| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-cyborg - 2019-12-12 | |||
| 03:00:47 | openstack | The meeting name has been set to 'openstack_cyborg' | |
| 03:00:52 | Sundar49 | Hi all | |
| 03:01:13 | chenke | Hi all. | |
| 03:01:19 | chenke | info chenke. | |
| 03:01:23 | chenke | info# chenke | |
| 03:01:25 | Yumeng | #info Yumeng | |
| 03:01:34 | Sundar49 | Hi chenke, Yumeng | |
| 03:01:51 | Yumeng | Hi Sundar49 | |
| 03:01:52 | Sundar49 | Let's give a min for folks to join | |
| 03:02:08 | wangzhh | Hi all. | |
| 03:02:20 | Sundar49 | Hi | |
| 03:02:26 | Yumeng | I just added https://wiki.openstack.org/wiki/Cyborg/Policy to the policy page | |
| 03:02:57 | Sundar49 | Yumeng: nice! | |
| 03:03:02 | chenke | good | |
| 03:03:30 | wangzhh | Great. | |
| 03:03:53 | Sundar49 | Good, let's get started | |
| 03:04:05 | Sundar49 | Agenda: https://wiki.openstack.org/wiki/Meetings/CyborgTeamMeeting#Agenda | |
| 03:04:16 | s_shogo | #info s_shogo | |
| 03:04:21 | Sundar49 | Anything to add? | |
| 03:04:58 | Sundar49 | #topic Secure_Default_Policies_Popup_Team | |
| 03:05:01 | Yumeng | mainly three questions needs to disscuss with you guys. please take a look at the bottom of https://wiki.openstack.org/wiki/Cyborg/Policy | |
| 03:05:16 | Sundar49 | Yumeng, could you explain to us what's happening in this area? | |
| 03:06:54 | Sundar49 | What do the terms mean, member vs. reader? | |
| 03:08:24 | Sundar49 | Yumeng: ^ | |
| 03:08:49 | Yumeng | emmm. to be simple. the main problem today is that : 1) admin everywhere 2)insecure custom roles: many policy rules simply use "" as the rule 3)not support read-only | |
| 03:10:08 | Sundar49 | Our RBAC policies allow for admin and user roles, I think. Are we considering more roles, like member and reader? | |
| 03:10:15 | Yumeng | these means sometimes users may have too much or not enough privileges | |
| 03:11:34 | Sundar49 | Have there been any meetings across the popup team? | |
| 03:11:40 | Yumeng | something like that. 1)we need consistent admin over all openstack projects 2) we need to have read-only | |
| 03:12:10 | Yumeng | 3) we can have a scoped-RBAC including project-scope and system-scope | |
| 03:12:36 | Sundar49 | I see. So you could have a project-scope admin? | |
| 03:13:37 | Yumeng | yes. project-scope works for most of our current cases. maybe we need consider add system-scope for device related RBAC | |
| 03:14:03 | Yumeng | emmm. seems I need to propose a spec to describe this in more details | |
| 03:14:11 | Sundar49 | Re. the question about cyborg:arq:create, I agree that allowing any user to create an ARQ is too liberal, esp. because the ARQ creator can also program the device. | |
| 03:14:29 | Sundar49 | Yea, a spec would be welcome | |
| 03:15:13 | Yumeng | yes. I have same concerns on cyborg:arq:create | |
| 03:15:28 | Sundar49 | How do we fix that? | |
| 03:16:06 | xinranwang | Hi all, sorry for late | |
| 03:16:30 | Yumeng | should we change to admin? | |
| 03:17:15 | Yumeng | I was wondering why the initial design was allowing any user? | |
| 03:17:25 | Yumeng | Does anyone know that? | |
| 03:17:29 | Sundar49 | That is too restrictive. We want some auhtorized users to crete, and others should be forbidden. | |
| 03:17:46 | Sundar49 | I mean: ^ for admin | |
| 03:18:53 | Sundar49 | Does it make to sense to have granular roles like, device profile reader/writer, ARQ reader/writer etc.? | |
| 03:19:32 | Yumeng | sundar49: emmm seems no writer, only reader | |
| 03:20:16 | Sundar49 | Who can POST device profiles, PATCH arqs, etc.? Apart from admin? | |
| 03:21:35 | Sundar49 | Yumeng, chenke, xinranwang, wangzhh: ^ | |
| 03:22:01 | chenke | I only use admin to create device_profile. | |
| 03:22:12 | xinranwang | I think only admin | |
| 03:22:36 | Sundar49 | admin in project scope? | |
| 03:22:58 | chenke | yes. | |
| 03:23:02 | wangzhh | emmm Yep. I remembered that we disscussed about it before. And only admin allowed. | |
