| *** harlowja has joined #openstack-meeting-cp | 00:03 | |
| *** harlowja has quit IRC | 00:09 | |
| *** harlowja has joined #openstack-meeting-cp | 00:14 | |
| *** edmondsw has joined #openstack-meeting-cp | 00:19 | |
| *** edmondsw has quit IRC | 00:24 | |
| *** gouthamr has quit IRC | 00:45 | |
| *** aselius has quit IRC | 00:47 | |
| *** gouthamr has joined #openstack-meeting-cp | 00:49 | |
| *** harlowja has quit IRC | 00:57 | |
| *** harlowja has joined #openstack-meeting-cp | 01:01 | |
| *** scottda_ has quit IRC | 01:24 | |
| *** markvoelker has joined #openstack-meeting-cp | 01:43 | |
| *** edmondsw has joined #openstack-meeting-cp | 01:58 | |
| *** edmondsw has quit IRC | 02:02 | |
| *** yamahata has quit IRC | 02:14 | |
| *** iyamahat has quit IRC | 02:16 | |
| *** markvoelker has quit IRC | 02:18 | |
| *** markvoelker has joined #openstack-meeting-cp | 03:15 | |
| *** nhelgeson has quit IRC | 03:21 | |
| *** coolsvap has joined #openstack-meeting-cp | 03:30 | |
| *** iyamahat has joined #openstack-meeting-cp | 03:41 | |
| *** gouthamr has quit IRC | 03:46 | |
| *** edmondsw has joined #openstack-meeting-cp | 03:46 | |
| *** markvoelker has quit IRC | 03:48 | |
| *** edmondsw has quit IRC | 03:51 | |
| *** iyamahat has quit IRC | 03:58 | |
| *** iyamahat has joined #openstack-meeting-cp | 04:03 | |
| *** iyamahat has quit IRC | 04:05 | |
| *** markvoelker has joined #openstack-meeting-cp | 04:45 | |
| *** iyamahat has joined #openstack-meeting-cp | 04:53 | |
| *** iyamahat has quit IRC | 04:54 | |
| *** iyamahat has joined #openstack-meeting-cp | 04:54 | |
| *** iyamahat has quit IRC | 05:01 | |
| *** iyamahat has joined #openstack-meeting-cp | 05:02 | |
| *** iyamahat_ has joined #openstack-meeting-cp | 05:05 | |
| *** iyamahat_ has quit IRC | 05:05 | |
| *** iyamahat has quit IRC | 05:09 | |
| *** markvoelker has quit IRC | 05:18 | |
| *** yamahata has joined #openstack-meeting-cp | 05:39 | |
| *** iyamahat has joined #openstack-meeting-cp | 05:43 | |
| *** iyamahat has quit IRC | 05:44 | |
| *** iyamahat has joined #openstack-meeting-cp | 05:44 | |
| *** iyamahat_ has joined #openstack-meeting-cp | 05:47 | |
| *** yamahata has quit IRC | 05:48 | |
| *** iyamahat__ has joined #openstack-meeting-cp | 05:49 | |
| *** iyamahat has quit IRC | 05:49 | |
| *** iyamahat_ has quit IRC | 05:52 | |
| *** yamahata has joined #openstack-meeting-cp | 05:53 | |
| *** iyamahat__ has quit IRC | 05:56 | |
| *** iyamahat has joined #openstack-meeting-cp | 05:57 | |
| *** iyamahat has quit IRC | 06:00 | |
| *** iyamahat has joined #openstack-meeting-cp | 06:00 | |
| *** yamahata has quit IRC | 06:03 | |
| *** yamahata has joined #openstack-meeting-cp | 06:17 | |
| *** MarkBaker has quit IRC | 07:04 | |
| *** iyamahat has quit IRC | 07:07 | |
| *** markvoelker has joined #openstack-meeting-cp | 07:15 | |
| *** edmondsw has joined #openstack-meeting-cp | 07:22 | |
| *** edmondsw has quit IRC | 07:26 | |
| *** markvoelker has quit IRC | 07:49 | |
| *** edmondsw has joined #openstack-meeting-cp | 08:03 | |
| *** MarkBaker has joined #openstack-meeting-cp | 08:31 | |
| *** iyamahat has joined #openstack-meeting-cp | 08:32 | |
| *** yamahata has quit IRC | 08:38 | |
| *** MarkBaker has quit IRC | 08:44 | |
| *** markvoelker has joined #openstack-meeting-cp | 08:46 | |
| *** MarkBaker has joined #openstack-meeting-cp | 08:56 | |
| *** iyamahat has quit IRC | 09:06 | |
| *** markvoelker has quit IRC | 09:19 | |
| *** MarkBaker has quit IRC | 09:40 | |
| *** sdague has joined #openstack-meeting-cp | 09:53 | |
| *** amrith has quit IRC | 10:02 | |
| *** amrith has joined #openstack-meeting-cp | 10:12 | |
| *** amrith is now known as Guest57559 | 10:12 | |
| *** Guest57559 is now known as amrith | 10:12 | |
| *** edmondsw has quit IRC | 10:13 | |
