Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2021-01-22
18:32:03 gmann yeah
18:32:14 gmann for nova I added all persona to check owner thing basically
18:32:20 lbragstad no - all of placement was protected with rule:admin_api which just checks role:admin essentially
18:32:56 gmann ok, in that case system-admin will also be able to access if enforce_scope is false
18:33:09 gmann as no project-id is checked there
18:33:36 lbragstad correct - system-admin will be able to access placement APIs
18:34:42 gmann admin is ok but reader we can make sure if new reader (project or system) cannot access in case of enforce_scope=false because we care changing the check_str to system_reader
18:35:02 gmann does it make sense?
18:35:31 sean-k-mooney we generally dont want project admins to be able to access placment by the way
18:35:50 sean-k-mooney and im not sure domain admins should eb able to either
18:36:30 sean-k-mooney plamcnet is one of those things that really only system admins should have access too
18:36:37 gmann sean-k-mooney: with new policy rigtht?
18:36:49 sean-k-mooney well system member would be ok too
18:36:53 sean-k-mooney gmann: yep
18:36:54 gmann yeah. that is lbragstad change does
18:37:10 gmann legacy Admin to SYSTEM_ADMIN
18:37:14 sean-k-mooney basically we need to enforce system scope
18:37:22 sean-k-mooney ya
18:37:35 gmann yeah
18:37:50 lbragstad well - there was a note in placement about exposing the usage API to project users
18:38:02 sean-k-mooney there may be uses for system reader or system member/user at somepoint
18:38:05 lbragstad from when mriedem refactored placement's policy enforcement and moved default policies into code
18:38:23 lbragstad stephenfin thought we should address that comment while we're in there mucking with the secure RBAC changes...
18:38:31 sean-k-mooney lbragstad: well currenlty plamcnet is not recommended to be exposed to endusers at all
18:39:06 sean-k-mooney at least in a public cloud case its provide a view into your infrastucre that you dont want normal tenants to have
18:39:22 lbragstad ok - in that case we should let stephenfin know? i'm assume i'm the person with the least amount of placement context
18:39:54 lbragstad https://review.opendev.org/c/openstack/placement/+/771964/1
18:40:24 sean-k-mooney there is perhaps a usces with unified limits
18:40:42 sean-k-mooney where if we are counting quots with lmits some endpoint might be ok
18:40:58 sean-k-mooney the RP endpoint and allocation candiates endpoint no
18:41:12 sean-k-mooney but looking an allocations for your instance might be ok
18:41:55 gmann but does not it give usages for requested project
18:41:57 sean-k-mooney each resouce provider has the hostname as its name so we cant allow project user to do an RP show for example
18:42:57 sean-k-mooney i though the usage endpoint was teh usage of an invetory
18:43:42 sean-k-mooney ok https://docs.openstack.org/api-ref/placement/?expanded=list-usages-detail#list-usages
18:43:52 sean-k-mooney would be ok for project users
18:44:05 sean-k-mooney that is the quota sutff
18:44:28 sean-k-mooney lbragstad: so https://review.opendev.org/c/openstack/placement/+/771964/1/placement/tests/functional/gabbits/usage-secure-rbac.yaml is fine
18:45:01 gmann yeah it make sense to have project scope there
18:45:52 sean-k-mooney i think /resource_providers /reshaper /allocation_candidates need to be system scope at lest by default
18:46:31 sean-k-mooney im not sure about /allocations/{consumer_uuid}
18:47:22 lbragstad yeah - stephenfin's change was specific to the usage API i believe
18:47:39 sean-k-mooney i think that would actully be ok as it is today for projects too https://docs.openstack.org/api-ref/placement/?expanded=list-allocations-detail#list-allocations
18:47:46 lbragstad because of https://review.opendev.org/c/openstack/placement/+/771964/1/placement/policies/usage.py#52
18:49:27 sean-k-mooney ya ok i think stephenfin's patch is going in the right direction
18:49:52 sean-k-mooney i dont see anything that is definetly incorrect e.g. too borad
18:50:19 sean-k-mooney ill start it for monday
18:51:10 lbragstad ok - i'd appreciate it, i think there are some things in how placement sets up fixtures that need to be investigated, too https://review.opendev.org/c/openstack/placement/+/772061/1/placement/tests/functional/gabbits/usage-secure-rbac.yaml
18:56:32 gmann lbragstad: commented in this ^^. project_id is not passed for policy check
18:57:18 gmann if we pass req.project_id in context.can() then it can fail if it is different from context.project_id
18:57:52 gmann I have not tested that just checked it in code. I faced many such isuse in nova APIs
18:58:36 lbragstad gmann i think we already fixed that in the previous patch
18:58:55 gmann oh, did not see that
21:01:03 openstackgerrit Lance Bragstad proposed openstack/placement master: Implement secure RBAC for resource providers https://review.opendev.org/c/openstack/placement/+/760240
21:05:15 openstackgerrit Lance Bragstad proposed openstack/placement master: Implement secure RBAC for resource providers https://review.opendev.org/c/openstack/placement/+/760240
22:47:39 openstackgerrit Lance Bragstad proposed openstack/placement master: Implement secure RBAC for resource providers https://review.opendev.org/c/openstack/placement/+/760240
22:47:40 openstackgerrit Lance Bragstad proposed openstack/placement master: Implement secure RBAC for aggregates https://review.opendev.org/c/openstack/placement/+/760235
22:47:41 openstackgerrit Lance Bragstad proposed openstack/placement master: Implement secure RBAC for allocations https://review.opendev.org/c/openstack/placement/+/760236
22:47:42 openstackgerrit Lance Bragstad proposed openstack/placement master: Implement secure RBAC for allocation candidates https://review.opendev.org/c/openstack/placement/+/760237
22:47:43 openstackgerrit Lance Bragstad proposed openstack/placement master: Implement secure RBAC for inventories https://review.opendev.org/c/openstack/placement/+/760238
22:47:44 openstackgerrit Lance Bragstad proposed openstack/placement master: Implement secure RBAC for resource classes https://review.opendev.org/c/openstack/placement/+/760239
22:47:45 openstackgerrit Lance Bragstad proposed openstack/placement master: Implement secure RBAC for traits https://review.opendev.org/c/openstack/placement/+/760241
#openstack-nova - 2021-01-23
03:52:45 openstackgerrit Merged openstack/nova master: Do not inherit os_glance properties on snapshot https://review.opendev.org/c/openstack/nova/+/771234
12:38:19 openstackgerrit Merged openstack/nova master: db: Clean up base migration https://review.opendev.org/c/openstack/nova/+/758155
16:00:01 openstackgerrit Jessie Lass proposed openstack/nova master: WIP: Adds emulation support if host arch != guest arch. https://review.opendev.org/c/openstack/nova/+/772156
17:29:08 openstackgerrit Jessie Lass proposed openstack/nova master: Add emulation support if host arch != guest arch. https://review.opendev.org/c/openstack/nova/+/772156
20:01:35 openstackgerrit Merged openstack/nova master: add openstack-python3-wallaby-jobs-arm64 job https://review.opendev.org/c/openstack/nova/+/742094
#openstack-nova - 2021-01-24
03:40:48 openstackgerrit Merged openstack/nova master: db: Merge in unique constraints https://review.opendev.org/c/openstack/nova/+/758156
05:40:39 openstackgerrit Merged openstack/nova master: utils: Remove periods from instance hostnames https://review.opendev.org/c/openstack/nova/+/764482
18:47:12 openstackgerrit Merged openstack/nova master: db: Drop "remove" of index https://review.opendev.org/c/openstack/nova/+/758157
#openstack-nova - 2021-01-25
07:28:25 openstackgerrit Yongli He proposed openstack/nova master: smartnic support - new vnic type https://review.opendev.org/c/openstack/nova/+/771363
07:28:25 openstackgerrit Yongli He proposed openstack/nova master: Smartnic support - cyborg drive https://review.opendev.org/c/openstack/nova/+/771362
07:28:26 openstackgerrit Yongli He proposed openstack/nova master: smartnic support https://review.opendev.org/c/openstack/nova/+/758944
08:39:02 lyarwood Morning \o
08:39:10 gibi lyarwood: morning o/
08:49:46 lyarwood bauzas / stephenfin ; https://review.opendev.org/c/openstack/nova/+/743231/ - I don't think we need to wait before removing the libvirt Xen driver right? bauzas I think you're confusing this driver with the XenAPI deprecation and removal.
08:59:18 openstackgerrit Lee Yarwood proposed openstack/nova master: docs: Move the LibvirtDistroSupportMatrix wiki page into our docs https://review.opendev.org/c/openstack/nova/+/771981
09:00:55 lyarwood gibi: https://review.opendev.org/c/openstack/nova/+/771711 - would you mind taking a look at this reference doc this week?
09:01:25 lyarwood https://review.opendev.org/c/openstack/nova/+/770926 is also a trivial bugfix if anyone has time
09:06:02 gibi lyarwood: OK, I've added these to my queue
09:06:17 lyarwood gibi: many thanks
09:38:55 openstackgerrit Wenping Song proposed openstack/nova master: Replaces tenant_id with project_id from List/Update Servers APIs https://review.opendev.org/c/openstack/nova/+/764292
09:44:02 stephenfin lyarwood: Yeah, I'd say bauzas is mixing things up a little there
09:49:06 openstackgerrit Stephen Finucane proposed openstack/nova stable/victoria: utils: Remove periods from instance hostnames https://review.opendev.org/c/openstack/nova/+/772271
09:51:43 openstackgerrit Stephen Finucane proposed openstack/nova stable/ussuri: utils: Remove periods from instance hostnames https://review.opendev.org/c/openstack/nova/+/772276
09:53:23 openstackgerrit Stephen Finucane proposed openstack/nova stable/train: utils: Remove periods from instance hostnames https://review.opendev.org/c/openstack/nova/+/772277
09:53:53 openstackgerrit Lee Yarwood proposed openstack/nova master: func: Allow compute_driver to be set and used by _IntegratedTestBase https://review.opendev.org/c/openstack/nova/+/764484
09:53:59 openstackgerrit Lee Yarwood proposed openstack/nova master: Add encryption fields to BlockDeviceMapping object and table https://review.opendev.org/c/openstack/nova/+/760453
09:54:07 openstackgerrit Lee Yarwood proposed openstack/nova master: image_meta: Add ephemeral encryption properties https://review.opendev.org/c/openstack/nova/+/760454
09:54:11 openstackgerrit Lee Yarwood proposed openstack/nova master: BlockDeviceMapping: Add is_local property https://review.opendev.org/c/openstack/nova/+/764485
09:54:16 openstackgerrit Lee Yarwood proposed openstack/nova master: WIP compute: Update bdms with ephemeral encryption details when requested https://review.opendev.org/c/openstack/nova/+/764486
09:54:23 openstackgerrit Lee Yarwood proposed openstack/nova master: WIP virt: Add ephemeral encryption flag https://review.opendev.org/c/openstack/nova/+/760455
09:54:30 openstackgerrit Lee Yarwood proposed openstack/nova master: WIP scheduler: Add an ephemeral encryption pre filter https://review.opendev.org/c/openstack/nova/+/760456
09:54:35 openstackgerrit Lee Yarwood proposed openstack/nova master: libvirt: Provide encryption details in block_info https://review.opendev.org/c/openstack/nova/+/772272
09:54:37 openstackgerrit Lee Yarwood proposed openstack/nova master: WIP/DMN libvirt: Enable ephemeral encryption support https://review.opendev.org/c/openstack/nova/+/772273
09:54:42 openstackgerrit Lee Yarwood proposed openstack/nova master: WIP block_device: Add local images to block_device_info https://review.opendev.org/c/openstack/nova/+/772274
09:59:58 bauzas lyarwood: stephenfin: nope, I know we are relating to libvirt-xen
10:00:37 stephenfin bauzas: But we never asked anyone to fix CI for that. afaik, we never had CI in the first place
10:00:46 bauzas but I was asking to wait for some time before removing it
10:01:10 bauzas stephenfin: a-ha, then that's what I mixed then

Earlier   Later