| *** tbachman is now known as Guest7179 | 00:21 | |
| *** tbachman is now known as Guest7182 | 02:05 | |
| *** bhagyashris_ is now known as bhagyashris | 08:42 | |
| opendevreview | Balazs Gibizer proposed openstack/placement master: DNM: check if doc build is broken on master https://review.opendev.org/c/openstack/placement/+/819766 | 08:51 |
|---|---|---|
| opendevreview | Tobias Urdin proposed openstack/nova master: libvirt: Add announce-self post live-migration workaround https://review.opendev.org/c/openstack/nova/+/741529 | 08:59 |
| opendevreview | Balazs Gibizer proposed openstack/placement master: Add yoga spec directory https://review.opendev.org/c/openstack/placement/+/819660 | 09:51 |
| opendevreview | Balazs Gibizer proposed openstack/placement master: Spec: support any trait in allocation candidates https://review.opendev.org/c/openstack/placement/+/649992 | 09:51 |
| opendevreview | Balazs Gibizer proposed openstack/placement master: Spec: support mixing required traits with any traits https://review.opendev.org/c/openstack/placement/+/649368 | 09:51 |
| qiujunting | sean-k-mooney | 11:07 |
| qiujunting | hi | 11:07 |
| qiujunting | can you help me. review this commit about pmem spec:https://review.opendev.org/c/openstack/nova/+/802225 | 11:08 |
| *** tbachman is now known as Guest7218 | 11:55 | |
| opendevreview | Balazs Gibizer proposed openstack/nova master: Log which instance event was timed out https://review.opendev.org/c/openstack/nova/+/819817 | 13:03 |
| opendevreview | Elod Illes proposed openstack/nova stable/wallaby: Ensure MAC addresses characters are in the same case https://review.opendev.org/c/openstack/nova/+/816883 | 13:48 |
| bauzas | gibi: thanks for creating the yoga specs directory for placement, I forgot about it | 14:13 |
| gibi | bauzas: I'm still failing to make it right :D | 14:13 |
| gibi | doc generation is hard :/ | 14:14 |
| bauzas | yeah I saw it | 14:14 |
| gibi | the extra pain is that locally I have pip dependency issue with the doc generation tox target | 14:16 |
| opendevreview | Balazs Gibizer proposed openstack/placement master: Add yoga spec directory https://review.opendev.org/c/openstack/placement/+/819660 | 14:17 |
| opendevreview | Balazs Gibizer proposed openstack/placement master: Spec: support any trait in allocation candidates https://review.opendev.org/c/openstack/placement/+/649992 | 14:17 |
| opendevreview | Balazs Gibizer proposed openstack/placement master: Spec: support mixing required traits with any traits https://review.opendev.org/c/openstack/placement/+/649368 | 14:17 |
| gibi | here is the next stab for it :) | 14:17 |
| gibi | bauzas: btw I did it becuase I reheated two of my old specs for placement :) | 14:21 |
| bauzas | I saw iy | 14:21 |
| elodilles | bauzas: not so much things to add to 'stable branches' section of novameetings, but let me know when i can update that | 14:31 |
| bauzas | elodilles: just do it (c) | 14:32 |
| bauzas | elodilles: and I'll update after you | 14:32 |
| elodilles | bauzas: ack :] | 14:33 |
| elodilles | bauzas: done | 14:36 |
| *** tbachman is now known as Guest7224 | 14:37 | |
| *** tbachman is now known as Guest7227 | 15:06 | |
| bauzas | in case people have other opinions about this wontfix... https://bugs.launchpad.net/nova/+bug/1951983 | 15:19 |
| bauzas | also, super weirdo bug https://bugs.launchpad.net/nova/+bug/1951169 | 15:22 |
| bauzas | placement cores, easy peasy for adding specs to yoga https://review.opendev.org/c/openstack/placement/+/819660 | 15:26 |
| bauzas | also, reminder: nova meeting in 33 mins here at #openstack-nova | 15:27 |
| gibi | bauzas: agree about https://bugs.launchpad.net/nova/+bug/1951983 until somebody proposes a better regexp it is simply a wontfix | 15:27 |
| bauzas | cool thanks | 15:27 |
| bauzas | last reminder: nova meeting in 7 mins here | 15:53 |