| *** markvoelker has joined #openstack-meeting-cp | 10:17 | |
| *** markvoelker has quit IRC | 10:49 | |
| *** kbyrne has quit IRC | 11:38 | |
| *** markvoelker has joined #openstack-meeting-cp | 11:46 | |
| *** kbyrne has joined #openstack-meeting-cp | 11:46 | |
| *** edmondsw has joined #openstack-meeting-cp | 12:10 | |
| *** edmondsw has quit IRC | 12:11 | |
| *** edmondsw has joined #openstack-meeting-cp | 12:11 | |
| *** markvoelker has quit IRC | 12:20 | |
| *** markvoelker has joined #openstack-meeting-cp | 12:28 | |
| *** scottda_ has joined #openstack-meeting-cp | 12:49 | |
| *** xyang1 has joined #openstack-meeting-cp | 13:05 | |
| *** david-lyle has quit IRC | 13:09 | |
| *** david-lyle has joined #openstack-meeting-cp | 13:09 | |
| *** gouthamr has joined #openstack-meeting-cp | 13:14 | |
| *** rarcea has joined #openstack-meeting-cp | 14:12 | |
| *** yamahata has joined #openstack-meeting-cp | 14:15 | |
| *** ayoung has joined #openstack-meeting-cp | 15:01 | |
| ayoung | Heyo! | 15:02 |
|---|---|---|
| *** felipemonteiro has joined #openstack-meeting-cp | 15:03 | |
| *** felipemonteiro_ has joined #openstack-meeting-cp | 15:05 | |
| *** felipemonteiro has quit IRC | 15:08 | |
| *** david-lyle has quit IRC | 15:10 | |
| *** david-lyle has joined #openstack-meeting-cp | 15:15 | |
| *** amrith has quit IRC | 15:28 | |
| *** amrith has joined #openstack-meeting-cp | 15:28 | |
| *** amrith is now known as Guest55601 | 15:28 | |
| *** gagehugo has joined #openstack-meeting-cp | 15:29 | |
| *** felipemonteiro__ has joined #openstack-meeting-cp | 15:38 | |
| *** felipemonteiro_ has quit IRC | 15:41 | |
| *** felipemonteiro_ has joined #openstack-meeting-cp | 15:43 | |
| *** felipemonteiro__ has quit IRC | 15:46 | |
| *** iyamahat has joined #openstack-meeting-cp | 15:52 | |
| hrybacki | ayoung: I think you might have been an hour early | 15:56 |
| hrybacki | :P | 15:56 |
| ayoung | yep | 15:56 |
| ayoung | hrybacki, I confirmed that with lbragstad. Had it on my calendar from pre-DST change | 15:57 |
| hrybacki | silly DST | 15:57 |
| lbragstad | ping raildo, ktychkova, rderose, htruta, hrybacki, atrmr, gagehugo, lamt, thinrichs, edmondsw, ruan_he, ayoung, morgan, raj_singh, johnthetubaguy, knikolla, nhelgeson | 15:59 |
| hrybacki | o/ | 15:59 |
| ayoung | Oyez | 15:59 |
| knikolla | o/ | 15:59 |
| gagehugo | o/ | 15:59 |
| *** blancos has joined #openstack-meeting-cp | 15:59 | |
| cmurphy | o/ | 16:00 |
| lbragstad | #startmeeting policy | 16:00 |
| openstack | Meeting started Wed Sep 6 16:00:08 2017 UTC and is due to finish in 60 minutes. The chair is lbragstad. Information about MeetBot at http://wiki.debian.org/MeetBot. | 16:00 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 16:00 |
| *** openstack changes topic to " (Meeting topic: policy)" | 16:00 | |
| openstack | The meeting name has been set to 'policy' | 16:00 |
| lbragstad | #link https://etherpad.openstack.org/p/keystone-policy-meeting | 16:00 |
| lbragstad | agenda ^ | 16:00 |
| lbragstad | it's a little light today - but i assume everyone is getting ready for the ptg or wrapping other things up | 16:00 |
| lbragstad | #topic policy-and-docs-in-code community goal | 16:01 |
| *** openstack changes topic to "policy-and-docs-in-code community goal (Meeting topic: policy)" | 16:01 | |
| lbragstad | quick update here | 16:01 |
| blancos | o/ | 16:01 |
| lbragstad | I spent yesterday working through the projects that don't appear to be impacted by the goal | 16:01 |
| ayoung | What guidance are we providing with regard to role names to projects that are doing this? | 16:01 |
| lbragstad | and i proposed patches to governance to update those accordingly | 16:01 |
| *** Rockyg has joined #openstack-meeting-cp | 16:01 | |
