| *** edmondsw has joined #openstack-meeting-cp | 00:19 | |
| *** edmondsw has quit IRC | 00:24 | |
| *** harlowja has quit IRC | 01:13 | |
| *** hongbin has joined #openstack-meeting-cp | 01:14 | |
| *** gouthamr has quit IRC | 01:25 | |
| *** yamahata has quit IRC | 01:43 | |
| *** iyamahat has quit IRC | 01:43 | |
| *** edmondsw has joined #openstack-meeting-cp | 02:07 | |
| *** edmondsw has quit IRC | 02:12 | |
| *** nhelgeson has quit IRC | 02:14 | |
| *** gouthamr has joined #openstack-meeting-cp | 02:21 | |
| *** markvoelker has quit IRC | 02:59 | |
| *** hongbin has quit IRC | 03:36 | |
| *** edmondsw has joined #openstack-meeting-cp | 03:55 | |
| *** edmondsw has quit IRC | 04:00 | |
| *** gouthamr has quit IRC | 04:14 | |
| *** harlowja has joined #openstack-meeting-cp | 04:31 | |
| *** gouthamr has joined #openstack-meeting-cp | 04:43 | |
| *** yamahata has joined #openstack-meeting-cp | 04:45 | |
| *** harlowja has quit IRC | 04:47 | |
| *** markvoelker has joined #openstack-meeting-cp | 05:00 | |
| *** gouthamr has quit IRC | 05:07 | |
| *** diablo_rojo has joined #openstack-meeting-cp | 05:25 | |
| *** markvoelker has quit IRC | 05:34 | |
| *** edmondsw has joined #openstack-meeting-cp | 05:43 | |
| *** harlowja has joined #openstack-meeting-cp | 05:46 | |
| *** edmondsw has quit IRC | 05:48 | |
| *** markvoelker has joined #openstack-meeting-cp | 06:31 | |
| *** harlowja has quit IRC | 06:42 | |
| *** MarkBaker has joined #openstack-meeting-cp | 07:01 | |
| *** markvoelker has quit IRC | 07:04 | |
| *** diablo_rojo has quit IRC | 07:21 | |
| *** rarcea has joined #openstack-meeting-cp | 07:28 | |
| *** edmondsw has joined #openstack-meeting-cp | 07:31 | |
| *** edmondsw has quit IRC | 07:36 | |
| *** markvoelker has joined #openstack-meeting-cp | 09:02 | |
| *** edmondsw has joined #openstack-meeting-cp | 09:19 | |
| *** edmondsw has quit IRC | 09:24 | |
| *** markvoelker has quit IRC | 09:35 | |
| *** sdague has joined #openstack-meeting-cp | 09:37 | |
| *** yamahata has quit IRC | 10:30 | |
| *** markvoelker has joined #openstack-meeting-cp | 10:32 | |
| *** MarkBaker has quit IRC | 10:45 | |
| *** markvoelker has quit IRC | 11:06 | |
| *** edmondsw has joined #openstack-meeting-cp | 11:07 | |
| *** edmondsw has quit IRC | 11:12 | |
| *** edmondsw has joined #openstack-meeting-cp | 11:30 | |
| *** MarkBaker has joined #openstack-meeting-cp | 11:55 | |
| *** markvoelker has joined #openstack-meeting-cp | 12:03 | |
| *** markvoelker has quit IRC | 12:25 | |
| *** markvoelker has joined #openstack-meeting-cp | 12:26 | |
| *** MarkBaker has quit IRC | 12:36 | |
| *** gouthamr has joined #openstack-meeting-cp | 12:58 | |
| *** felipemonteiro__ has joined #openstack-meeting-cp | 14:08 | |
| *** felipemonteiro_ has joined #openstack-meeting-cp | 14:11 | |
| *** felipemonteiro__ has quit IRC | 14:14 | |
| *** MarkBaker has joined #openstack-meeting-cp | 14:15 | |
| *** zhipeng has joined #openstack-meeting-cp | 14:17 | |
| *** xyang1 has joined #openstack-meeting-cp | 14:19 | |
| *** zhipeng has quit IRC | 14:22 | |
| *** zhipeng has joined #openstack-meeting-cp | 14:23 | |
| *** MarkBaker has quit IRC | 14:25 | |
| *** MarkBaker has joined #openstack-meeting-cp | 14:30 | |
| *** zhipeng has quit IRC | 14:53 | |
| *** zhipeng has joined #openstack-meeting-cp | 14:53 | |
| *** iyamahat has joined #openstack-meeting-cp | 14:59 | |
| *** blancos has joined #openstack-meeting-cp | 15:12 | |
| *** yamahata has joined #openstack-meeting-cp | 15:15 | |
| *** felipemonteiro_ has quit IRC | 15:18 | |