| 03:24:03 | Sundar49 | Yumeng: So, the next step is that we need to review this table in the wiki? | |
| 03:24:20 | Sundar49 | are you included in any meetings they have for this ? | |
| 03:26:09 | Sundar49 | If anybody has any thoughts, please speak up. | |
| 03:27:08 | Sundar49 | #topic Devstack components for multi-node | |
| 03:27:23 | Sundar49 | Shaohe's table: end of https://etherpad.openstack.org/p/cyborg-ptg-ussuri | |
| 03:27:59 | Sundar49 | Any further comments? | |
| 03:28:33 | Sundar49 | If not, shall we close this as final? | |
| 03:29:09 | chenke | I have one. | |
| 03:29:18 | chenke | 9. agent enabled_drivers N Y N | |
| 03:29:47 | chenke | agent enabled_drivers? | |
| 03:30:36 | Sundar49 | chenke, what is the comment? | |
| 03:30:38 | chenke | I think cyborg-agent node's conf need this . | |
| 03:31:09 | Sundar49 | Oh yes, it should be N N Y | |
| 03:31:16 | chenke | Ye. | |
| 03:31:26 | Sundar49 | Please write that in the etherpad | |
| 03:31:53 | Sundar49 | Thanks, chenke. Anything else? | |
| 03:32:21 | Yumeng | Sundar49: not yet. I just talked to zhurong. his idea is that this can be flexible. we can either use admin directly to post ARQ or use any user to make this post request to a system user to help do this post and return results. | |
| 03:32:44 | chenke | about 10. api ramdisk_heartbeat_timeout | |
| 03:33:07 | chenke | I don't know why we need this | |
| 03:33:26 | Yumeng | Sundar49: I will propose a spec today and welcome you guys to disscuss. | |
| 03:33:59 | Sundar49 | Yumeng: when a user wants to launch a VM with accelerators, he needs the ability to POST and PATCH ARQs, right? Does he have to ask the admin to create the VM? | |
| 03:34:20 | Sundar49 | Yumeng: ok, we can discuss in the spec | |
| 03:35:05 | Sundar49 | chenke: I don't see a reason for it either. We can probably drop it. | |
| 03:35:25 | chenke | Agree. | |
| 03:36:29 | Sundar49 | Ok, moving on | |
| 03:36:53 | Sundar49 | For functional testing, we don't have Li today | |
| 03:37:14 | Sundar49 | #topic Programming | |
| 03:37:34 | Sundar49 | API proposal: https://etherpad.openstack.org/p/cyborg-ussuri-programming-apis | |
| 03:37:57 | Sundar49 | Has anybody reviewed this yet? | |
| 03:39:18 | Sundar49 | s_shogo, would you like to bring up or discuss your patch? | |
| 03:39:53 | s_shogo | Yap,My patch relates the bottom of the proposal, > " Update FPGA user logic (bitstream)" | |
| 03:41:16 | Sundar49 | My first comment is, it probably needs more validation :) Validation of inputs, Needs some checks: is the bitstream id valid, is the bitstream already programmed, is the deployable in use, etc. | |
| 03:41:23 | Sundar49 | Also, UT | |
| 03:41:43 | s_shogo | There is no specific topic, so | |
| 03:42:14 | s_shogo | Thank you Sundar49 , I improve that. | |
| 03:42:21 | Sundar49 | Thanks | |
| 03:43:49 | Sundar49 | Before we move onto other things, have you all had a chance to look at the comments in https://review.opendev.org/#/c/692707/6/nova/objects/external_event.py@36 https://review.opendev.org/#/c/631244/51/nova/conductor/manager.py@1578 | |
| 03:44:16 | Sundar49 | This will have impact on Cyborg side too | |
| 03:45:01 | chenke | Ok. Will look at it after meeting. | |
| 03:45:25 | Sundar49 | ok | |
| 03:45:36 | Sundar49 | #topic Storyboard, specs, patches | |
| 03:46:19 | Sundar49 | I know there is a long list of specs and patches for me to look at :). Does anybody want to raise anything specific to expedite? | |
| 03:47:45 | Sundar49 | Very quiet meeting today :) | |
| 03:48:11 | Sundar49 | Ok, I''m going to keep chugging on Nova side. Please ping me if you have comments/questions/concerns | |
| 03:48:40 | Sundar49 | Have a good day, everybody! | |
| 03:48:50 | Yumeng | bye. see you | |
| 03:48:52 | Sundar49 | #endmeeting | |
| 03:48:54 | openstack | Meeting ended Thu Dec 12 03:48:52 2019 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | |