token | 20:18 |
| david-lyle | so it would be the domain I auth'd into to | 20:18 |
| david-lyle | no? | 20:18 |
| * david-lyle reviews v3 sample policy again, crying softly | 20:19 | |
| lbragstad | right - would authenticating for a specific scope be considered just that? | 20:19 |
| david-lyle | but the target is the project.domain_id, hmm | 20:20 |
| david-lyle | I need more time to walk that through | 20:20 |
| lbragstad | http://cdn.pasteraw.com/6badyzj32kns0bjhbbxk58zsc59hxrq | 20:20 |
| *** ayoung has joined #openstack-meeting-cp | 20:20 | |
| lbragstad | ^ that would technically give me a token scoped to a domain | 20:21 |
| david-lyle | the target will be the project.domain_id and then the horizon policy will match that in the credentials check | 20:21 |
| david-lyle | so either cloud_admin, domain_admin for the target domain | 20:22 |
| david-lyle | the patch may be right | 20:22 |
| *** gouthamr has quit IRC | 20:24 | |
| robcresswell | I need some time to get my round this :/ | 20:25 |
| david-lyle | I think the logic is correct, we just didn't include the targets as specified in v3 sample policy | 20:26 |
| lbragstad | do we think this is something we need more involvement in from other projects, too? | 20:26 |
| *** _-___-_ has joined #openstack-meeting-cp | 20:26 | |
| *** _-___-_ has left #openstack-meeting-cp | 20:26 | |
| david-lyle | lbragstad: which part? | 20:26 |
| lbragstad | david-lyle the domain parts | 20:26 |
| lbragstad | david-lyle or the *which* domains part | 20:26 |
| robcresswell | This particular issue just seems like part of the underlying horizon-keystone domain confusion | 20:27 |
| lbragstad | david-lyle because you also mentioned the "what can this use do across OpenStack" point of view | 20:27 |
| david-lyle | so my understanding is... this really only effects keystone and horizon, the other projects' policies are completely project based | 20:28 |
| lbragstad | ok | 20:28 |
| david-lyle | so they only use the project scoped token | 20:28 |
| david-lyle | domain token is only used for identity operations | 20:28 |
| lbragstad | so this should be something we can whiteboard next week | 20:28 |
| david-lyle | yes | 20:29 |
| lbragstad | (pending everyone has time to digest the information) | 20:29 |
| david-lyle | I think we just missed the target when we added support for the v3 sample | 20:29 |
| david-lyle | and this bug will cover that, or the target was added later, I'm unsuer | 20:29 |
| david-lyle | *unsure | 20:29 |
| robcresswell | I'll take a look at it over the next week | 20:31 |
| robcresswell | well, maybe the week after due to PTG, but before next meeting | 20:31 |
| robcresswell | Assuming I can wrap my tiny UI brain around these lofty auth concepts :p | 20:31 |
| david-lyle | I will draw pictures :P | 20:32 |
| david-lyle | I lived domain hell for a long time | 20:32 |
| * lbragstad *loves* pictures | 20:32 | |
| robcresswell | Okay to move on for now? I see rdopiera has dropped a review on it too | 20:33 |
| david-lyle | the other 2 patches in the first block still need review | 20:33 |
| david-lyle | err 1 other | 20:33 |
| david-lyle | 1 merged | 20:33 |
| robcresswell | yep | 20:33 |
| lbragstad | #link https://review.openstack.org/#/c/397332/2 this guy? | 20:34 |
| david-lyle | yes, it looks fine, I just want to test to make sure | 20:35 |
| david-lyle | no point in wasting the effort of trying to get a domain scoped token in a single domain env | 20:35 |
| david-lyle | the base policy file will handle things | 20:35 |
| david-lyle | without the domain scoped token | 20:36 |