| * gibi is reminded :) | 15:58 | |
| bauzas | #startmeeting nova | 16:00 |
| opendevmeet | Meeting started Tue Nov 30 16:00:00 2021 UTC and is due to finish in 60 minutes. The chair is bauzas. Information about MeetBot at http://wiki.debian.org/MeetBot. | 16:00 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 16:00 |
| opendevmeet | The meeting name has been set to 'nova' | 16:00 |
| bauzas | #link https://wiki.openstack.org/wiki/Meetings/Nova#Agenda_for_next_meeting | 16:00 |
| bauzas | good 'day, 'vyone | 16:00 |
| gibi | \o | 16:00 |
| ganso | o/ | 16:00 |
| elodilles | o/ | 16:00 |
| bauzas | okay, let's statry | 16:01 |
| * bauzas shouldn't wear mittens when typing | 16:02 | |
| bauzas | #topic Bugs (stuck/critical) | 16:02 |
| bauzas | #info No Critical bug | 16:02 |
| bauzas | #link https://bugs.launchpad.net/nova/+bugs?search=Search&field.status=New 23 new untriaged bugs (-6 since the last meeting) | 16:02 |
| bauzas | thanks to all who helped | 16:02 |
| bauzas | #help Nova bug triage help is appreciated https://wiki.openstack.org/wiki/Nova/BugTriage | 16:03 |
| bauzas | #link https://storyboard.openstack.org/#!/project/openstack/placement 25 open stories (-8 since the last meeting) in Storyboard for Placement | 16:03 |
| bauzas | ditto ^ | 16:03 |
| bauzas | impressive number | 16:03 |
| bauzas | I know the names :p | 16:04 |
| dansmith | o/ | 16:04 |
| bauzas | any particular bug to discuss before we move to the next topic ? | 16:04 |
| bauzas | I guess no | 16:05 |
| bauzas | #topic Gate status | 16:05 |
| bauzas | #link https://bugs.launchpad.net/nova/+bugs?field.tag=gate-failure Nova gate bugs | 16:05 |
| bauzas | no new gate bug I can see | 16:05 |
| bauzas | #link https://zuul.openstack.org/builds?project=openstack%2Fplacement&pipeline=periodic-weekly Placement periodic job status | 16:05 |
| bauzas | the issue we discussed last week is fixed ^ | 16:06 |
| bauzas | #info Please look at the gate failures, file a bug, and add an elastic-recheck signature in the opendev/elastic-recheck repo (example: https://review.opendev.org/#/c/759967) | 16:06 |
| bauzas | fwiw, I haven't see any specific issue with our gate | 16:06 |
| gibi | bauzas: the issue is not fixed it just did not appear in the recent runs | 16:07 |
| bauzas | ah right, it was a race | 16:07 |
| gibi | I don't know about any active effor on our side making that fixed | 16:07 |
| gibi | it was about the pmlogger service | 16:07 |
| bauzas | right | 16:07 |
| bauzas | ok, nothing else to tell ? | 16:08 |
| bauzas | #topic Release Planning | 16:08 |
| bauzas | #info Yoga-2 is due Jan 6th#link https://releases.openstack.org/yoga/schedule.html#y-2 | 16:09 |
| bauzas | #undo | 16:09 |
| opendevmeet | Removing item from minutes: #info Yoga-2 is due Jan 6th#link https://releases.openstack.org/yoga/schedule.html#y-2 | 16:09 |
| bauzas | #info Yoga-2 is due Jan 6th | 16:09 |
| bauzas | #link https://releases.openstack.org/yoga/schedule.html#y-2 | 16:09 |
| bauzas | #info Next spec review day to be planned for mid-Dec | 16:09 |
| bauzas | so, | 16:09 |
| bauzas | what do you think about Dec 14th for a new spec review day ? | 16:10 |
| bauzas | the next week, I'll be off | 16:10 |
| sean-k-mooney | +1 for 14th | 16:10 |
| gibi | 14th works for me | 16:10 |
| bauzas | we have a few open specs | 16:10 |
| gibi | I'm off from the 20th | 16:10 |
| bauzas | gibi: maybe like me | 16:11 |
| bauzas | maybe I'll work on the Dec 22th day | 16:11 |
| bauzas | but... | 16:11 |
| bauzas | I'm not sure we would have quorum | 16:11 |
| bauzas | ok, any other thought? | 16:12 |
| bauzas | #agreed Next spec review day will be Tuesday Dec 14th | 16:13 |
| gibi | I will not be around in the week of Yoga-2 | 16:13 |
| bauzas | I'll provide a new ML email | 16:13 |
| gibi | I will be back on the 10th of Jan | 16:13 |
| bauzas | gibi: oh, you're now living in France ? | 16:13 |