| *** aselius has joined #openstack-meeting-cp | 16:02 | |
| lbragstad | ayoung: we're not - we're just ensuring they move what they have in code | 16:02 |
| lbragstad | we not requiring renames or refactoring | 16:02 |
| ayoung | Does that mean the role enforcement will be in code? | 16:02 |
| lbragstad | but.. that's a good question | 16:02 |
| ayoung | admin? | 16:02 |
| lbragstad | role enforcement will be done by the oslo.policy enforce object, like it always has | 16:03 |
| ayoung | It would be best if they could tag an API as "admin" without hardcoding what that means | 16:03 |
| lbragstad | yeah | 16:03 |
| lbragstad | i also have these | 16:03 |
| lbragstad | #link https://review.openstack.org/#/c/500141/ | 16:03 |
| lbragstad | #link https://review.openstack.org/#/c/500207/ | 16:03 |
| ayoung | something like "default the admin_required rule to mean role:admin" but not codify that on each line of the policy enforcement | 16:03 |
| lbragstad | that seems specifically related to https://review.openstack.org/#/c/500141/ | 16:04 |
| ayoung | They should be able to add a single rule, even maybe in a config file, that specifies just how to do admin at both cloud and project scope | 16:04 |
| *** david-lyle has quit IRC | 16:04 | |
| *** dklyle has joined #openstack-meeting-cp | 16:04 | |
| edmondsw | o/ | 16:05 |
| ayoung | Actually, that would be a really valuable first step; each of the projects should identify on a per-api basis which of scope of admin they mean: global or project scoped | 16:06 |
| lbragstad | yeah | 16:06 |
| ayoung | even if the default implementation does not distinguish, lets future proof them at that level | 16:06 |
| lbragstad | i completely agree | 16:06 |
| edmondsw | with global roles, scope is no longer a policy thing at all | 16:06 |
| lbragstad | ayoung: you're talking about https://review.openstack.org/#/c/500207/1/specs/queens/include-scope-in-policy.rst right? | 16:07 |
| ayoung | I tjhink so...loooking | 16:07 |
| lbragstad | yeah - it'd be awesome to get that functionality into oslo this release somehow | 16:08 |
| lbragstad | that way projects that have policy in code can start implementing it | 16:08 |
| * edmondsw adds that to his reading list | 16:08 | |
| lbragstad | edmondsw: #link https://review.openstack.org/#/c/500141/ too | 16:08 |
| ayoung | edmondsw, lets use the terminology that Global IS a scope. | 16:08 |
| ayoung | or Cloud or even service scope, to distinguish from project scope | 16:08 |
| lbragstad | something elevated above project | 16:09 |
| edmondsw | definitely | 16:09 |
| *** nhelgeson has joined #openstack-meeting-cp | 16:09 | |
| ayoung | the only operations we consider "unscoped" are on the Keystone server itself. And unscoped token should not be accepted by a remote service | 16:09 |
| lbragstad | right | 16:09 |
| ayoung | and an unscoped token should probable not have global roles on it | 16:09 |
| edmondsw | agreed | 16:09 |
| ayoung | but that is getting ahead of the discussion | 16:09 |
| *** iyamahat has quit IRC | 16:10 | |
| edmondsw | unscoped tokens shouldn't have roles or any kind | 16:10 |
| edmondsw | s/or/of/ | 16:10 |
| ayoung | Cool. So we will talk about tokens scoped to one of three things: domain, project, or global? | 16:10 |
| edmondsw | yep | 16:10 |
| ayoung | cool. please continue lbragstad | 16:10 |
| lbragstad | correct - the piece that the oslo spec helps projects align operations with those scopes | 16:11 |
| lbragstad | helps with* | 16:11 |
| *** yamahata has quit IRC | 16:11 | |
| lbragstad | so - if anyone has feedback on either of those oslo specs, i'd love to hear it | 16:11 |
| lbragstad | we're also on the schedule to visit with the oslo folks at the ptg about it | 16:12 |
| ayoung | can we provide example rules in them? | 16:12 |