| robcresswell | Ah, yeah that looks a little more straightforward | 20:36 |
| robcresswell | Would be nice to add a separate test for it I think | 20:38 |
| *** kberger has quit IRC | 20:39 | |
| *** gouthamr has joined #openstack-meeting-cp | 20:40 | |
| david-lyle | so down to the PCI entry I think is done | 20:40 |
| david-lyle | there are a couple of potentially unaddressed bugs in domain-admin support section | 20:41 |
| lbragstad | yeah - that's what I spent a bunch of time on last week, trying to figure out what was left | 20:41 |
| lbragstad | (PCI ^) | 20:41 |
| david-lyle | did we figure out how to get the passwd strength regex to horizon? | 20:42 |
| lbragstad | david-lyle into horizon? | 20:43 |
| david-lyle | yes | 20:43 |
| lbragstad | keystone now expose it through an api | 20:43 |
| robcresswell | Side note, isn't the hard requirement on subsets of characters considered bad practice? | 20:43 |
| david-lyle | ok, I was trying to read through the patches | 20:43 |
| lbragstad | implemented here - #link https://review.openstack.org/#/q/topic:bp/pci-dss-password-requirements-api | 20:44 |
| lbragstad | docs #link https://developer.openstack.org/api-ref/identity/v3/index.html?expanded=show-domain-group-option-configuration-detail#domain-configuration | 20:44 |
| lbragstad | GET /v3/domains/default/config/security_compliance/password_regex | 20:46 |
| * david-lyle can | 20:46 | |
| david-lyle | I may regret asking this, keystone doesn't support microversions, correct? | 20:47 |
| lbragstad | david-lyle correct | 20:47 |
| robcresswell | :D | 20:47 |
| lbragstad | david-lyle it's actually one of the *first* things we talk about next week | 20:47 |
| robcresswell | please no | 20:47 |
| robcresswell | :) | 20:47 |
| lbragstad | no what? | 20:47 |
| david-lyle | so in an older v3 install, I just get a 404? | 20:47 |
| robcresswell | please no microversions | 20:48 |
| lbragstad | david-lyle correct - we had to be careful with that | 20:48 |
| robcresswell | I'm not a fan, though I can explain why separately. | 20:48 |
| lbragstad | david-lyle because it exposes config over the api | 20:48 |
| lbragstad | robcresswell i'd be interested in hearing your view point | 20:49 |
| david-lyle | ok, so for a while horizon will have to check, but if 404 use our internal setting | 20:49 |
| lbragstad | david-lyle I believe so - but let me double check the logic | 20:49 |
| robcresswell | lbragstad: I'll message after the meeting if you like, or I can drop in on your PTG session. | 20:49 |
| lbragstad | robcresswell first thing wednesday morning - https://etherpad.openstack.org/p/pike-ptg-keystone-ocata-carry-over | 20:49 |
| robcresswell | david-lyle: Yeah, I suppose so | 20:50 |
| robcresswell | lbragstad: Got it | 20:50 |
| david-lyle | robcresswell: grab me before you go, as I will forget :P | 20:50 |
| robcresswell | david-lyle: Ha will do | 20:50 |
| lbragstad | robcresswell i'd still be interested in hearing the gist of it prior to the PTG though | 20:50 |
| robcresswell | sure | 20:51 |
| *** ducttape_ has quit IRC | 20:51 | |
| *** ducttape_ has joined #openstack-meeting-cp | 20:51 | |
| david-lyle | robcresswell: do we have a microversion support group session as part of horizon's time at the PTG? | 20:51 |
| lbragstad | david-lyle https://github.com/openstack/keystone/blob/master/keystone/resource/core.py#L1115 | 20:52 |
| robcresswell | david-lyle: Whatever bar I end up in on Tuesday night | 20:52 |
| lbragstad | it should be either a 404 or a 403 if the option is not set | 20:52 |
| david-lyle | ok, we can handle that | 20:52 |