| bauzas | :p | 16:13 |
| gibi | I've just checked, no :D | 16:14 |
| bauzas | anyway, no worries | 16:14 |
| bauzas | we will only have the spec deadline for yoga-2 | 16:14 |
| gibi | I have two placement specs to get approved :) | 16:15 |
| bauzas | I've seen them :p | 16:15 |
| bauzas | anyway, moving on | 16:15 |
| bauzas | #topic Review priorities | 16:16 |
| bauzas | #link https://review.opendev.org/q/status:open+(project:openstack/nova+OR+project:openstack/placement)+label:Review-Priority%252B1 | 16:16 |
| bauzas | #link https://review.opendev.org/c/openstack/nova/+/816861 bauzas proposing a documentation change for helping contributors to ask for reviews | 16:16 |
| bauzas | I'm afraid I didn't had time to modify it | 16:16 |
| bauzas | nothing to discuss then for this week | 16:16 |
| bauzas | unless people want to have review priorities ? | 16:17 |
| bauzas | fwiw, my main priority will be unified limits reviews | 16:17 |
| bauzas | OK, next topic | 16:18 |
| bauzas | #topic Stable Branches | 16:18 |
| bauzas | I'm sitting down, listening to elodilles | 16:18 |
| elodilles | #info stable gates are OK | 16:18 |
| elodilles | stable/xena has ~3 merged bug fixes, maybe we can wait some more bug fix to land before we do a release | 16:19 |
| elodilles | and that's it | 16:19 |
| bauzas | I was triaging a bug related to the compute service delete issue, and I saw we hadn't yet merged https://review.opendev.org/c/openstack/nova/+/802847 | 16:20 |
| *** whoami-rajat__ is now known as whoami-rajat | 16:20 | |
| bauzas | I'll look at other backports that are fixing bad bugs, and I'll try to review them | 16:20 |
| elodilles | thanks in advance \o/ | 16:21 |
| bauzas | well, no problem | 16:22 |
| bauzas | moving on | 16:22 |
| bauzas | #topic Sub/related team Highlights | 16:22 |
| bauzas | Libvirt :lyarwood ? | 16:22 |
| lyarwood | Nothing from me | 16:22 |
| bauzas | cool | 16:22 |
| bauzas | #topic Open discussion | 16:22 |
| bauzas | (gmann) Specless BP approval request for RBAC community-wide goal | 16:22 |
| bauzas | #link https://blueprints.launchpad.net/nova/+spec/policy-defaults-refresh-2 | 16:23 |
| bauzas | gmann: around ? | 16:23 |
| dansmith | I am, if you have questions | 16:23 |
| bauzas | honestly, I don't think I have any concerns | 16:24 |
| dansmith | I've been working on a patch to get servers back to the place where we want it, | 16:24 |
| bauzas | maybe one about upgrades and what it means for operators that were modifying the policies | 16:24 |
| dansmith | as an example people can work from | 16:24 |
| dansmith | and it's very close | 16:24 |
| bauzas | but this is just changing the defaults | 16:24 |
| dansmith | gmann and johnthetubaguy[m] are mostly happy I think, just working out one more functional thing | 16:24 |
| dansmith | bauzas: well, this is pretty much all about defaults anyway, | 16:25 |
| dansmith | and nobody could really have rolled to the new ones yet anyway, so not an upgrade concern, IMHO | 16:25 |
| dansmith | but the revised plan involves less change when they do upgrade | 16:25 |
| bauzas | dansmith: I guess you're referring to https://review.opendev.org/c/openstack/governance/+/815158/20/goals/proposed/consistent-and-secure-rbac.rst as the revised plan ? | 16:26 |
| dansmith | yep | 16:26 |
| bauzas | ok, | 16:27 |
| bauzas | this plan isn't yet sold but whatever it will be, nothing will really change from nova | 16:27 |
| dansmith | well, things have to change in nova of course, | 16:28 |
| bauzas | so as you said, I don't think there is any upgrade concern then | 16:28 |
| bauzas | nothing will really change from a nova perspective if you prefer | 16:28 |
| dansmith | but mostly just undoing some of the proposed stuff that hasn't been able to be realized yet.. stepping back from some of that stuff that we merged proactively | 16:28 |
| bauzas | things have to change, but upgrades aren't a concern either way | 16:28 |
| dansmith | much less of a concern than what they were, but of the stuff we're keeping, no real change, yeah | 16:29 |
| dansmith | and keystone will go first which will help our upgrade be even less impactful than it was going to be, if we ever got past the big bubble we had going | 16:29 |
| bauzas | to answer the original paperwork question, I think there is no controversy to tell it's a specless BP and we don't to document this as we already have https://review.opendev.org/c/openstack/governance/+/815158/20/goals/proposed/consistent-and-secure-rbac.rst | 16:29 |
| bauzas | we don't need* to | 16:30 |
| dansmith | ++ | 16:30 |
| bauzas | that said, of course this work will need some release notes | 16:30 |
| dansmith | obviously | 16:30 |
| bauzas | to explain the changes to the operators | 16:30 |
| bauzas | ok | 16:31 |
| bauzas | anyone has other concerns N? | 16:31 |
| bauzas | dang, I need to learn typing | 16:31 |
| bauzas | (and that's what happens when you have a french keyboard with ? located near n and requiring shift) | 16:31 |
| bauzas | anyway | 16:32 |
| bauzas | #agreed https://blueprints.launchpad.net/nova/+spec/policy-defaults-refresh-2 accepted as a specless BP as the direction is already explained in https://review.opendev.org/c/openstack/governance/+/815158/ | 16:32 |
| bauzas | moving on, last topic | 16:32 |
| bauzas | (ganso) Raising awareness of vif_multiqueue_enabled in flavor work that is ready to be reviewed/merged | 16:33 |
| bauzas | ganso: around ? | 16:33 |
| ganso | o/ | 16:33 |
| bauzas | #link https://blueprints.launchpad.net/nova/+spec/multiqueue-flavor-extra-spec | 16:33 |
| ganso | so as the topic titles says: https://review.opendev.org/q/topic:%22bp%252Fmultiqueue-flavor-extra-spec%22+(status:open%20OR%20status:merged) | 16:33 |
| ganso | we've discussed 2-3 weeks ago about this and that it could/may be specless, but it was approved to be specless ~6 months ago | 16:34 |
| bauzas | ganso: nothing changed during the implementation phase requiring further discussion ? | 16:34 |
| ganso | bauzas: as far as I know, nothing changed and the code is complete | 16:34 |
| bauzas | the BP was previously approved as specless so I don't see problems approving it again providing there were no changes in design | 16:35 |
| ganso | I rebased it and it is passing CI | 16:35 |
| bauzas | (requiring further discussions) | 16:35 |
| ganso | I'm pretty much shepherding this set of changes now, but the work was done by stephenfin | 16:36 |
| bauzas | ganso: I guess you're taking over stephenfin's work ? | 16:36 |
| ganso | yes | 16:36 |
| bauzas | OK, that's crystal clear then | 16:36 |
| bauzas | I don't have any problems reapproving it | 16:36 |
| bauzas | anyone else disagreeing ? | 16:36 |
| ganso | great =) | 16:36 |
| bauzas | #agreed https://blueprints.launchpad.net/nova/+spec/multiqueue-flavor-extra-spec to approve it again as a specless BP for the yoga release cycle | 16:37 |
| bauzas | we're at the end of the agenda, anything else to mention ? | 16:37 |
| bauzas | I'm happy to say we were quick this time :) | 16:38 |
| gibi | \o/ | 16:38 |
| bauzas | if not, | 16:38 |
| bauzas | #endmeeting* | 16:38 |
| opendevmeet | Meeting ended Tue Nov 30 16:38:34 2021 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 16:38 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/nova/2021/nova.2021-11-30-16.00.html | 16:38 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/nova/2021/nova.2021-11-30-16.00.txt | 16:38 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/nova/2021/nova.2021-11-30-16.00.log.html | 16:38 |
| bauzas | man, I'm fed up with my typing issues | 16:38 |
| * bauzas will install TuxType | 16:39 | |
| bauzas | thanks all | 16:40 |
| elodilles | thanks bauzas o/ | 16:40 |