| lbragstad | #link https://etherpad.openstack.org/p/oslo-ptg-queens | 16:12 |
| ayoung | and we should probably standardize what we mean by "owner" | 16:12 |
| edmondsw | I like the use cases for include-scope-in-policy at any rate... will read more later | 16:13 |
| lbragstad | i would imagine that to be a conversations with a larger group, just to make sure we level set on consistent terms and don't assume owner means the same thing everywhere | 16:13 |
| edmondsw | "owner" definitely doesn't mean the same thing everywhere :) | 16:13 |
| lbragstad | i'd need to dig into other projects and how they use owner | 16:13 |
| ayoung | we should also encourage them to not have ADMIN_OR... in the rule names, as admin is an override, and should be able to do anything. | 16:13 |
| edmondsw | ++ | 16:13 |
| lbragstad | or i can just take edmondsw's word for it :) | 16:14 |
| ayoung | I would suspect that for most places they use "owner" to mean "member of project with write permissions" | 16:14 |
| edmondsw | in some places owner is a user, in others it's a project | 16:14 |
| lbragstad | so - really quick on the policy in code stuff/communtiy goal | 16:14 |
| lbragstad | it also built a version of dhellmann's burndown chart to track that work | 16:14 |
| lbragstad | #link https://www.lbragstad.com/policy-burndown/ | 16:14 |
| edmondsw | ayoung drop the "with write permissions" | 16:14 |
| lbragstad | that should publish new results twice a day | 16:15 |
| ayoung | edmondsw, I would actually like it if they distinguished at the API level whether read/write is expected | 16:15 |
| hrybacki | lbragstad++ | 16:15 |
| *** dklyle has quit IRC | 16:15 | |
| ayoung | I think that is the heart of what you mean? | 16:15 |
| ayoung | Member implies Write and Read | 16:16 |
| edmondsw | ayoung I just meant that "owner" is sometimes used for read as well as write, I believe... nothing really write-specific about it | 16:16 |
| ayoung | yeah, I figured that is what you meant | 16:16 |
| ayoung | I tend to think of permissions in a DAG, so write kindof implies read, but Member definintely implies read and write | 16:17 |
| edmondsw | ayoung but if I followed your comment about distinguishing, yeah, docs for each policy should definitely be clear as to whether it is a read or write operations (and more) | 16:17 |
| ayoung | really, we have admin+red+write as one set and member+read+write as a second. | 16:17 |
| *** david-lyle has joined #openstack-meeting-cp | 16:18 | |
| ayoung | as the read-only role people are asking for might need to read info that a Member should not read. | 16:18 |
| ayoung | what if we provided a default set of Rules and suggest to the projects that they implement them. | 16:19 |
| edmondsw | there is an odd case with nova ssh keys that we'll have to be conscious of here... in that case, I believe the user to which the key belongs can do things that even admin can't... i.e. admin isn't a true superset | 16:19 |
| ayoung | ADMIN_WRITE, ADMIN_READ, MEMBER_WRITE, MEMBER_READ. | 16:19 |
| ayoung | edmondsw, yes | 16:19 |
| ayoung | and that should be OWNER | 16:19 |
| ayoung | or USER? | 16:20 |
| edmondsw | :) | 16:20 |
| ayoung | something that indicates permission is at the per-user level. | 16:20 |
| ayoung | OWNER_READ: Get my Keys. | 16:20 |
| edmondsw | owner has been overloaded too much... I'd prefer we be clearer and say user if that's what is meant | 16:20 |
| ayoung | edmondsw, ++ | 16:20 |
| ayoung | USER: user_id=target.user_id or trustee_id=target.user_id | 16:21 |
| ayoung | Ugh | 16:22 |
| ayoung | no way to scope those operations in a trust | 16:22 |
| ayoung | would need to user impersonation today | 16:22 |
| ayoung | yuck | 16:22 |
| ayoung | OK, lbragstad which of those two specs do you want me to add the suggested rules to? | 16:23 |
