| *** ducttape_ has joined #openstack-meeting-cp | 00:00 | |
| *** lamt has joined #openstack-meeting-cp | 01:01 | |
| *** ducttape_ has quit IRC | 01:46 | |
| *** ducttape_ has joined #openstack-meeting-cp | 01:46 | |
| *** ducttape_ has quit IRC | 02:11 | |
| *** ducttape_ has joined #openstack-meeting-cp | 02:24 | |
| *** mars has joined #openstack-meeting-cp | 02:26 | |
| *** ducttape_ has quit IRC | 03:04 | |
| *** mars has quit IRC | 03:16 | |
| *** mars has joined #openstack-meeting-cp | 03:20 | |
| *** ducttape_ has joined #openstack-meeting-cp | 03:41 | |
| *** sheeprine has quit IRC | 04:00 | |
| *** sheeprine has joined #openstack-meeting-cp | 04:05 | |
| *** ducttape_ has quit IRC | 04:05 | |
| *** ducttape_ has joined #openstack-meeting-cp | 04:15 | |
| *** ducttape_ has quit IRC | 04:21 | |
| *** ducttape_ has joined #openstack-meeting-cp | 04:23 | |
| *** diablo_rojo has joined #openstack-meeting-cp | 04:26 | |
| *** ducttape_ has quit IRC | 04:47 | |
| *** diablo_rojo has quit IRC | 05:38 | |
| *** gouthamr has quit IRC | 05:40 | |
| *** lamt has quit IRC | 05:47 | |
| *** ducttape_ has joined #openstack-meeting-cp | 05:48 | |
| *** ducttape_ has quit IRC | 05:53 | |
| *** sigmavirus has quit IRC | 06:52 | |
| *** sigmavirus has joined #openstack-meeting-cp | 06:53 | |
| *** sigmavirus is now known as Guest53153 | 06:54 | |
| *** mars has quit IRC | 07:08 | |
| *** ducttape_ has joined #openstack-meeting-cp | 07:19 | |
| *** ducttape_ has quit IRC | 07:23 | |
| *** mars has joined #openstack-meeting-cp | 07:26 | |
| *** rdopiera has quit IRC | 08:03 | |
| *** rdopiera has joined #openstack-meeting-cp | 08:03 | |
| *** dfflanders has quit IRC | 08:12 | |
| *** ducttape_ has joined #openstack-meeting-cp | 08:49 | |
| *** ducttape_ has quit IRC | 08:53 | |
| *** ducttape_ has joined #openstack-meeting-cp | 09:50 | |
| *** ducttape_ has quit IRC | 09:54 | |
| *** mars has quit IRC | 10:37 | |
| *** ducttape_ has joined #openstack-meeting-cp | 10:51 | |
| *** ducttape_ has quit IRC | 10:55 | |
| *** sdague has joined #openstack-meeting-cp | 11:01 | |
| *** ducttape_ has joined #openstack-meeting-cp | 11:52 | |
| *** ducttape_ has quit IRC | 11:57 | |
| *** Guest53153 is now known as sigmavirus | 12:10 | |
| *** sigmavirus has quit IRC | 12:10 | |
| *** sigmavirus has joined #openstack-meeting-cp | 12:10 | |
| *** ducttape_ has joined #openstack-meeting-cp | 12:53 | |
| *** ducttape_ has quit IRC | 12:58 | |
| *** ducttape_ has joined #openstack-meeting-cp | 13:24 | |
| *** gouthamr has joined #openstack-meeting-cp | 13:40 | |
| *** lamt has joined #openstack-meeting-cp | 14:03 | |
| *** ducttape_ has quit IRC | 14:06 | |
| *** ducttape_ has joined #openstack-meeting-cp | 14:44 | |
| *** ducttape_ has quit IRC | 14:53 | |
| *** lamt has quit IRC | 14:56 | |
| *** rderose has joined #openstack-meeting-cp | 15:06 | |
| *** ducttape_ has joined #openstack-meeting-cp | 15:21 | |
| *** lamt has joined #openstack-meeting-cp | 15:34 | |
| *** spilla has joined #openstack-meeting-cp | 15:45 | |
| *** edmondsw has joined #openstack-meeting-cp | 15:56 | |
| *** ravelar has joined #openstack-meeting-cp | 15:57 | |
| *** ruan_ has joined #openstack-meeting-cp | 15:57 | |
| *** ruan_ is now known as Guest74913 | 15:57 | |
| *** gagehugo has joined #openstack-meeting-cp | 15:57 | |
| *** ayoung has joined #openstack-meeting-cp | 15:58 | |
| *** _ducttape_ has joined #openstack-meeting-cp | 15:58 | |
| lbragstad | #startmeeting policy | 16:00 |
|---|---|---|
| openstack | Meeting started Wed Mar 1 16:00:00 2017 UTC and is due to finish in 60 minutes. The chair is lbragstad. Information about MeetBot at http://wiki.debian.org/MeetBot. | 16:00 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 16:00 |
| *** openstack changes topic to " (Meeting topic: policy)" | 16:00 | |
| openstack | The meeting name has been set to 'policy' | 16:00 |
| lbragstad | ping antwash, raildo, ktychkova, dolphm, dstanek, rderose, htruta, atrmr, gagehugo, lamt, thinrichs, edmondsw, ruan, ayoung, stevemar, ravelar, morgan, raj_singh, johnthetubeguy | 16:00 |
| lbragstad | agenda #link https://etherpad.openstack.org/p/keystone-policy-meeting | 16:00 |
| gagehugo | o/ | 16:00 |
| ravelar | o/ | 16:00 |
| lamt | o/ | 16:00 |
| lbragstad | o/ | 16:00 |
| Guest74913 | o/ | 16:00 |
| rderose | o/ | 16:00 |
| *** Guest74913 has quit IRC | 16:00 | |
| aunnam | o/ | 16:00 |
| ayoung | Hey | 16:01 |
| *** diablo_rojo has joined #openstack-meeting-cp | 16:01 | |
| *** ruan_08 has joined #openstack-meeting-cp | 16:01 | |
| sneti | o/ | 16:01 |
| ruan_08 | o/ | 16:01 |
| lbragstad | we have a pretty good crowd today | 16:01 |
| *** ducttape_ has quit IRC | 16:01 | |
| knikolla | o/ | 16:02 |
| lbragstad | #topic Recap policy discussions from the PTG | 16:02 |
| *** openstack changes topic to "Recap policy discussions from the PTG (Meeting topic: policy)" | 16:02 | |
| ayoung | ravelar, can you maybe come up with a more descriptive name than Policy in code (part 5) | 16:02 |
| * johnthetubaguy lurks | 16:03 | |
| lbragstad | johnthetubaguy o/ | 16:03 |
| ravelar | ayoung are you talking about all the parts or just that one specifically? | 16:03 |
| ayoung | ravelar, all of them | 16:03 |
| ayoung | like...are they by subunit, I assume? | 16:03 |
| edmondsw | o/ | 16:03 |
| ravelar | ayoung what do you prefer? They are just redundantly adding default groups | 16:03 |
| lbragstad | johnthetubaguy I totally misspelled your nick in the ping (sorry!) | 16:03 |
| johnthetubaguy | lbragstad: heh, no worries | 16:04 |
| ravelar | ayoung and I am just following novas convention when they made the patches on their end | 16:04 |
| ayoung | ravelar, why are they different reviews? Is there some ordering there? | 16:04 |
| edmondsw | johnthetubaguy I pinged you in nova IRC to look at a nova policy-related patch that needs your quick review... other reviewers are holding it up waiting for you | 16:04 |
| johnthetubaguy | lbragstad: that must be my plumber cousin | 16:04 |
| *** breitz has quit IRC | 16:04 | |
| lbragstad | johnthetubaguy that's what I was thinking | 16:04 |
| johnthetubaguy | edmondsw: yeah, stuck trying to rework some critical specs at the moment, its open in a tab | 16:04 |
| lbragstad | ayoung no - they are just broken up so the changes aren't so big | 16:04 |
| ravelar | ayoung there are many default groups and rather than putting them in one huge patch change, I simply chained them together. | 16:04 |
| edmondsw | johnthetubaguy tx | 16:04 |
| ayoung | and why are they going into common instead of the sub projects? | 16:05 |
| ravelar | ayoung like here https://blueprints.launchpad.net/nova/+spec/policy-in-code | 16:05 |
| ayoung | I'd expect to see identity/policy assignment/policy etc | 16:05 |
| *** breitz has joined #openstack-meeting-cp | 16:05 | |
| ayoung | the only stuff in common should be actual common stuff | 16:05 |
| ravelar | ayoung isn't policy common? it was a recommendation made by dolphm | 16:05 |
| lbragstad | ravelar ++ | 16:06 |
| ravelar | ayoung and it is in one central place like you would expect to find policy.json | 16:06 |
| lbragstad | ravelar didn't you both refactor that last friday? | 16:06 |
| dolphm | ayoung: i think he's just asking why the individual policies are not in their respective modules | 16:06 |
| dolphm | err, ravelar | 16:06 |
| ayoung | ravelar, no, the policy changes you made look like each is specific to a certain submodule | 16:06 |
| edmondsw | having it in a central place makes it easier to find... which is a big help to folks that want to customize policy | 16:06 |
| ayoung | right | 16:06 |
| edmondsw | nova's done the same with conf, incidentally | 16:06 |
| ravelar | lbragstad yes | 16:06 |
| lbragstad | edmondsw by central you mean in keystone/common/policy/ ? | 16:07 |
| edmondsw | which is also nice | 16:07 |
| ayoung | edmondsw, yeah, don' | 16:07 |
| ayoung | t do that | 16:07 |
| ayoung | edmondsw, the whole point of the submodules is to group like functionality together in a way that things can grow | 16:07 |
| edmondsw | lbragstad yes... or I'd prefer to be like nova and keystone/policies | 16:07 |
| johnthetubaguy | FWIW, this is how ironic did it: https://github.com/openstack/ironic/blob/8db68fef4e97b2ed6552b80215ab03093f18e615/ironic/common/policy.py | 16:08 |
| ayoung | put things from submoduiles into common means that everything should be in common | 16:08 |
| *** eglute has left #openstack-meeting-cp | 16:08 | |
| dolphm | edmondsw: we also have keystone/policy | 16:08 |