| *** zhipeng has quit IRC | 15:28 | |
| *** zhipeng has joined #openstack-meeting-cp | 15:28 | |
| *** zhipeng has quit IRC | 15:30 | |
| *** zhipeng has joined #openstack-meeting-cp | 15:31 | |
| *** zhipeng has quit IRC | 15:42 | |
| *** zhipeng has joined #openstack-meeting-cp | 15:43 | |
| *** MarkBaker has quit IRC | 15:47 | |
| *** Rockyg has joined #openstack-meeting-cp | 15:52 | |
| *** nhelgeson has joined #openstack-meeting-cp | 15:53 | |
| *** diablo_rojo has joined #openstack-meeting-cp | 15:58 | |
| *** zhipeng has quit IRC | 15:59 | |
| *** zhipeng has joined #openstack-meeting-cp | 16:00 | |
| lbragstad | #startmeeting policy | 16:00 |
|---|---|---|
| openstack | Meeting started Wed Jul 19 16:00:19 2017 UTC and is due to finish in 60 minutes. The chair is lbragstad. Information about MeetBot at http://wiki.debian.org/MeetBot. | 16:00 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 16:00 |
| *** openstack changes topic to " (Meeting topic: policy)" | 16:00 | |
| openstack | The meeting name has been set to 'policy' | 16:00 |
| lbragstad | ping raildo, ktychkova, rderose, htruta, hrybacki, atrmr, gagehugo, lamt, thinrichs, edmondsw, ruan, ayoung, morgan, raj_singh, johnthetubaguy, knikolla, nhelgeson | 16:00 |
| lbragstad | in case anyone is around | 16:00 |
| *** diablo_rojo has quit IRC | 16:00 | |
| edmondsw | o/ | 16:00 |
| lbragstad | #link https://etherpad.openstack.org/p/keystone-policy-meeting | 16:01 |
| *** gagehugo has joined #openstack-meeting-cp | 16:01 | |
| lbragstad | agenda ^ | 16:01 |
| gagehugo | o/ | 16:01 |
| blancos | o/ | 16:01 |
| lamt | o/ | 16:01 |
| * morgan lurks | 16:01 | |
| *** diablo_rojo has joined #openstack-meeting-cp | 16:01 | |
| lbragstad | alright - let's go ahead and get started | 16:01 |
| lbragstad | #topic open discussion | 16:01 |
| *** openstack changes topic to "open discussion (Meeting topic: policy)" | 16:01 | |
| lbragstad | :) | 16:01 |
| lbragstad | we don't have anything on the agenda - which i think is fine since a lot of folks are focused on finishing up feature work | 16:01 |
| lbragstad | but we can certainly have open discussion | 16:02 |
| edmondsw | I'm seeking another +2 on https://review.openstack.org/#/c/482359/ | 16:02 |
| edmondsw | pretty bad bug we introduced in pike with our policy changes | 16:03 |
| lbragstad | yeah - we should get that into pike for sure | 16:03 |
| lbragstad | (no release note needed) | 16:04 |
| edmondsw | right... it worked before, and it will work again once we get this change merged | 16:04 |
| lbragstad | something else i wanted to run by the group before I start working on it | 16:05 |
| lbragstad | #link https://review.openstack.org/#/c/464763/ | 16:05 |
| lbragstad | ^ so that's the specification for global roles | 16:05 |
| *** felipemonteiro has joined #openstack-meeting-cp | 16:05 | |
| lbragstad | which i have a wip implementation up for | 16:05 |
| *** rarcea has quit IRC | 16:05 | |
| lbragstad | and this question is an implementation detail, but how do we want to denote global scope in the request for a token? | 16:06 |
| lbragstad | anyone have ideas there? | 16:06 |
| *** felipemonteiro_ has joined #openstack-meeting-cp | 16:07 | |
| lbragstad | cc morgan ^ | 16:07 |
| edmondsw | "scope": {"global": True} ? | 16:07 |
| morgan | hm | 16:07 |
| morgan | i don't know if we need to do that | 16:07 |
| lbragstad | edmondsw: yeah - that's was samueldmq said too https://review.openstack.org/#/c/464763/15/specs/keystone/backlog/global-roles.rst | 16:07 |