| lbragstad | well - the one is specific to deprecating policies, so probably not that one | 16:23 |
| lbragstad | other other is for adding scope | 16:23 |
| * knikolla needs to go. but will read the log. | 16:23 | |
| lbragstad | which is probably closer to what you're thinking? | 16:23 |
| lbragstad | ayoung: if not, we can break it off into it's own spec, too | 16:24 |
| edmondsw | I'd have said separate spec, I think | 16:24 |
| lbragstad | ok | 16:24 |
| ayoung | well, it ties in with scope, though | 16:24 |
| edmondsw | yeah, maybe that one... I haven't read it yet :) | 16:24 |
| edmondsw | sure, throw it in there... we can always pull it out if need be | 16:25 |
| edmondsw | does seem like it might fit there | 16:25 |
| lbragstad | #topic open discussion | 16:26 |
| *** openstack changes topic to "open discussion (Meeting topic: policy)" | 16:26 | |
| lbragstad | anything else we want to cover today? | 16:27 |
| edmondsw | none from me | 16:28 |
| lbragstad | cool | 16:28 |
| lbragstad | looks like we can get some time back | 16:28 |
| lbragstad | reminder we won't have a meeting next week because of the PTG | 16:29 |
| lbragstad | if you're going to be there, travel safe! | 16:29 |
| edmondsw | ++ | 16:29 |
| lbragstad | thanks for coming! | 16:29 |
| lbragstad | #endmeeting | 16:29 |
| *** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings" | 16:29 | |
| openstack | Meeting ended Wed Sep 6 16:29:32 2017 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 16:29 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/policy/2017/policy.2017-09-06-16.00.html | 16:29 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/policy/2017/policy.2017-09-06-16.00.txt | 16:29 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/policy/2017/policy.2017-09-06-16.00.log.html | 16:29 |
| *** blancos has quit IRC | 16:29 | |
| *** felipemonteiro__ has joined #openstack-meeting-cp | 16:30 | |
| *** felipemonteiro__ has quit IRC | 16:33 | |
| *** felipemonteiro__ has joined #openstack-meeting-cp | 16:33 | |
| *** iyamahat has joined #openstack-meeting-cp | 16:34 | |
| *** felipemonteiro_ has quit IRC | 16:34 | |
| *** felipemonteiro_ has joined #openstack-meeting-cp | 16:50 | |
| *** felipemonteiro__ has quit IRC | 16:54 | |
| *** harlowja has quit IRC | 17:07 | |
| *** harlowja has joined #openstack-meeting-cp | 17:07 | |
| *** felipemonteiro_ has quit IRC | 17:08 | |
| *** felipemonteiro_ has joined #openstack-meeting-cp | 17:09 | |
| *** felipemonteiro__ has joined #openstack-meeting-cp | 17:11 | |
| *** rarcea has quit IRC | 17:12 | |
| *** felipemonteiro_ has quit IRC | 17:14 | |
| *** Rockyg has quit IRC | 17:25 | |
| *** diablo_rojo has quit IRC | 17:29 | |
| *** yamahata has joined #openstack-meeting-cp | 17:31 | |
| *** gagehugo has left #openstack-meeting-cp | 17:44 | |
| *** Guest55601 is now known as amrith | 17:52 | |
| *** coolsvap has quit IRC | 17:54 | |
| *** harlowja has quit IRC | 18:02 | |
| *** lbragstad has quit IRC | 19:43 | |
| *** lbragstad has joined #openstack-meeting-cp | 19:45 | |
| *** felipemonteiro_ has joined #openstack-meeting-cp | 20:09 | |
| *** felipemonteiro__ has quit IRC | 20:12 | |
| *** gouthamr has quit IRC | 21:15 | |
| *** harlowja has joined #openstack-meeting-cp | 21:45 | |
| *** edmondsw has quit IRC | 21:52 | |
| *** xyang1 has quit IRC | 22:09 | |
| *** edmondsw has joined #openstack-meeting-cp | 22:23 | |
| *** edmondsw has quit IRC | 22:28 | |
| *** gouthamr has joined #openstack-meeting-cp | 22:54 | |
| *** scottda_ has quit IRC | 23:00 | |
| *** felipemonteiro_ has quit IRC | 23:01 | |
| *** felipemonteiro has joined #openstack-meeting-cp | 23:09 | |
| *** kbyrne has quit IRC | 23:38 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!