| dolphm | edmondsw: for /v3/policies | 16:08 |
| ravelar | edmondsw it was originally setup that way, however when looking at it, the feedback was that we also have keystone/policy | 16:08 |
| edmondsw | I meant keystone/policies would be a directory, not a file | 16:08 |
| ayoung | heh | 16:08 |
| knikolla | this is similar to our conf structure though. | 16:08 |
| knikolla | and i think that was the goal. | 16:08 |
| edmondsw | e.g. https://github.com/openstack/nova/tree/master/nova/policies | 16:09 |
| ayoung | keystone/policy was just the datastore, though. It was agnostic of content. We wanted to kill that at one point | 16:09 |
| dolphm | ravelar: maybe base.py should be in keystone/common, and each individual policy file should be in keystone/identity keystone/catalog etc | 16:09 |
| ayoung | dolphm, ++ | 16:09 |
| lbragstad | that could work | 16:09 |
| johnthetubaguy | FWIW, that caused a mess for our config | 16:09 |
| ayoung | think in terms of people that have to trace from API calls to policy | 16:09 |
| ravelar | dolphm wouldn't that scatter a lot of the files unnecessarily? | 16:09 |
| ayoung | the API call starts at the router, then goes to the controller. | 16:09 |
| johnthetubaguy | if you put them next to each other, in a central place, you can consider them as a single operator "API", but each to their own really, there are trade offs both ways | 16:10 |
| dolphm | although, nova did nova/policies/ for everything just like nova/conf and keystone/conf | 16:10 |
| ayoung | the logical place to look for the policy for a specific controller would be in a file right next to it | 16:10 |
| dolphm | ravelar: it puts the actual policies closer to the code their protecting | 16:10 |
| ravelar | yeah but controller that calls policies is in common | 16:10 |
| ravelar | not in the respective folder | 16:10 |
| lbragstad | similar to the schema.py files of each submidle | 16:10 |
| edmondsw | ayoung dolphm we have common conf directory... why not same for policies? | 16:10 |
| lbragstad | module* | 16:10 |
| edmondsw | https://github.com/openstack/keystone/tree/master/keystone/conf | 16:10 |
| dolphm | ravelar: it's just two different philosophies; i don't think one is necessarily better than the other (other than i'll maintain that having both keystone/policy and keystone/policies would suck) | 16:10 |
| edmondsw | policy is just a different type of conf, really | 16:11 |
| johnthetubaguy | ... but if you want to curate the policy as a single interface the operators need to understand, you might want it in one folder | 16:11 |
| ravelar | johnthetubaguy ++ | 16:11 |
| ayoung | edmondsw, because with conf you tend to go from the file to the repo to find what implements that. With policy you tend to go from the router to the controller to the policy to see what is going to happen | 16:11 |
| johnthetubaguy | dolphm: that sounds like the worst of both choices policy and policies | 16:11 |
| dolphm | johnthetubaguy: right | 16:11 |
| edmondsw | ayoung not me... | 16:11 |
| edmondsw | ayoung I got from the file to the repo, just like conf | 16:12 |
| ayoung | edmondsw, yes, but with policy in code, there will be no file | 16:12 |
| edmondsw | ayoung not true | 16:12 |
| rderose | I'm leaning towards keeping it in one folder | 16:12 |
| edmondsw | ayoung you'll generate the file | 16:12 |
| ravelar | the policy is being called from common controller protected though right? | 16:12 |
| edmondsw | edmondsw you can't expect operators to understand routers and such to make those connections | 16:12 |
| edmondsw | and I should talk to ayoung, not myself... | 16:13 |
| ayoung | so, one folder is fine. just name the files the same as the modules they protect | 16:13 |
| ayoung | identity assignment and so on | 16:13 |
| lbragstad | I don't mind having them named after the resources they protect | 16:13 |
| rderose | me too | 16:13 |
| lbragstad | but I could go either way here | 16:13 |
| ayoung | I mean, its wrong, but so much of Keystone is wrong, this is not even something that registers. | 16:13 |
| johnthetubaguy | FWIW, we were aiming more towards the URL structure than the file structure, but the fact they aren't the same is a totally different problem we have | 16:13 |
| ayoung | johnthetubaguy, +++++++ | 16:13 |
| edmondsw | that's a reason to fix the file structure, no? :) | 16:14 |
| edmondsw | I still struggle to figure out where to look in keystone's code structure for differnt things... | 16:14 |
| dstanek | johnthetubaguy: i hate the fact that we have to consider URL structure at all | 16:14 |
| ayoung | so, the alternative setup we could go with is to merge the routers and maybe even the controllers into a single place, and name them accordingly | 16:15 |
| ayoung | dstanek, so I was looking at how Kubernetes does that. With Kubernets, you have a single discovery page that lists the entities, and then from each entity you get the URL. Then the URL structures are forced to be very regular | 16:15 |
| rderose | ayoung: you mean out of common? | 16:16 |
| ayoung | so user, group, role, etc.... | 16:16 |
| knikolla | move = move and have the old location import the new one with a deprecation warning. | 16:16 |
| ayoung | rderose, I'd probable go keystone/routers | 16:16 |
| ayoung | common is unnecessary naming for most things | 16:16 |
| *** _ducttape_ has quit IRC | 16:16 | |
| rderose | true | 16:16 |
| *** ducttape_ has joined #openstack-meeting-cp | 16:17 | |
| johnthetubaguy | dstanek: I am thinking about the operator, what they care about when setting things is the URL structure, at least I do | 16:17 |
| ayoung | So...I opened with criticism, but ravelar I should have opened with a compliement on the nice work you are doing there...this is all just detail stuff | 16:17 |
| edmondsw | ++ | 16:17 |
| lbragstad | ++ | 16:17 |
| knikolla | ++ | 16:17 |
| rderose | ++ | 16:17 |
| rderose | :) | 16:17 |
| ayoung | johnthetubaguy, hence http://specs.openstack.org/openstack/keystone-specs/specs/keystone/ongoing/role-check-from-middleware.html | 16:17 |
| lbragstad | ravelar those details aside - i think those changes are close to merging | 16:18 |
| dolphm | ayoung: ++ :) | 16:18 |
| ravelar | ayoung thanks! I like the input in general | 16:18 |
| lbragstad | it would be nice to get those issues resolved in review sometime today so that ravelar and antwash can address | 16:18 |
| lbragstad | policy etherpad from PTG #link https://etherpad.openstack.org/p/pike-ptg-keystone-policy | 16:18 |
| johnthetubaguy | ayoung: true, but then we end up with access checks in too many places, well in the Nova case at least, but thats a different discussion | 16:18 |
| lbragstad | these are the patches we have in keystone #link https://review.openstack.org/#/q/topic:bp/policy-in-code+status:open+project:openstack/keystone | 16:19 |
| ayoung | lbragstad, I really don't care where it lands, so long as there is a well thought out rationale. If it is functional, we can also refactor in the future | 16:19 |
| lbragstad | ayoung ++ exactly, | 16:19 |
| dstanek | johnthetubaguy: i'd love to try to figure out exactly why url structure matters so much. maybe we can have a side conversation later | 16:19 |
| ayoung | johnthetubaguy, the RBAC check and the scope check are fundamentally different things, with different requirements. I want to make sure we keep that in mind, and don't hard code the role check into the deep policy-in-code impl | 16:20 |
| johnthetubaguy | dstanek: operators shouldn't need to read the code, only our policy docs and the api-ref, its all stemming from that view of the world really | 16:20 |
| ayoung | code should not know about any actual roles...that should be a configuration/operator decision | 16:20 |
| edmondsw | dstanek because the url structure is everything from the operator perspective. And as nice as comments are, I'm going to want to double-check things, which means going into the code. I need to know where to do that, and what I know is the url structure | 16:20 |
| johnthetubaguy | ayoung: yeah, I think we have exactly the same goals | 16:20 |
| ayoung | Of course, the horrible Nova-everything-in-one-post-api-cuz-we-love-SOAP-API approach does make it a little diffiduclt to convince people | 16:21 |
| ayoung | but, hey | 16:21 |
| dstanek | johnthetubaguy: edmondsw: you guys have the same opinion for the exact opposite reason. | 16:21 |
| edmondsw | :) | 16:21 |
| lbragstad | #progress | 16:22 |
| dstanek | johnthetubaguy: i've always thought the way we document api is wrong :-) | 16:22 |
| dolphm | dstanek: but it IS documented :P | 16:23 |
| dstanek | for some definition of documented :P | 16:23 |
| edmondsw | ++ | 16:23 |
| lbragstad | so - after ravelar and antwash get through moving policy into code we have the documentation bits - #link https://review.openstack.org/#/c/435078/ | 16:23 |
| lbragstad | which will have to be dependent on #link https://review.openstack.org/#/c/439070/ | 16:24 |
| lbragstad | cc johnthetubaguy ^ that's the interface the sdague was talking about | 16:24 |
| johnthetubaguy | ah, yeah, thats it | 16:24 |
| johnthetubaguy | didn't we say we needed multiple url and verb pairs? | 16:25 |
| lbragstad | johnthetubaguy yeah - probably ? | 16:25 |
| ayoung | BTW, ravelar have you looked at my refactorings to support is_admin? | 16:25 |
| lbragstad | johnthetubaguy antwash just posted that yesterday to start getting feedback on it | 16:25 |
| ayoung | seee the three reviews stacked up here https://review.openstack.org/#/c/387710/ | 16:26 |
| lbragstad | johnthetubaguy any feedback nova has on that interface would be a huge help | 16:26 |
| johnthetubaguy | sneti and aunnam should totally take a look at that ^ | 16:27 |
| lbragstad | once that is released in a new version of oslo.policy, we'll be able to tackle the documentation bits | 16:27 |
| ayoung | I'm totes going to block anything that prevents those from merging...wrote them too long ago | 16:27 |
| ayoung | Oct 17... | 16:27 |
| edmondsw | johnthetubaguy I just -1'ed with that comment | 16:28 |
| edmondsw | and to remove scope and access | 16:28 |
| ayoung | and only SteveMar has reviewed them, so please just merge them | 16:28 |
| ayoung | https://review.openstack.org/#/c/387161/12 | 16:29 |
| ayoung | https://review.openstack.org/#/c/387710/13 | 16:29 |
| ayoung | and https://review.openstack.org/#/c/257636/18 | 16:29 |
| ravelar | ayoung ah looking at that now | 16:29 |
| johnthetubaguy | edmondsw: oops, me too, but thats cool | 16:29 |
| lbragstad | johnthetubaguy edmondsw perfect | 16:29 |
| lbragstad | johnthetubaguy is there anything else we came up with during last weeks session that needs to be in that patch that you remember? | 16:30 |
| ayoung | ravelar, thanks, but also need people with +2 to just pull the trigger. I'm not able to actively work on this any more, and its hurting keystone, and all of openstack, to not have is_admin support in policy | 16:30 |
| edmondsw | ayoung there's a -1 from henrynash on https://review.openstack.org/#/c/257636/18 | 16:30 |
| ayoung | edmondsw, and he is still wrong | 16:30 |
| ayoung | edmondsw, that is cuz he's thinking in terms of the cloudsample | 16:31 |
| edmondsw | ayoung cool... I didn't read his comment yet | 16:31 |
| ayoung | we discussed, and he never re-addressed it | 16:31 |
| edmondsw | you just said nobody had reviewed them but stevemar :) | 16:31 |
| knikolla | ayoung: as previously said, let me know when you want me to pick something up which you can't work on. | 16:31 |
| knikolla | though i'm still unsure what the consensus for moving forward with role check in middleware is | 16:32 |
| ayoung | edmondsw, yeah, and Sam looked at that one, too, but only steve looked at the prior | 16:32 |
| ayoung | https://review.openstack.org/#/c/387161/12 | 16:32 |
| ayoung | its a straight refactoring, pulling code together for the is_admin check to be done in once place | 16:32 |
| edmondsw | knikolla ayoung we agreed at the PTG that role check in middleware was essentially dead now | 16:32 |
| ayoung | edmondsw, that is stupid, but irrelevant to this. | 16:33 |
| edmondsw | ayoung I was responding to knikolla's question about that | 16:33 |
| ayoung | edmondsw, you can;'t just kill the idea without replacign it with something else that solves the problem. until we have the replacement, it merely pining for the Fjords | 16:33 |
| ayoung | edmondsw, so, what did you say was a better approach? | 16:34 |
| edmondsw | ayoung consensus was that the approach the nova team is taking is better | 16:34 |
| lbragstad | #link https://review.openstack.org/#/q/topic:bp/policy-remove-scope-checks | 16:34 |
| lbragstad | cc johnthetubaguy ^ | 16:34 |
| edmondsw | ayoung don't shoot the messenger :) | 16:34 |
| johnthetubaguy | so we have me too spec on the docs, but this is the more interesting one | 16:35 |
| johnthetubaguy | so this is largely splitting our existing policy checks into a policy check and a scope check | 16:35 |
| dstanek | edmondsw: actually i think we said we need to go down the current path and get what we committed to completed | 16:35 |
| dstanek | then revisit under the new context | 16:35 |
| lbragstad | dstanek specifically moving policy into code and documenting it | 16:36 |
| dstanek | lbragstad: ++ | 16:36 |
| lbragstad | dstanek that's essentially common ground work we need regardless of the direction we take | 16:36 |
| johnthetubaguy | so where today we have a policy check, nova is going to have two checks, one checking policy and another checking the context scope | 16:36 |
| dstanek | we were trying to not boil the ocean just yet | 16:36 |
| lbragstad | but... moving policy into code and documenting it has immediate positive effects on operators | 16:36 |
| edmondsw | lbragstad ++ | 16:37 |
| ayoung | Wonderful. Is Nova going to go around and fix this in every other project? Is it going to provide a way to map from URL to required role? | 16:37 |
| edmondsw | ayoung essentially yes | 16:38 |
| johnthetubaguy | I like maping a role to a URL, but doing that means breaking so much backwards compatibility, we just can't do that yet | 16:38 |
| ayoung | johnthetubaguy, we can for everything but that Bulk api | 16:38 |
| edmondsw | the docs will tell operators which policy rules go with which URLs, and the default policy settings, which include role | 16:39 |
| ayoung | So there, yeah, you would need something like a faked-out-url-string that does the same kind of role check | 16:39 |
| johnthetubaguy | what I have right now is quick fixes for the problems operators are facing today, in a way that works across upgrade without changing their existing policy files | 16:39 |
| ayoung | but then that would be the one off...and you would still need a top level role to be able to execute that API at all | 16:39 |
| ayoung | johnthetubaguy, what I have is a fix for the whole damn problem, for all services | 16:39 |
| ayoung | that works across upgrade without changing their existing policy files | 16:39 |
| johnthetubaguy | ayoung: except it doesn't deal with upgrade | 16:39 |
| ayoung | yes it does | 16:40 |
| johnthetubaguy | so it seems like folks with modified policy files get a broken system across upgrade | 16:40 |
| johnthetubaguy | and we still need to write all the docs on what each of the rules mean, and what the sensible defaults are | 16:40 |
| johnthetubaguy | the problem is history has taught me its impossible to have this conversation on IRC and specs, needs video and voice / high bandwidth | 16:41 |
| ayoung | johnthetubaguy, the problem is that when we have cross project meetings about this in the past, the only people there were Keystone people. I | 16:42 |
| ayoung | 've given up | 16:42 |
| edmondsw | johnthetubaguy ++ hence the PTG | 16:42 |
| johnthetubaguy | if I had seen the policy ones, I would have gone, I just didn't sadly | 16:43 |
| johnthetubaguy | we have the same issue in reverse with capabilities API | 16:44 |
| johnthetubaguy | had no API wg or keystone folks when we did that in cross project session before, it happens, PTG is making that a little better and worse at the same time | 16:44 |
| ayoung | johnthetubaguy, so, the Nova work should probably be orthoganal, but the RBAC check from middleware needs to be kept alive, and implemented. Otherwise, we don't really have a solution. OpenStack is more than just Nova, and a solution tthat ignores the other services is not a solution | 16:44 |
| ayoung | doing a smarter scope check in Nova is awesome | 16:45 |
| johnthetubaguy | Nova is nothing without the rest of OpenStack, I am totally sold on that | 16:45 |
| ayoung | its the right thing to do, and the other project should follow suit | 16:45 |
| johnthetubaguy | it feels like all this stuff is needed before we could move to anything new anyways | 16:45 |
| edmondsw | johnthetubaguy you were in the main policy one :) | 16:45 |
| ayoung | johnthetubaguy, have you read that spec? | 16:46 |
| ayoung | I am pretty sure you hhave, we discuessd in previous meetings | 16:46 |
