| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2020-06-03 | |||
| 09:00:58 | frickler | lyarwood: incidentally, one of them is also blacklisted on bionic for devstack-ceph-plugin. I'm going to build a ceph-focal job to verify the others, those did work fine in my local setup | |
| 09:01:20 | frickler | c.f. https://bugs.launchpad.net/devstack-plugin-ceph/+bug/1876330 | |
| 09:01:20 | openstack | Launchpad bug 1876330 in devstack-plugin-ceph "Rescue BFV instances not working with ceph backend, Tempest new test failing" [Undecided,New] - Assigned to Lee Yarwood (lyarwood) | |
| 09:06:33 | stephenfin | frickler: lyarwood is on PTO for the next month (new baby) | |
| 09:06:53 | stephenfin | just FYI | |
| 09:10:31 | frickler | stephenfin: yeah, I saw that warning, thx. anyone else wanting to debug failing volume detachments on focal? this might be a blocker for migrating the default jobs unless we accept to permanently blacklist those tests | |
| 09:16:57 | gibi | alex_xu: hi! did you tried zoom? does it work for you? | |
| 09:41:57 | alex_xu | gibi: yes, zoom works for us | |
| 09:42:54 | gibi | alex_xu: OK. I will change the etherpads and drop a mail to ML that we switch. I hope zoom works for everyone | |
| 09:43:07 | alex_xu | gibi: thanks! | |
| 10:03:17 | gibi | alex_xu: Done | |
| 10:05:49 | gibi | alex_xu: liuyulong seemed to participate on the neutron sessions yesterday and I guess he is from PRC too | |
| 10:06:23 | gibi | so if you need to join to other jitsi rooms during the week he might help | |
| 10:15:03 | stephenfin | gmann: Dumb question, but what's the expected behaviour when someone adds e.g. a reader role to a user on a Train-based deployment (i.e. before the policy default refresh) | |
| 10:16:19 | stephenfin | gmann: I would assume it'll be completely ignored and only things like "is this user an admin or owner" would be considered? | |
| 10:23:36 | bauzas | gibi: alex_xu: sorry, just saw your discussions, you want to move from meetpad to zoom ? | |
| 10:24:17 | bauzas | it's a bit unfortunate :( | |
| 10:24:25 | bauzas | but okay | |
| 10:31:02 | sean-k-mooney | alex_xu: have you tried useing meetpad wtih chrome by the way | |
| 10:31:24 | sean-k-mooney | it is not too hapy with firefox but chrome works fine for me | |
| 10:31:54 | sean-k-mooney | i have used both an while i kind of prefer meetpad i think both work resonably well | |
| 10:35:18 | gibi | bauzas: yeah, the tool is secondary for me the primary goal is to allow everyone to join | |
| 10:40:13 | luyao | sean-k-mooney: I used chrome but didn't work for me. :( | |
| 12:31:34 | johnthetubaguy | stephenfin: if you add a reader role, they will have access to start instances | |
| 12:32:12 | stephenfin | It also seems they also have access to delete other users instances | |
| 12:32:22 | johnthetubaguy | correct | |
| 12:32:30 | johnthetubaguy | they have full access, as any user would | |
| 12:32:35 | johnthetubaguy | that is the point of the work, to fix that problem | |
| 12:32:49 | johnthetubaguy | but you have to opt into the new behviour | |
| 12:33:28 | johnthetubaguy | admin_or_owner meant, admin or anyone with any role in a project | |
| 12:33:41 | stephenfin | I was about to ask | |
| 12:33:55 | stephenfin | admin_or_owner suggested admin or owner of resource (i.e. user that created server) | |
| 12:34:13 | stephenfin | but that's not the case, fun :) | |
| 12:34:19 | johnthetubaguy | yeah, that is why I was so keen to get this done, the policy checks are basically non-sense by default | |
| 12:34:26 | johnthetubaguy | to be clear, owner is the project | |
| 12:34:30 | johnthetubaguy | the user only owns keypairs | |
| 12:34:40 | johnthetubaguy | we have not changed that at all | |
| 12:35:18 | johnthetubaguy | (there is a way to break your API and make the user sort of own things, but it was a compromise while we don't have hierarchical quotas) | |
| 12:35:26 | stephenfin | Okay, I don't know how I never got that nuance reading the specs | |
| 12:35:48 | johnthetubaguy | that is more the history of the API, project owns things, not users | |
| 12:36:02 | johnthetubaguy | (expect keypairs) | |
| 12:36:15 | stephenfin | so for everything != keypairs, admin_or_owner is really admin_or_project_member? | |
| 12:36:27 | johnthetubaguy | if it worked properly, yes | |
| 12:36:43 | johnthetubaguy | right now its admin_or_anyone_in_the_project | |
| 12:37:01 | johnthetubaguy | hopefully by V or W we can make it admin_or_project_memeber | |
| 12:37:08 | stephenfin | sorry, yeah, by project_member I was talking in general, not in terms of keystone roles | |
| 12:37:27 | stephenfin | admin_or_is_in_project | |
| 12:37:29 | johnthetubaguy | i.e. the role reader can delete any instance in a project, right now | |
| 12:37:35 | johnthetubaguy | ack | |
| 12:37:42 | stephenfin | okay, cool | |
| 12:37:52 | sean-k-mooney | johnthetubaguy: ya that is a bug | |
| 12:37:57 | stephenfin | johnthetubaguy++ thanks for the clarification. I'll try find somewhere to slot that into the docs | |
| 12:38:03 | sean-k-mooney | isnt there a patch to fix that | |
| 12:38:31 | johnthetubaguy | sean-k-mooney: which bit? the policy work last cycle was all to try and make this sane... eventually, after a transition period | |
| 12:38:48 | stephenfin | sean-k-mooney: We have proper role-based policy support integrated now, if that's what you mean | |
| 12:39:02 | sean-k-mooney | johnthetubaguy: there is a patch to make ti so that the reader role can not delete instances | |
| 12:39:04 | stephenfin | the work gmann and others did last cycle | |
| 12:39:52 | sean-k-mooney | i was looking at it last week i think it came up downstream and we were debaing if we caould backport it or not | |
| 12:40:09 | stephenfin | sean-k-mooney: we're talking about the same thing here, I suspect | |
| 12:40:21 | stephenfin | sean-k-mooney: read the scrollback | |
| 12:40:59 | stephenfin | tl;dr: the reader role is completely ignored until Ussuri and is then opt-in in Ussuri | |
| 12:41:09 | sean-k-mooney | yes | |
| 12:41:28 | stephenfin | all that matters is whether the user is an admin or a member of the project that the instance is part of | |
| 12:41:37 | sean-k-mooney | be consulting worte kcs articles of how to hack one in and our customer always mess it up | |
| 12:41:58 | sean-k-mooney | so it will be nice when we can jsut use the reader role in osp | |
| 12:42:07 | stephenfin | so a user that is a member of project foo will be able to delete any instance in project foo, even if they only have the reader role | |
| 12:42:21 | sean-k-mooney | stephenfin: well that is a bug | |
| 12:42:51 | sean-k-mooney | if a user is part of a project but only has the reader role they should not be able to delete the instnace | |
| 12:43:02 | sean-k-mooney | if the have teh member and reader role then the can | |
| 12:43:14 | sean-k-mooney | but if they only have the reader role they should not be able to do the delete | |
| 12:43:27 | sean-k-mooney | that was fixed by adding an new policy defintion | |
| 12:43:30 | sean-k-mooney | for server delete | |
| 12:44:10 | sean-k-mooney | this one i think https://github.com/openstack/nova/blob/master/nova/policies/servers.py#L319-L328 | |
| 12:44:15 | stephenfin | sean-k-mooney: that's my understanding, yes | |
| 12:44:54 | stephenfin | this was the policy-defaults-refresh blueprint | |
| 12:45:10 | gibi | nova session starts in 15 minutes | |
| 12:45:26 | gibi | please note that we switched back to Zoom | |
| 12:45:35 | sean-k-mooney | stephenfin: this is what fixed it https://github.com/openstack/nova/commit/c3fcc31d5f74e45e6c8eeadf3e45a53c194e08ab | |
| 12:45:52 | stephenfin | yup | |
| 12:46:03 | sean-k-mooney | it changed form check_str=RULE_AOO, to check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN, | |
| 12:47:22 | stephenfin | which was added by bee15b56814673e784ec18a7b92cbf4974fa6628 | |
| 12:52:57 | johnthetubaguy | stephenfin: sean-k-mooney: that all sounds like what I was meaning | |
| 12:53:07 | stephenfin | \o/ | |
| 12:53:10 | stephenfin | phew | |
| 12:53:41 | sean-k-mooney | johnthetubaguy: we also told our downstream folks that its not backportable so we are good there too :) | |
| 12:53:55 | johnthetubaguy | reader and member should work in ussri I think | |
| 12:53:59 | johnthetubaguy | sean-k-mooney: +1 | |
| 13:00:09 | gibi | it time | |
| 13:00:12 | gibi | it is time | |
| 13:00:20 | artom | There's a meeting password? | |
| 13:00:56 | gibi | PTG2020 | |
| 13:04:37 | bauzas | stephenfin: we need you ^ | |
| 13:05:12 | gmann | stephenfin: yeah what johnthetubaguy mentioned. in addition we had few bugs where admin_owner was open to everyone because project_id was not passed as policy target which were fixed in our policy work in ussuri. you might get 404 from DB etc but not 403 | |
| 13:08:32 | artom | Zoom is not cooperating | |
| 13:13:28 | stephenfin | artom: I had to use Chrome | |
| 13:13:36 | stephenfin | Firefox insisted on me installing stuff | |
| 13:15:13 | artom | stephenfin, yeah, I ended up installing the client | |
| 13:15:21 | artom | Neither Chrome nor Firefox were working | |
| 13:15:32 | artom | FWIW, Jitsi was just fine in the browser *ahem AHEM* | |
| 13:15:34 | artom | ;) | |