| bauzas | I'm a gross person, I haven't officially thanked you all at the end of the meeting | 16:40 |
| elodilles | :D | 16:42 |
| *** xek_ is now known as xek | 16:48 | |
| bauzas | gmann: can I put you assignee on https://blueprints.launchpad.net/nova/+spec/policy-defaults-refresh-2 ? | 17:07 |
| opendevreview | Nicolas Parquet proposed openstack/nova master: Add v2.91 microversion, allowing @ and dot (.) characters in keypair name https://review.opendev.org/c/openstack/nova/+/781076 | 17:14 |
| gmann | bauzas: sure, thanks | 18:05 |
| opendevreview | Dan Smith proposed openstack/nova master: Revert project-specific APIs for servers https://review.opendev.org/c/openstack/nova/+/816206 | 18:07 |
| opendevreview | Dan Smith proposed openstack/nova master: Make API fixture pass roles https://review.opendev.org/c/openstack/nova/+/819907 | 18:08 |
| dansmith | gmann: this has the fixture change on top ^ so you can see it not working without it, and then working when we change that | 18:08 |
| dansmith | I haven't done more digging on why this is required, but hoping it's something you can spot easily | 18:08 |
| gmann | dansmith: ok, checking | 18:08 |
| dansmith | I wonder if we're not really testing fake policy like we think in functional? | 18:08 |
| gmann | dansmith: which is good :). I wanted to remove those fake policy from unit as well as from functional tests completely but that might need more tests modification but something we should do. | 18:09 |
| dansmith | don't disagree that it would be better, I just don't know why this is required right now, | 18:10 |
| dansmith | since I would expect us to at most be testing with old defaults OR'd in | 18:10 |
| gmann | sure, I will check it where we are missing things. | 18:11 |
| gmann | dansmith: did you see my comment https://review.opendev.org/c/openstack/nova/+/816206/9/nova/policies/base.py | 18:11 |
| gmann | dansmith: if CONTEXT_ADMIN if more readable then it is fine otherwise we can ad ADMIN ? | 18:12 |
| dansmith | gmann: oh yeah I did, I just got distracted by the functional failures | 18:12 |
| gmann | I started converting SYSTEM_READER to SYSTEM_ADMIN on top of your patch so doing it in base patch will avoid rebase or so | 18:12 |
| gmann | sure | 18:13 |
| gmann | dansmith: this is reason for functional test failure https://review.opendev.org/c/openstack/nova/+/816206/comment/510a59e0_5ffbc2f5/ | 18:57 |
| gmann | dansmith: functional test using the real policy helped us to capture it. | 18:58 |
| dansmith | gmann: ahh, I was probably conflating that rule with the admin_or_owner below it when thinking that we'd still have the old default | 19:00 |
| gmann | dansmith: yeah, and those role hierarchy fix in 819907 made test passing because of 'admin' being used as user-id for functional test https://review.opendev.org/c/openstack/nova/+/819907/comment/eba56840_d585da0a/ | 19:01 |
| dansmith | gmann: you mean that's why they worked before I switched the rule... | 19:02 |
| dansmith | gmann: should I use admin_or_owner for those flavor-extra-spec rules, or add the DEPRECATED_ADMIN_OR_OWNER to context_admin/ | 19:03 |
| gmann | dansmith: I think DEPRECATED_ADMIN_POLICY as CONTEXT_ADMIN is going to replace SYSTEM_ADMIN only . I was trying to do it this way https://review.opendev.org/c/openstack/nova/+/819389 | 19:05 |
| gmann | and PROJECT_ADMIN going to be with DEPRECATED_ADMIN_OR_OWNER which has project_id in that | 19:06 |
| gmann | dansmith: let me update my patch and then you can use the new ADMIN rule for place of role:admin | 19:08 |
| dansmith | gmann: ack | 19:08 |
| dansmith | gmann: we still want my patch to pass proper roles from the fixture though right? | 19:09 |
| dansmith | presumably we need to also let you get a fixture with no (or foo) roles for testing that member is enforced | 19:09 |
