| *** hoonetorg has quit IRC | 00:10 | |
| *** rcernin has quit IRC | 00:42 | |
| *** rcernin has joined #openstack-oslo | 00:46 | |
| *** rcernin has quit IRC | 02:13 | |
| *** rcernin has joined #openstack-oslo | 02:15 | |
| *** rcernin has quit IRC | 02:33 | |
| *** dave-mccowan has quit IRC | 02:41 | |
| *** dave-mccowan has joined #openstack-oslo | 02:48 | |
| *** rcernin has joined #openstack-oslo | 02:55 | |
| *** dave-mccowan has quit IRC | 04:19 | |
| *** trident has quit IRC | 06:39 | |
| *** trident has joined #openstack-oslo | 06:42 | |
| *** rcernin has quit IRC | 06:59 | |
| *** rcernin has joined #openstack-oslo | 07:06 | |
| *** lbragstad_ has joined #openstack-oslo | 07:19 | |
| *** lbragstad has quit IRC | 07:21 | |
| *** tosky has joined #openstack-oslo | 07:33 | |
| *** rcernin has quit IRC | 07:41 | |
| *** ralonsoh has joined #openstack-oslo | 07:47 | |
| *** dtantsur|afk is now known as dtantsur | 08:10 | |
| *** sum12 has quit IRC | 08:14 | |
| *** tkajinam has quit IRC | 08:23 | |
| openstackgerrit | Elod Illes proposed openstack/oslo.messaging stable/queens: Simplify tools/test-setup.sh https://review.opendev.org/739922 | 08:27 |
|---|---|---|
| *** sum12 has joined #openstack-oslo | 09:01 | |
| *** rcernin has joined #openstack-oslo | 09:26 | |
| *** rcernin has quit IRC | 09:41 | |
| openstackgerrit | Dmitry Tantsur proposed openstack/tooz master: hashring: allow choosing hash function https://review.opendev.org/739725 | 09:51 |
| openstackgerrit | Merged openstack/oslo.messaging stable/train: Print warning message when connection running out https://review.opendev.org/734740 | 11:13 |
| *** raildo has joined #openstack-oslo | 11:37 | |
| *** rcernin has joined #openstack-oslo | 12:08 | |
| *** rcernin has quit IRC | 12:16 | |
| *** odjdtn2 has joined #openstack-oslo | 12:19 | |
| *** hoonetorg has joined #openstack-oslo | 12:25 | |
| odjdtn2 | Hello, I would like to enable CADF auditing, trying right now with glance and nova. I saw the available drivers are "messaging, messagingv2, routing, log, test, noop" for [audit_middleware_notifications]. I managed to use the "log" driver, but I'm wondering, is a standard way to send those event through http? Should I write a driver or is there already a driver which achieve this? | 12:26 |
| *** kgiusti has joined #openstack-oslo | 12:35 | |
| *** adriant has quit IRC | 13:05 | |
| *** adriant has joined #openstack-oslo | 13:05 | |
| dansmith | bnemec: do you happen to know the magic config incantation that would let me enable debug logging for oslo policy? | 13:38 |
| dansmith | ah log_config_append is what I want I think | 13:49 |
| *** geguileo has joined #openstack-oslo | 13:54 | |
| *** dave-mccowan has joined #openstack-oslo | 14:24 | |
| *** moguimar has joined #openstack-oslo | 14:28 | |
| elod | hberaud: can you have a quick look at this patch? https://review.opendev.org/#/c/739490/ | 14:29 |
| *** odjdtn2 has quit IRC | 14:31 | |
| *** dave-mccowan has quit IRC | 14:31 | |
| *** hamalq has joined #openstack-oslo | 15:44 | |
| *** hamalq_ has joined #openstack-oslo | 15:45 | |
| *** hamalq has quit IRC | 15:49 | |
| *** dtantsur is now known as dtantsur|afk | 16:01 | |
| bnemec | dansmith: It's probably because of https://github.com/openstack/oslo.log/blob/master/oslo_log/_options.py#L30 | 16:23 |
| bnemec | You could override https://github.com/openstack/oslo.log/blob/master/oslo_log/_options.py#L175 and remove oslo_policy from the list. | 16:23 |
| *** moguimar has quit IRC | 16:25 | |
| *** gouthamr has quit IRC | 16:26 | |
| dansmith | bnemec: yeah that's what I'm trying now.. I thought there was a way to tweak just one without overriding all the defaults, but I guess not | 16:29 |
| bnemec | Unfortunately not. :-/ | 16:30 |
| dansmith | bnemec: so on this: https://pastebin.com/mdDRPZgv | 16:35 |
| dansmith | bnemec: does that "cannot format data" message mean that it got an exception while trying to str() the target object, or what? | 16:35 |