| morgan | but i'm fine with it | 16:07 |
| edmondsw | morgan why wouldn't we need to? | 16:07 |
| morgan | do we explicitly say we will always have a scope block? | 16:07 |
| morgan | if we don't, we could just omit the scope block | 16:07 |
| edmondsw | morgan no, can't do that... there is a difference between globally-scoped and unscoped | 16:08 |
| morgan | or empty scope = global | 16:08 |
| morgan | no roles = unscoped | 16:08 |
| edmondsw | ? | 16:08 |
| lbragstad | no global roles == unscoped? | 16:08 |
| edmondsw | you don't specify roles on a token request | 16:08 |
| morgan | wait for in the requesT? | 16:08 |
| morgan | oh wait i was thinking in the response | 16:09 |
| lbragstad | morgan: yeah the request | 16:09 |
| morgan | sure we can do global = true | 16:09 |
| morgan | not a huge fan of it, but i can | 16:09 |
| morgan | 't think of a better way | 16:09 |
| edmondsw | same here | 16:09 |
| lbragstad | yeah - i couldn't really either | 16:09 |
| lbragstad | and samueldmq said the same thing | 16:09 |
| lbragstad | it's also pretty consistent with scoping to a domain or project | 16:10 |
| morgan | hm. | 16:10 |
| morgan | i don't like it needing to be explicitly "true" | 16:10 |
| lbragstad | morgan: would you prefer "scope": "global" ? | 16:10 |
| morgan | what happens if you scope: {project: xxxxx, global: true} | 16:10 |
| edmondsw | "scope": {"type": "global"} ? | 16:10 |
| morgan | edmondsw: that would be better | 16:10 |
| lbragstad | morgan: i would say that is a 4XX | 16:11 |
| edmondsw | lbragstad +1 | 16:11 |
| *** felipemonteiro has quit IRC | 16:11 | |
| morgan | actually that more accurately dictates what i want to implement in a more generic auth route | 16:11 |
| lbragstad | that'd be like scoping to a project and a domain at the same time | 16:11 |
| morgan | s/dictates/mirrors | 16:11 |
| morgan | lbragstad: ^ what edmondsw suggested looks way better | 16:11 |
| morgan | type: "global" | 16:11 |
| lbragstad | morgan: ok - so how would we convert that to support projects and domain? | 16:12 |
| lbragstad | you'd have to supply an ID with it | 16:12 |
| morgan | we could support type: project, id: XXXX | 16:12 |
| edmondsw | lbragstad I'm not following | 16:12 |
| edmondsw | just leave projects and domains as they are | 16:12 |
| morgan | but we wouldn't change anything for project/domain scoping today | 16:12 |
| lbragstad | morgan: yeah - project would require another field in the request for the id | 16:12 |
| edmondsw | i.e., type isn't required for them | 16:12 |
| morgan | edmondsw: ++ | 16:12 |
| lbragstad | right | 16:12 |
| morgan | if we do an iteration on auth to move it to /auth (See backlog) we can make type required there | 16:13 |
| lbragstad | it would be a little weird to have the inconsistency - but i do see the reason for it | 16:13 |
| edmondsw | oh, are we talking about the response now? | 16:13 |
| lbragstad | i'm still focused on the request | 16:13 |
| morgan | lbragstad: we could support both mechanisms | 16:13 |
| morgan | and i'd just support it | 16:13 |
| edmondsw | so yeah, no changes to project or domain-scoped requests, I think | 16:13 |
| morgan | type: "project", id: XXX | 16:13 |
| morgan | would be trivial to add it | 16:13 |
| morgan | but not needed | 16:13 |
| * lbragstad grabs an etherpad | 16:14 | |
| morgan | we would continue to support "project: id-xxxxx" | 16:14 |
| lbragstad | #link https://etherpad.openstack.org/p/keystone-global-roles-scratchpaper | 16:14 |