| lbragstad | and it should be something that you can get with a valid token | 20:53 |
| lbragstad | (as opposed to other things in the domain config - which typically require admin) | 20:53 |
| david-lyle | right the policy was default | 20:53 |
| david-lyle | err "" | 20:53 |
| cmurphy | hi - sorry this meeting slipped my mind, i'll have a look at 339487 | 20:53 |
| lbragstad | david-lyle yeah - we shimmied that in here and beat with a hammer until it worked - https://github.com/openstack/keystone/blob/master/keystone/resource/controllers.py#L188-L197 | 20:54 |
| david-lyle | seems like time is low | 20:58 |
| david-lyle | anything pressing to hit in the last couple of minutes? | 20:58 |
| david-lyle | we can talk more about "Looking Forward" next week | 20:59 |
| robcresswell | Nothing else from me | 20:59 |
| lbragstad | not that i know of - if there is something we need to add to the agenda next week let me know | 20:59 |
| robcresswell | Thanks for attending; I'll keep sending out the email reminders etc | 20:59 |
| lbragstad | or add it | 20:59 |
| lbragstad | https://etherpad.openstack.org/p/pike-ptg-keystone-horizon | 20:59 |
| lbragstad | #link https://etherpad.openstack.org/p/pike-ptg-keystone-horizon | 20:59 |
| robcresswell | lbragstad: If you could give the weekly meeting a shout out during the PTG that would be much appreciated | 21:00 |
| david-lyle | horizon folks will be loitering the second half of the week so pull us in as needed | 21:00 |
| lbragstad | robcresswell will do - to get more keystone devs involved? | 21:00 |
| lbragstad | I assume? | 21:00 |
| * david-lyle may be speaking for himself only | 21:00 | |
| robcresswell | lbragstad: Just so people are aware its ongoing | 21:00 |
| lbragstad | ++ | 21:01 |
| lbragstad | will do | 21:01 |
| david-lyle | oh they're aware, that's why they're not here now | 21:01 |
| robcresswell | I've not intention of bullying people into attending :) | 21:01 |
| robcresswell | haha | 21:01 |
| robcresswell | thanks all | 21:01 |
| robcresswell | #endmeeting | 21:01 |
| *** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings" | 21:01 | |
| openstack | Meeting ended Thu Feb 16 21:01:46 2017 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 21:01 |
| lbragstad | thanks! | 21:01 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/keystone_horizon/2017/keystone_horizon.2017-02-16-20.00.html | 21:01 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/keystone_horizon/2017/keystone_horizon.2017-02-16-20.00.txt | 21:01 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/keystone_horizon/2017/keystone_horizon.2017-02-16-20.00.log.html | 21:01 |
| david-lyle | thanks | 21:01 |
| *** gagehugo has left #openstack-meeting-cp | 21:05 | |
| *** diablo_rojo_phon has joined #openstack-meeting-cp | 21:27 | |
| *** diablo_rojo has quit IRC | 21:31 | |
| *** ducttape_ has quit IRC | 21:42 | |
| *** ducttape_ has joined #openstack-meeting-cp | 21:50 | |
| *** ducttape_ has quit IRC | 22:03 | |
| *** ducttape_ has joined #openstack-meeting-cp | 22:10 | |
| *** bknudson has left #openstack-meeting-cp | 22:13 | |
| *** bknudson has joined #openstack-meeting-cp | 22:14 | |
| *** gouthamr has quit IRC | 22:15 | |
| *** diablo_rojo has joined #openstack-meeting-cp | 22:22 | |
| *** lamt has quit IRC | 22:47 | |
| *** lamt has joined #openstack-meeting-cp | 22:48 | |
| *** lamt has quit IRC | 22:50 | |
| *** lamt has joined #openstack-meeting-cp | 23:03 | |
| *** lamt has quit IRC | 23:30 | |
| *** diablo_rojo_phon has quit IRC | 23:40 | |
| *** jaugustine has quit IRC | 23:51 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!