| bnemec | dansmith: Looks like there are a couple of places that could come from: https://github.com/openstack/oslo.policy/blob/master/oslo_policy/policy.py#L923 and https://github.com/openstack/oslo.policy/blob/master/oslo_policy/policy.py#L933 | 16:40 |
| bnemec | My guess would be that's coming from one of the deepcopy calls. | 16:40 |
| dansmith | has to be 933 because it's target= I think | 16:41 |
| bnemec | Ah, right | 16:42 |
| dansmith | but yeah that helps, thanks | 16:43 |
| dansmith | so I was failing a policy check that should have worked, | 16:44 |
| dansmith | so I turned on debug to see that, | 16:44 |
| dansmith | I'm guessing that the copy also fails for real which means the policy rule doesn't have any target object to actually look at, hence the failure right? | 16:44 |
| *** whoami-rajat has quit IRC | 16:46 | |
| bnemec | It looks like the target only gets deepcopied on the debug path, unfortunately. | 16:46 |
| bnemec | So that may be unrelated to the actual failure. | 16:46 |
| dansmith | okay | 16:47 |
| dansmith | it's weird, I'm actually passing it a dict() which is pretty flat, AFAICT | 16:49 |
| bnemec | I wonder if we actually need a deepcopy there. It doesn't look like mask_dict_password modifies the passed in object. It just iterates it and builds a new one. | 16:50 |
| dansmith | well, that may be, but I still don't know what's killing it with what I'm giving to that function | 16:50 |
| bnemec | Yeah, that's kind of an odd message. | 16:52 |
| openstackgerrit | Ben Nemec proposed openstack/oslo.policy master: Don't deepcopy objects before mask_dict_password https://review.opendev.org/740068 | 16:57 |
| dansmith | bnemec: so can you help me understand why this policy isn't working? | 17:02 |
| dansmith | https://pastebin.com/FC1Nq0xJ | 17:02 |
| dansmith | first line is glance/policy.json | 17:02 |
| dansmith | and the second is the log debug line of the check, which is raising a 403 | 17:03 |
| dansmith | if I null out the rule, it'll pass, so I know it's checking the file | 17:03 |
| bnemec | dansmith: It may be necessary to quote the literal: https://github.com/openstack/oslo.policy/blob/master/oslo_policy/_checks.py#L299 | 17:13 |
| dansmith | ah damn, I had done that earlier | 17:13 |
| dansmith | ah, my echo command is stripping those | 17:14 |
| dansmith | hot damn, thanks bnemec ! | 17:15 |
| bnemec | \o/ | 17:15 |
| bnemec | We should document that better. That docstring is in a private function so it doesn't show up in the published docs anywhere. | 17:16 |
| dansmith | yeah, so, | 17:17 |
| dansmith | IMHO the policy docs need a thousand more examples | 17:17 |
| dansmith | I only figured out what I did, which seems like a super simple example, by reading a lot of oslo.policy code | 17:17 |
| dansmith | including the quotes for a literal thing | 17:17 |
| dansmith | like, it seemed overly hard for me to figure out "how do I compare an attribute of the target object against a static string" | 17:18 |
| bnemec | Yeah, none of the examples use a static value. They're all using magic attributes like role, rule, project_id, etc. | 17:19 |
| dansmith | and they're all context-based instead of target-based, IIRC | 17:19 |
| dansmith | also not sure how you're supposed to do something like compare two values from a context and a target that are the same | 17:20 |
| dansmith | like project-id=project-id | 17:20 |
| dansmith | seems like a scope is needed, like request.project_id:target.project_id or some such | 17:21 |
| bnemec | Hmm, good point. | 17:22 |
| dansmith | I meant to go try to figure out how we implement those rules today, | 17:23 |
| dansmith | because obviously "owner" should be that, unless there's some more magical ownership checking or something | 17:23 |
| bnemec | I know documentation of targets has been a pain point in the past too. We don't really have any way to document what fields are available in the target passed in to a check, short of looking at the code. | 17:23 |
| dansmith | yeah, and that's legit hard for oslo.policy to do, which is fine | 17:23 |
| dansmith | if you turn on debugging policy, that's discoverable to admins (harder than it should be, but doable) | 17:24 |
| dansmith | but knowing how to write the rule should be a minimum I think | 17:24 |
| bnemec | True. | 17:24 |
| bnemec | As long as the debug logging doesn't blow up. :-) | 17:24 |
| dansmith | well, there's that :) | 17:24 |
| bnemec | Lot of doc bugs open against oslo.policy already. :-( | 17:26 |
| dansmith | bnemec: fwiw, I haven't gotten that failure to print the debug'd target in a while.. not sure what I changed, but I don't think it was anything specific | 17:28 |
| bnemec | Oh, I think we do cover the project_id case though: "os_compute_api:servers:start" : "project_id:%(project_id)s" | 17:28 |
| dansmith | got a job running in zuul now, so we'll see if that hits it, which would have less manual tinkering than I did | 17:28 |
| bnemec | From https://docs.openstack.org/oslo.policy/latest/admin/policy-yaml-file.html | 17:28 |
| dansmith | bnemec: how does that work? | 17:29 |
| bnemec | Interesting. I proposed a patch to remove the deepcopy, so hopefully that will eliminate it completely. | 17:29 |
| dansmith | that unquoted project_id is a property on what, context? why do I need to do the string-formatting for the right-hand side? | 17:29 |
| bnemec | The doc just calls it an API attribute. I have to admit I'm not sure where those come from. | 17:31 |
| dansmith | whatever your answer, this is the super-confusing bit I'm talking about | 17:31 |
| dansmith | is it like any property name comes from context, and target is the thing used for any string formatting? | 17:31 |
| dansmith | it was confusing for me to read rules like that because they're properties on both context and the target and I needed just the target and a string constant | 17:32 |
| bnemec | There's a lot of magic that happens with policies. :-/ We had a similar discussion a while back about the roles. We document a check against role:admin, but never discussed what other roles might be available. | 17:37 |
| dansmith | well, again, the debug is actually pretty good once you get it turned on, | 17:38 |
| dansmith | although it's unfortunate that there's no [oslo_policy]debug=True flag | 17:38 |
| dansmith | it's more the understanding of what the syntax of the rule is, at least to me | 17:39 |
| dansmith | but anyway, I know I'm just whining and not helping :) | 17:39 |
| bnemec | It's good feedback though. There's definitely room for improvement here. | 17:41 |
| dansmith | tbh, this is the first time I've had to really grok policy to write something new, | 17:41 |
| bnemec | Like I see we overloaded the term "target" in that doc. The doc uses it to refer to the rule name, while internally it refers to the target object. | 17:41 |
| dansmith | it's always been applying an example someone else gave me or just making someone else figure it out | 17:42 |
| dansmith | so I guess it's shocking to me that it's this cryptic as I expect users really need to be able to make these changes, and it seems like reading the code is the only way | 17:42 |
| dansmith | yeah | 17:42 |
| dansmith | and the debug calls the "action" the "rule" | 17:42 |
| openstackgerrit | Mary Camp proposed openstack/openstackdocstheme master: Add version dropdown on docs.starlingx.io https://review.opendev.org/740072 | 17:43 |
| openstackgerrit | Merged openstack/oslo.messaging stable/rocky: Simplify tools/test-setup.sh https://review.opendev.org/739490 | 17:51 |
| openstackgerrit | Ben Nemec proposed openstack/oslo.policy master: Include example of literal comparison policy rule https://review.opendev.org/740073 | 17:52 |
| bnemec | Oops, forgot to use a permalink. | 17:53 |
| openstackgerrit | Ben Nemec proposed openstack/oslo.policy master: Include example of literal comparison policy rule https://review.opendev.org/740073 | 17:53 |
| bnemec | dansmith: I tried to capture the basics in https://bugs.launchpad.net/oslo.policy/+bug/1886857 Feel free to add your thoughts. | 18:03 |
| openstack | Launchpad bug 1886857 in oslo.policy "Improve documentation of what data is used in checks" [High,Triaged] | 18:03 |
| bnemec | raildo: ^Might be relevant to your interests as well. | 18:03 |
| raildo | bnemec, ack, thanks for the heads up, I'll take a look on it | 18:03 |
| dansmith | bnemec: seems good, thanks | 18:05 |
| *** ralonsoh has quit IRC | 18:07 | |
| smcginnis | bnemec: Can you ack https://review.opendev.org/#/c/738833/ if you are OK with it? hberaud removed the automatic PTL-Approved vote. I think that was to have you approve it. Though I'm not sure then if hberaud should be removed as the release liaison for oslo if that's the case. | 18:11 |
| bnemec | smcginnis: lgtm. I certainly don't want to remove hberaud as release liaison so maybe we just need to discuss with him why he did that. | 18:14 |
| smcginnis | ++ | 18:18 |
| hberaud | smcginnis, bnemec: o/ I did that just to be sure | 18:51 |
| hberaud | smcginnis, bnemec: I just prefer double check things | 18:52 |
| hberaud | smcginnis, bnemec: but if you want I can leave the PTL approved auto validation and only follow the classic release process, as you prefer. Sean already caught issues on my previous patches and he have a good vision about oslo, so I think we can continue by leaving the auto validation | 18:58 |
| *** gmann_ has joined #openstack-oslo | 19:17 | |
| *** gmann_ is now known as gmann | 19:18 | |
| *** geguileo has quit IRC | 19:21 | |
| *** mnaser has joined #openstack-oslo | 19:32 | |
| *** dougwig has joined #openstack-oslo | 19:33 | |
| *** jberg-dev has joined #openstack-oslo | 19:33 | |
| *** TheJulia has joined #openstack-oslo | 19:35 | |
| *** jungleboyj_ has joined #openstack-oslo | 19:35 | |
| *** rpittau has joined #openstack-oslo | 19:40 | |
| *** jrosser has joined #openstack-oslo | 19:48 | |
| *** csatari has joined #openstack-oslo | 19:49 | |
| *** hemna has quit IRC | 19:52 | |
| *** rm_work has joined #openstack-oslo | 19:53 | |
| *** andrewbogott has joined #openstack-oslo | 19:54 | |
| *** gagehugo has joined #openstack-oslo | 19:57 | |
| *** hemna has joined #openstack-oslo | 19:59 | |
| *** knikolla has joined #openstack-oslo | 20:05 | |
| *** kgiusti has left #openstack-oslo | 20:09 | |
| *** johnsom_ has joined #openstack-oslo | 20:10 | |
| *** coreycb has joined #openstack-oslo | 20:13 | |
| *** samueldmq has joined #openstack-oslo | 20:16 | |
| *** lbragstad_ is now known as lbragstad | 20:42 | |
| *** vdrok has joined #openstack-oslo | 20:44 | |
| *** mnaser is now known as mnaser|ic | 20:52 | |
| openstackgerrit | norman shen proposed openstack/oslo.messaging stable/stein: Print warning message when connection running out https://review.opendev.org/740115 | 20:55 |
| *** raildo has quit IRC | 21:01 | |
| *** mnaser|ic has quit IRC | 21:08 | |
| *** mnaser|ic has joined #openstack-oslo | 21:08 | |
| *** mnaser|ic has quit IRC | 21:08 | |
| *** mnaser|ic has joined #openstack-oslo | 21:08 | |
| *** mnaser|ic is now known as vexxhost | 21:08 | |
| *** gouthamr has joined #openstack-oslo | 21:11 | |
| *** vexxhost is now known as mnaser | 21:14 | |
| *** mnaser is now known as mnaser|ic | 21:14 | |
| *** gouthamr_ has joined #openstack-oslo | 21:15 | |
| *** johnsom_ is now known as johnsom | 21:19 | |
| *** johnsom has joined #openstack-oslo | 21:19 | |
| *** tosky has quit IRC | 22:30 | |
| *** tkajinam has joined #openstack-oslo | 22:58 | |
| *** rcernin has joined #openstack-oslo | 23:01 | |
| *** hamalq_ has quit IRC | 23:09 | |
| *** hamalq has joined #openstack-oslo | 23:10 | |
| *** Dmitrii-Sh has quit IRC | 23:14 | |
| *** Dmitrii-Sh has joined #openstack-oslo | 23:21 | |
| *** mnaser|ic has quit IRC | 23:38 | |
| *** mnaser|ic has joined #openstack-oslo | 23:38 | |
| *** mnaser|ic has quit IRC | 23:38 | |
| *** mnaser|ic has joined #openstack-oslo | 23:38 | |
| *** mnaser|ic is now known as mnaser | 23:38 | |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!