| edmondsw | if you did want to support type: "project" on /auth, you'd still need a project: {} block, not just an id, so it could be a name and domain name, etc. | 16:14 |
| edmondsw | as it is today | 16:14 |
| morgan | lbragstad: so, i think we always accept type | 16:16 |
| morgan | but it's optional for project/domain, | 16:16 |
| morgan | ? | 16:16 |
| morgan | *shrug* | 16:16 |
| edmondsw | yep | 16:16 |
| lbragstad | ok - so the top three are already implemented | 16:17 |
| lbragstad | and we have to support those | 16:17 |
| morgan | really? we support "scoped": "unscoped"?! | 16:18 |
| morgan | *sigh* | 16:18 |
| lbragstad | yeah.... | 16:18 |
| morgan | wow that is terrible | 16:18 |
| edmondsw | ugh | 16:18 |
| morgan | what the hell. | 16:18 |
| edmondsw | I thought unscoped was just not specifying the scope block | 16:18 |
| morgan | when did that creep in? | 16:18 |
| lbragstad | a long time ago | 16:18 |
| lbragstad | i spent a day trying to figure it out | 16:18 |
| edmondsw | can you also just not specify the scope block? | 16:18 |
| lbragstad | edmondsw: right | 16:18 |
| edmondsw | ok, I didn't imagine that, at least | 16:19 |
| morgan | ok so we could do "scope": "global" | 16:19 |
| lbragstad | edmondsw: but not if the user has a default project and a role on that default project | 16:19 |
| morgan | *sobs" | 16:19 |
| edmondsw | oh, default projects... ugh... | 16:19 |
| edmondsw | that's a v2 thing, right? So we can get rid of it soon? | 16:19 |
| morgan | yeah default projects should have died | 16:19 |
| morgan | no | 16:19 |
| morgan | it's also in v3 | 16:19 |
| edmondsw | boo | 16:19 |
| lbragstad | well - kind of | 16:19 |
| morgan | yeah.. lets just... pretend it isn't | 16:19 |
| morgan | for now | 16:19 |
| lbragstad | it's in v3 enough to be a pain | 16:19 |
| edmondsw | lol | 16:19 |
| lbragstad | it's kinda there but not really... | 16:19 |
| lbragstad | it certainly wasn't a clean break | 16:20 |
| edmondsw | keystone v4! with new auth! ;) | 16:20 |
| morgan | edmondsw: actually | 16:20 |
| morgan | v4, no auth in /v4 | 16:20 |
| lbragstad | let's do it | 16:20 |
| edmondsw | morgan that was just to get your reaction :P | 16:20 |
| morgan | and i'm being serious | 16:20 |
| lbragstad | edmondsw: we're already sold on it | 16:20 |
| edmondsw | yeah, I know | 16:21 |
| lbragstad | morgan: i have a post it on my monitor to try and write up what we discussed in atlanta | 16:21 |
| morgan | yeah | 16:21 |
| edmondsw | I guess default projects aren't really part of the auth API, so they could go away in v4? | 16:21 |
| morgan | edmondsw: no, they could be removed in a new auth version | 16:22 |
| * edmondsw thinks this is more like a keystone meeting than a policy meeting | 16:22 | |
| morgan | anyway | 16:22 |
| morgan | there is't much in policy atm to talk about | 16:22 |
| morgan | anyway | 16:22 |
| lbragstad | since it's a major revision - it could go away | 16:22 |
| lbragstad | yeah - this is helpful, i mostly wanted to try and figure out what it would look like for requesting a global token | 16:22 |
| morgan | so lets *not* do scope: global | 16:23 |
| morgan | lets do scope { type: global } | 16:23 |
| morgan | it is *more* consistent | 16:23 |
| lbragstad | if we went the type route eventually - we would need to port the existing project and domain scoping to it | 16:23 |
| morgan | trivial to do so | 16:24 |
| morgan | type supersedes non-specified project block | 16:24 |
| edmondsw | if we have "scope": "unscoped" should we just have "scope": "global" instead of "scope": {"type": "global"} ? | 16:24 |
