| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2020-06-03 | |||
| 10:35:18 | gibi | bauzas: yeah, the tool is secondary for me the primary goal is to allow everyone to join | |
| 10:40:13 | luyao | sean-k-mooney: I used chrome but didn't work for me. :( | |
| 12:31:34 | johnthetubaguy | stephenfin: if you add a reader role, they will have access to start instances | |
| 12:32:12 | stephenfin | It also seems they also have access to delete other users instances | |
| 12:32:22 | johnthetubaguy | correct | |
| 12:32:30 | johnthetubaguy | they have full access, as any user would | |
| 12:32:35 | johnthetubaguy | that is the point of the work, to fix that problem | |
| 12:32:49 | johnthetubaguy | but you have to opt into the new behviour | |
| 12:33:28 | johnthetubaguy | admin_or_owner meant, admin or anyone with any role in a project | |
| 12:33:41 | stephenfin | I was about to ask | |
| 12:33:55 | stephenfin | admin_or_owner suggested admin or owner of resource (i.e. user that created server) | |
| 12:34:13 | stephenfin | but that's not the case, fun :) | |
| 12:34:19 | johnthetubaguy | yeah, that is why I was so keen to get this done, the policy checks are basically non-sense by default | |
| 12:34:26 | johnthetubaguy | to be clear, owner is the project | |
| 12:34:30 | johnthetubaguy | the user only owns keypairs | |
| 12:34:40 | johnthetubaguy | we have not changed that at all | |
| 12:35:18 | johnthetubaguy | (there is a way to break your API and make the user sort of own things, but it was a compromise while we don't have hierarchical quotas) | |
| 12:35:26 | stephenfin | Okay, I don't know how I never got that nuance reading the specs | |
| 12:35:48 | johnthetubaguy | that is more the history of the API, project owns things, not users | |
| 12:36:02 | johnthetubaguy | (expect keypairs) | |
| 12:36:15 | stephenfin | so for everything != keypairs, admin_or_owner is really admin_or_project_member? | |
| 12:36:27 | johnthetubaguy | if it worked properly, yes | |
| 12:36:43 | johnthetubaguy | right now its admin_or_anyone_in_the_project | |
| 12:37:01 | johnthetubaguy | hopefully by V or W we can make it admin_or_project_memeber | |
| 12:37:08 | stephenfin | sorry, yeah, by project_member I was talking in general, not in terms of keystone roles | |
| 12:37:27 | stephenfin | admin_or_is_in_project | |
| 12:37:29 | johnthetubaguy | i.e. the role reader can delete any instance in a project, right now | |
| 12:37:35 | johnthetubaguy | ack | |
| 12:37:42 | stephenfin | okay, cool | |
| 12:37:52 | sean-k-mooney | johnthetubaguy: ya that is a bug | |
| 12:37:57 | stephenfin | johnthetubaguy++ thanks for the clarification. I'll try find somewhere to slot that into the docs | |
| 12:38:03 | sean-k-mooney | isnt there a patch to fix that | |
| 12:38:31 | johnthetubaguy | sean-k-mooney: which bit? the policy work last cycle was all to try and make this sane... eventually, after a transition period | |
| 12:38:48 | stephenfin | sean-k-mooney: We have proper role-based policy support integrated now, if that's what you mean | |
| 12:39:02 | sean-k-mooney | johnthetubaguy: there is a patch to make ti so that the reader role can not delete instances | |
| 12:39:04 | stephenfin | the work gmann and others did last cycle | |
| 12:39:52 | sean-k-mooney | i was looking at it last week i think it came up downstream and we were debaing if we caould backport it or not | |
| 12:40:09 | stephenfin | sean-k-mooney: we're talking about the same thing here, I suspect | |
| 12:40:21 | stephenfin | sean-k-mooney: read the scrollback | |