| gmann | dansmith: for is_admin L1092 yeah it is ok but else part make reader also give member authority https://review.opendev.org/c/openstack/nova/+/819907/1/nova/tests/fixtures/nova.py#1092 | 19:14 |
| gmann | if we remove the else part and let real role being tested what test use then it should be ok | 19:15 |
| dansmith | gmann: well, it just assumes member if not admin, which all the current users of that fixture are going to expect.. I'm saying it needs to be extended to allow you to tell it what roles you want | 19:15 |
| gmann | and later we can add user_id as 'member', 'reader' etc and add role accodringl;y | 19:15 |
| dansmith | gmann: otherwise non-admin stuff will all fail too because roles=[] can't do aything | 19:15 |
| gmann | yeah that is true | 19:16 |
| dansmith | if we fix the deprecated rule bit, then this doesn't matter just yet, but before we can test with deprecated rules disabled, we'll have to fix this I think | 19:16 |
| gmann | dansmith: right for No legacy tests we need that. and we can add we can add user_id == 'member' and add only member role and else part as add reader | 19:17 |
| dansmith | sure, or just pass roles= to the fixture | 19:18 |
| dansmith | right now, the user that is used is something other than "member" so we probably need a bunch of changes for that first | 19:18 |
| gmann | +1, much better | 19:18 |
| opendevreview | Dan Smith proposed openstack/nova master: Make API fixture pass roles https://review.opendev.org/c/openstack/nova/+/819907 | 19:30 |
| dansmith | gmann: like this-ish ^ | 19:30 |
| gmann | dansmith: +1 yeah, and you want default to reader only (lower level of access) ? here https://review.opendev.org/c/openstack/nova/+/819907/2/nova/tests/functional/api/client.py#140 | 19:33 |
| dansmith | gmann: that defaults to member, not reader.. since that's what everything else would expect currently, it seemed like that would be the best default | 19:34 |
| dansmith | looks like maybe it's only used in one other place though, | 19:34 |
| dansmith | so I guess I could default it even lower and fix that one too | 19:35 |
| dansmith | default should be roles=[] right? since that's what you get if you're not explicitly granted reader/member/admin on a project | 19:35 |
| gmann | dansmith: yeah. but if it need mroe test fix then we can leave as of now and later we can do while moving func tests also to reader/mem,ber | 19:35 |
| dansmith | oh nm, it's just used here | 19:35 |
| opendevreview | Dan Smith proposed openstack/nova master: Make API fixture pass roles https://review.opendev.org/c/openstack/nova/+/819907 | 19:37 |
| dansmith | I thought client was used a few other places directly, but it's not, so we should be good to default to roles=[] ^ | 19:37 |
| gmann | +1. yeah its self.api and self.admin_api | 19:39 |
| gmann | as of now | 19:39 |
| dansmith | yup | 19:39 |
| sean-k-mooney | well default to roles=None | 19:39 |
| sean-k-mooney | rather then [] | 19:39 |
| opendevreview | Ghanshyam proposed openstack/nova master: Introduce 'admin' policy base rule https://review.opendev.org/c/openstack/nova/+/819389 | 19:39 |
| sean-k-mooney | sicne you should not use mutable defaults but same effect | 19:39 |
| gmann | dansmith: ^^ this is for 'admin' basically renaming 'context_is_admin' to 'admin' | 19:39 |
| dansmith | sean-k-mooney: did you look at the patch? :) | 19:40 |
| dansmith | gmann: cool thanks | 19:40 |
| sean-k-mooney | nope just saw the converstaion scroll by | 19:40 |
| dansmith | sean-k-mooney: trying not to take offense that you think I don't know not to use mutable defaults :) | 19:40 |
| sean-k-mooney | :) | 19:41 |
| sean-k-mooney | i still see it in code often enough but ya you already did it the right way https://review.opendev.org/c/openstack/nova/+/819907/3/nova/tests/functional/api/client.py#140 | 19:42 |
| gmann | I think we have hacking rule for that. | 19:49 |
| dansmith | gmann: I don't think your admin patch works for me by itself, | 20:13 |
| dansmith | since it's still requiring role:admin, which isn't what we have today | 20:13 |
| dansmith | it needs to be is_admin in order to work as-is right? | 20:13 |
| * dansmith will bbl | 20:19 | |
| gmann | dansmith: context set is_admin based on this rule itself https://github.com/openstack/nova/blob/d630615a02469442fb50ed4aa7e092206a28166a/nova/context.py#L138 | 20:24 |
| gmann | https://review.opendev.org/c/openstack/nova/+/819389/4/nova/policy.py | 20:24 |
| gmann | but as it is two level deprecated rule combined I hope each one is logical ORed by oslo policy. but is it failing on your patch? if so then we can avoid to rename it for now. and add DEPRECATED_ADMIN_POLICY in is_context_admin rule only | 20:29 |
| gmann | dansmith: yeah, i ran your patch with my change and it does not work. oslo policy add only one level of deprecated rule in logical OR. | 20:39 |
| gmann | dansmith: I will abandon my patch and let's rename CONTEXT_ADMIN to ADMIN in your patch but keeping rule:is_context_admin. commented in https://review.opendev.org/c/openstack/nova/+/816206/comment/543216d1_15fecfb1/ | 20:40 |
| dansmith | gmann: okay, but that's not enough, it needs to be "role:admin or is_admin:True" | 21:43 |
| dansmith | so do you want me to do that on context_is_admin with a deprecated_rule= or add it to admin_api? | 21:44 |
| gmann | dansmith: yeah that will add ORed both | 21:44 |
| gmann | dansmith: yeah deprecated_rule=DEPRECATED_ADMIN_POLICY . | 21:45 |
| dansmith | okay that's not enough either, I need this: https://termbin.com/bnqh | 21:46 |
| dansmith | you okay with that? | 21:46 |
| dansmith | oh wait | 21:46 |
| dansmith | it's enough to use it as-is for today, you're right | 21:46 |
| dansmith | I'm thinking this needs to work for both old and new, but not as of this patch | 21:46 |
| dansmith | so yeah, I will just add the deprecated_admin_policy there | 21:46 |
| gmann | if you do this then it should ADMIN = 'rule:context_is_admin' | 21:47 |
| dansmith | yep, hadn't saved that before paste :) | 21:47 |
| dansmith | running all the tests now, but expect this to work now | 21:48 |
| gmann | dansmith: so with that you do not need this right? 'check_str='is_admin:True or role:admin',' | 21:48 |
| dansmith | correct, for just this patch, I don't | 21:48 |
| gmann | yeah. | 21:48 |
| dansmith | there are just too many balls in the air with this stuff for my tiny brain :D | 21:50 |
| artom | dansmith, for the record, I'm painfully aware of the door that your last line opened, but am steadfastly refusing to step through it | 23:06 |
| dansmith | artom: lol, I *literally* almost pinged you, asking if you wanted to do the mriedem thing in his stead :D | 23:06 |
| artom | I'm all grown up now | 23:07 |
| dansmith | riiight | 23:08 |
| artom | No really, I'm organizing expensive calls and everything :P | 23:09 |
| opendevreview | Dan Smith proposed openstack/nova master: Allow per-context rule in error messages https://review.opendev.org/c/openstack/nova/+/816865 | 23:37 |
| opendevreview | Dan Smith proposed openstack/nova master: Revert project-specific APIs for servers https://review.opendev.org/c/openstack/nova/+/816206 | 23:37 |
| opendevreview | Ghanshyam proposed openstack/nova master: Convert SYSTEM_ADMIN|READER to Admin and system scope https://review.opendev.org/c/openstack/nova/+/819390 | 23:42 |
| opendevreview | Ghanshyam proposed openstack/nova master: Convert SYSTEM_ADMIN|READER to Admin and system scope https://review.opendev.org/c/openstack/nova/+/819390 | 23:44 |
| opendevreview | Ghanshyam proposed openstack/nova master: Convert SYSTEM_ADMIN|READER to Admin and system scope https://review.opendev.org/c/openstack/nova/+/819390 | 23:44 |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!