| morgan | allowing scope { type: project, project: {id: xxx}, domain: {id: yyy}} | 16:24 |
| morgan | and we would support type: unscoped | 16:25 |
| morgan | oh fff. | 16:25 |
| morgan | this is not discoverable | 16:25 |
| morgan | *sigh* | 16:25 |
| morgan | edmondsw: i would prefer to add support for type: unscoped | 16:25 |
| morgan | than more non-dict forms of the scope-key | 16:25 |
| edmondsw | morgan fine by me | 16:25 |
| edmondsw | yeah | 16:26 |
| * morgan notes we need to make this discoverable | 16:26 | |
| morgan | but that is a separate issue. | 16:26 |
| edmondsw | morgan now you have me concerned about how we make this discoverable... | 16:26 |
| lbragstad | morgan: which part specifically isn't discoverable? | 16:26 |
| edmondsw | lbragstad that keystone supports global scoping | 16:27 |
| morgan | ^^ | 16:27 |
| lbragstad | bah | 16:27 |
| lbragstad | we need a GET /auth/scopes | 16:27 |
| lbragstad | endpoint | 16:27 |
| * morgan grabs laptop to wire up /auth as soon as tests for new-filesystem catalog are done | 16:27 | |
| morgan | lbragstad: /auth/ having info for this is probably a good place to start. | 16:28 |
| lbragstad | the first step for making this discoverable would be allowing keystone to answer "what scopes do you support?" | 16:29 |
| lbragstad | right? | 16:29 |
| morgan | yeah | 16:29 |
| morgan | and i don't want to add that to /v3/auth if that makes sense | 16:29 |
| morgan | i mean we can... but i think /v3/auth doesn't actually do anything interesting with a GET right now | 16:30 |
| morgan | and no token | 16:30 |
| morgan | so, i don't want to change that behavior | 16:30 |
| *** blancos_ has joined #openstack-meeting-cp | 16:31 | |
| lbragstad | yeah - that's fine | 16:31 |
| lbragstad | this feels like something we could do with versionless auth | 16:32 |
| lbragstad | or at least start fresh with | 16:32 |
| morgan | yeah | 16:32 |
| lbragstad | morgan: https://github.com/openstack/keystone/blob/025e844fc485c23be1de033473f3cadd7486b642/keystone/auth/core.py#L231-L244 | 16:32 |
| morgan | yeah. | 16:32 |
| lbragstad | morgan: some of the `unscoped` bits bled into https://github.com/openstack/keystone/blob/025e844fc485c23be1de033473f3cadd7486b642/keystone/auth/schema.py#L56-L61 | 16:33 |
| morgan | yep | 16:34 |
| lbragstad | but - that issues pre-existed our jsonschema validation | 16:34 |
| *** david-lyle has quit IRC | 16:34 | |
| lbragstad | which was done in 2014 | 16:34 |
| lbragstad | it's been there a while | 16:34 |
| morgan | yah | 16:34 |
| morgan | anyway | 16:34 |
| lbragstad | ok - so in summary | 16:35 |
| lbragstad | it sounds like if we do global roles and want to scope globally | 16:36 |
| lbragstad | we can do so with "scope": {"type": "global"} | 16:36 |
| lbragstad | which would be inconsistent with the rest of how scope is done | 16:36 |
| lbragstad | but it would be consistent if/when we do versionless auth | 16:36 |
| lbragstad | or - we could do "scope": {"global": "true"} to be more consistent with project and domain scoping | 16:38 |
| *** zhipeng has quit IRC | 16:39 | |
| *** zhipeng has joined #openstack-meeting-cp | 16:39 | |
| morgan | sure. but i don't think a different key matters | 16:40 |
| morgan | in this case | 16:40 |
| morgan | most consistent with current would be "scope": "global" | 16:40 |
| morgan | as much as i hate it | 16:40 |
| lbragstad | ok - so | 16:40 |
| lbragstad | 1.) "scope": {"type": "global"} | 16:40 |
| morgan | and that is just because of prior art for unscoped | 16:41 |
| *** blancos_ has quit IRC | 16:41 | |
| lbragstad | 2.) "scope": {"global": "true"} | 16:41 |
| *** zhipeng has quit IRC | 16:41 | |
| lbragstad | 3.) "scope": "global" | 16:41 |
| *** blancos_ has joined #openstack-meeting-cp | 16:41 | |
| lbragstad | 3 would be the most consistent given the warts with "unscoped" | 16:41 |
| morgan | 4<snark>.) "scope": {"global": {"yes_really": True}} | 16:41 |
| lbragstad | ++ | 16:42 |
| morgan | correct, 3 is most consistent with v3 auth | 16:42 |
| morgan | 2. is most consistent with other "scoped" operations | 16:42 |
| lbragstad | 2 isn't as bad and still offers consistency with project and domain scoping | 16:42 |
| morgan | 1 is the best overall option, but is most inconsistent with v3 auth | 16:42 |
| lbragstad | but the "global": "true" part doesn't really make much sense | 16:42 |
| morgan | so, i vote either 1 or 3 | 16:43 |
| morgan | i don't like 2 at all | 16:43 |
| *** blancos_ has quit IRC | 16:43 | |
| lbragstad | ok | 16:43 |
| * lbragstad votes for #4 | 16:43 | |
| lbragstad | i can detail both options in the spec | 16:43 |
| *** blancos_ has joined #openstack-meeting-cp | 16:43 | |
| morgan | wfm | 16:43 |
| lbragstad | cool - i think that's all I had for open discussion | 16:44 |
| lbragstad | anyone have anything else? | 16:44 |
| lbragstad | alright - looks like we'll get some time back | 16:45 |
| lbragstad | thanks all | 16:45 |
| lbragstad | #endmeeting | 16:45 |
| *** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings" | 16:45 | |
| openstack | Meeting ended Wed Jul 19 16:45:58 2017 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 16:46 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/policy/2017/policy.2017-07-19-16.00.html | 16:46 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/policy/2017/policy.2017-07-19-16.00.txt | 16:46 |
| *** blancos_ has quit IRC | 16:46 | |
| openstack | Log: http://eavesdrop.openstack.org/meetings/policy/2017/policy.2017-07-19-16.00.log.html | 16:46 |
| *** gagehugo has left #openstack-meeting-cp | 16:50 | |
| *** david-lyle has joined #openstack-meeting-cp | 16:52 | |
| *** blancos has left #openstack-meeting-cp | 17:19 | |
| *** harlowja has joined #openstack-meeting-cp | 17:25 | |
| *** harlowja has quit IRC | 17:25 | |
| *** harlowja has joined #openstack-meeting-cp | 17:26 | |
| *** Rockyg has quit IRC | 17:54 | |
| *** yamahata has quit IRC | 17:54 | |
| *** iyamahat has quit IRC | 17:54 | |
| *** iyamahat has joined #openstack-meeting-cp | 18:12 | |
| *** yamahata has joined #openstack-meeting-cp | 18:31 | |
| *** u_nuSLASHkm8 has joined #openstack-meeting-cp | 18:33 | |
| *** u_nuSLASHkm8 has quit IRC | 18:33 | |
| *** kbyrne has quit IRC | 19:22 | |
| *** kbyrne has joined #openstack-meeting-cp | 19:25 | |
| *** tinyurl_comSLASH has joined #openstack-meeting-cp | 19:44 | |
| *** MarkBaker has joined #openstack-meeting-cp | 19:45 | |
| *** tinyurl_comSLASH has left #openstack-meeting-cp | 19:47 | |
| *** coolsvap has quit IRC | 19:51 | |
| *** MarkBaker has quit IRC | 20:00 | |
| *** MarkBaker has joined #openstack-meeting-cp | 21:11 | |
| *** gouthamr has quit IRC | 21:49 | |
| *** felipemonteiro_ has quit IRC | 22:15 | |
| *** gouthamr has joined #openstack-meeting-cp | 22:18 | |
| *** sdague has quit IRC | 22:33 | |
| *** edmondsw has quit IRC | 22:40 | |
| *** MarkBaker has quit IRC | 23:13 | |
| *** MarkBaker has joined #openstack-meeting-cp | 23:24 | |
| *** edmondsw has joined #openstack-meeting-cp | 23:59 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!