| johnthetubaguy | ayoung: I did, I think I read read that when you pointed to that last time | 16:46 |
| johnthetubaguy | re-read^ | 16:46 |
| lbragstad | ayoung the role check in middleware spec had a few reviews from contributors representing other projects | 16:47 |
| ayoung | lbragstad So, who decided it was dead? What superceded it? | 16:47 |
| lbragstad | ayoung we decided to put it on hold until we do policy in code and solid documentation | 16:47 |
| dstanek | ayoung: i think just getting some of the foundational work done | 16:47 |
| johnthetubaguy | I think I remember starting to add comments on it actually, but it had merged already, but I could be miss-remembering that | 16:48 |
| ayoung | lbragstad, the two are orthogonal, though | 16:48 |
| lbragstad | ayoung and the *main* reason why I wanted to do that was because it will force our developers through and exercise of understand the warts in our existing policy implementation | 16:48 |
| lbragstad | ayoung that way we can get more people up to speed on the approach | 16:48 |
| ayoung | while the is_admin check should be a pre-req for the policy-in-code work | 16:48 |
| ayoung | lbragstad, who do you mean by "our developers" ? I was working on this, heads down, for years. | 16:49 |
| lbragstad | ayoung exactly | 16:49 |
| lbragstad | ayoung just you though, and you undestand a *lot* about policy | 16:49 |
| ayoung | So who are you planning on taking this on? | 16:49 |
| lbragstad | antwash and ravelar are started on it already | 16:50 |
| ayoung | lbragstad, wonderful. ravelar the policy in code stuff is, I would say, third priority. | 16:50 |
| ayoung | First is bug 968696 | 16:50 |
| openstack | bug 968696 in OpenStack Identity (keystone) ""admin"-ness not properly scoped" [High,In progress] https://launchpad.net/bugs/968696 - Assigned to Adam Young (ayoung) | 16:50 |
| ayoung | Second is policy in middleware | 16:50 |
| ayoung | policy in code is third | 16:50 |
| ayoung | now... | 16:51 |
| johnthetubaguy | for me this is about the operators, if we can do something to get them into a happier place, and it doesn't move us further away from the existing plans, thats all good | 16:51 |
| ayoung | I don't say that to belittle your efforts, and it can go in as soon as it is ready | 16:51 |
| *** antwash has joined #openstack-meeting-cp | 16:51 | |
| lbragstad | I disagree because the policy in code has zero impact | 16:51 |
| ayoung | lbragstad, and has 0 value | 16:51 |
| ayoung | busineess valuie | 16:51 |
| ayoung | it can be done the way things are now | 16:51 |
| johnthetubaguy | ayoung: all the operators want the policy docs yesterday, this gets them some docs | 16:52 |
| ayoung | policy in code is a good idea, but it does not solve the limitations of keystone | 16:52 |
| lbragstad | i also disagree with that because it allows better management of policy files | 16:52 |
| edmondsw | policy in code is going to make fixing 968696 easier | 16:52 |
| lbragstad | ayoung i won't say that policy in code is going to be the silver bullet | 16:52 |
| ayoung | edmondsw, not if it does not take the is_admin fixes into account | 16:52 |
| ayoung | which were written 6 months ago | 16:52 |
| edmondsw | ayoung have you read john's specs? | 16:52 |
| lbragstad | but I do understand the value of implementing it because it will force developers *across* openstack to understand the policy checks they provide | 16:52 |
| ayoung | lbragstad, its a good idea, its just not nearly as important as understanding where keystone is falling down | 16:53 |
| johnthetubaguy | "falling down"? | 16:53 |
| ayoung | johnthetubaguy, yes | 16:54 |
| dstanek | great movie? | 16:54 |
| ayoung | johnthetubaguy, I have ahad to stop thinking about the security aspects of opolicy enforcement becauser it was keeping me up nights | 16:54 |
| ayoung | dstanek, Meh...good movie, not quite great...only watched once | 16:55 |
| ayoung | So, please get the is_admin stuff in *before* policy in code | 16:55 |
| ayoung | the policy in code stuff looks well enough self contained that it should follow in pretty soon there after | 16:56 |
| ayoung | then, please either go with RBAC in middleware, or come up with some other approach that actually solves the problems | 16:56 |
| lbragstad | I see no technical reason why policy in code has to be dependent on the is_admin stuff | 16:56 |
| johnthetubaguy | they seem in parallel to me | 16:56 |
| ayoung | lbragstad, look closer | 16:57 |
| ayoung | is_admin needs to be enforced by the the code | 16:57 |
| * lbragstad squints | 16:57 | |
| ayoung | otherwise, both those patches will need to be rewritten | 16:57 |
| lbragstad | I will review those three patches today | 16:57 |
| ayoung | Its going to be a rebase nightmare, and I am not around to do it | 16:57 |
| ayoung | which means it is not going to happen | 16:58 |
| ayoung | lbragstad, understand that I don't have time to work on them, so if you have changes you want made, you need to find someone else to make them | 16:58 |
| lbragstad | ack | 16:59 |
| lbragstad | alright - we're about out of time | 16:59 |
| johnthetubaguy | there are tweaks to the default policy.json there is a little clash there | 16:59 |
| ayoung | johnthetubaguy, yep. | 16:59 |
| johnthetubaguy | honestly, people are setting the rules with no idea what they mean right now, that seems really bad | 16:59 |
| lbragstad | johnthetubaguy ++ | 16:59 |
| johnthetubaguy | they are both things we need to fix, so there is certainly agreement there | 17:00 |
| lbragstad | alright - thanks for coming everyone! i appreciate the discussion :) | 17:01 |
| lbragstad | see everyone next week | 17:01 |
| ayoung | johnthetubaguy, so lets make it so they never have to touche policy.jhson again | 17:01 |
| lbragstad | #endmeeting | 17:01 |
| *** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings" | 17:01 | |
| openstack | Meeting ended Wed Mar 1 17:01:34 2017 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 17:01 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/policy/2017/policy.2017-03-01-16.00.html | 17:01 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/policy/2017/policy.2017-03-01-16.00.txt | 17:01 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/policy/2017/policy.2017-03-01-16.00.log.html | 17:01 |
| *** spilla has left #openstack-meeting-cp | 17:02 | |
| *** ravelar has left #openstack-meeting-cp | 17:02 | |
| *** edmondsw has left #openstack-meeting-cp | 17:05 | |
| *** gagehugo has left #openstack-meeting-cp | 17:06 | |
| *** eglute has joined #openstack-meeting-cp | 18:07 | |
| *** harlowja has quit IRC | 18:43 | |
| *** harlowja has joined #openstack-meeting-cp | 18:46 | |
| *** gouthamr has quit IRC | 18:56 | |
| *** gouthamr has joined #openstack-meeting-cp | 19:00 | |
| *** ducttape_ has quit IRC | 19:10 | |
| *** raj_singh_ has joined #openstack-meeting-cp | 19:30 | |
| *** raj_singh_ has quit IRC | 19:31 | |
| *** stream10 has joined #openstack-meeting-cp | 19:35 | |
| *** ruan_08 has quit IRC | 19:42 | |
| *** ducttape_ has joined #openstack-meeting-cp | 19:48 | |
| *** ducttape_ has quit IRC | 19:59 | |
| *** ducttape_ has joined #openstack-meeting-cp | 20:01 | |
| *** harlowja has quit IRC | 20:08 | |
| *** stream10 has quit IRC | 20:47 | |
| *** beisner- has joined #openstack-meeting-cp | 20:50 | |
| *** beisner has quit IRC | 20:53 | |
| *** beisner- is now known as beisner | 20:53 | |
| *** ducttape_ has quit IRC | 21:00 | |
| *** harlowja has joined #openstack-meeting-cp | 21:01 | |
| *** harlowja has quit IRC | 21:01 | |
| *** harlowja has joined #openstack-meeting-cp | 21:01 | |
| *** ducttape_ has joined #openstack-meeting-cp | 21:20 | |
| *** stream10 has joined #openstack-meeting-cp | 21:30 | |
| *** gouthamr has quit IRC | 21:33 | |
| *** ducttape_ has quit IRC | 21:38 | |
| *** stream10 has quit IRC | 22:14 | |
| *** ducttape_ has joined #openstack-meeting-cp | 22:39 | |
| *** ducttape_ has quit IRC | 22:45 | |
| *** breitz_ has joined #openstack-meeting-cp | 22:45 | |
| *** breitz has quit IRC | 22:46 | |
| *** ducttape_ has joined #openstack-meeting-cp | 22:51 | |
| *** breitz has joined #openstack-meeting-cp | 22:52 | |
| *** breitz_ has quit IRC | 22:54 | |
| *** gouthamr has joined #openstack-meeting-cp | 22:58 | |
| *** lamt has quit IRC | 23:17 | |
| *** ducttape_ has quit IRC | 23:27 | |
| *** ducttape_ has joined #openstack-meeting-cp | 23:44 | |
| *** Guest27057 is now known as zigo | 23:57 | |
| *** sdague has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!