| 12:40:59 | stephenfin | tl;dr: the reader role is completely ignored until Ussuri and is then opt-in in Ussuri | |
| 12:41:09 | sean-k-mooney | yes | |
| 12:41:28 | stephenfin | all that matters is whether the user is an admin or a member of the project that the instance is part of | |
| 12:41:37 | sean-k-mooney | be consulting worte kcs articles of how to hack one in and our customer always mess it up | |
| 12:41:58 | sean-k-mooney | so it will be nice when we can jsut use the reader role in osp | |
| 12:42:07 | stephenfin | so a user that is a member of project foo will be able to delete any instance in project foo, even if they only have the reader role | |
| 12:42:21 | sean-k-mooney | stephenfin: well that is a bug | |
| 12:42:51 | sean-k-mooney | if a user is part of a project but only has the reader role they should not be able to delete the instnace | |
| 12:43:02 | sean-k-mooney | if the have teh member and reader role then the can | |
| 12:43:14 | sean-k-mooney | but if they only have the reader role they should not be able to do the delete | |
| 12:43:27 | sean-k-mooney | that was fixed by adding an new policy defintion | |
| 12:43:30 | sean-k-mooney | for server delete | |
| 12:44:10 | sean-k-mooney | this one i think https://github.com/openstack/nova/blob/master/nova/policies/servers.py#L319-L328 | |
| 12:44:15 | stephenfin | sean-k-mooney: that's my understanding, yes | |
| 12:44:54 | stephenfin | this was the policy-defaults-refresh blueprint | |
| 12:45:10 | gibi | nova session starts in 15 minutes | |
| 12:45:26 | gibi | please note that we switched back to Zoom | |
| 12:45:35 | sean-k-mooney | stephenfin: this is what fixed it https://github.com/openstack/nova/commit/c3fcc31d5f74e45e6c8eeadf3e45a53c194e08ab | |
| 12:45:52 | stephenfin | yup | |
| 12:46:03 | sean-k-mooney | it changed form check_str=RULE_AOO, to check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN, | |
| 12:47:22 | stephenfin | which was added by bee15b56814673e784ec18a7b92cbf4974fa6628 | |
| 12:52:57 | johnthetubaguy | stephenfin: sean-k-mooney: that all sounds like what I was meaning | |
| 12:53:07 | stephenfin | \o/ | |
| 12:53:10 | stephenfin | phew | |
| 12:53:41 | sean-k-mooney | johnthetubaguy: we also told our downstream folks that its not backportable so we are good there too :) | |
| 12:53:55 | johnthetubaguy | reader and member should work in ussri I think | |
| 12:53:59 | johnthetubaguy | sean-k-mooney: +1 | |
| 13:00:09 | gibi | it time | |
| 13:00:12 | gibi | it is time | |
| 13:00:20 | artom | There's a meeting password? | |
| 13:00:56 | gibi | PTG2020 | |
| 13:04:37 | bauzas | stephenfin: we need you ^ | |
| 13:05:12 | gmann | stephenfin: yeah what johnthetubaguy mentioned. in addition we had few bugs where admin_owner was open to everyone because project_id was not passed as policy target which were fixed in our policy work in ussuri. you might get 404 from DB etc but not 403 | |
| 13:08:32 | artom | Zoom is not cooperating | |
| 13:13:28 | stephenfin | artom: I had to use Chrome | |
| 13:13:36 | stephenfin | Firefox insisted on me installing stuff | |
| 13:15:13 | artom | stephenfin, yeah, I ended up installing the client | |
| 13:15:21 | artom | Neither Chrome nor Firefox were working | |
| 13:15:32 | artom | FWIW, Jitsi was just fine in the browser *ahem AHEM* | |
| 13:15:34 | artom | ;) | |
| 13:15:59 | liuyulong | gibi, alex_xu, meetpad does not work fine if without a proxy. So I setup a socket5 proxy VM from a public cloud in Singapore, it does not work fine either. The voice of the meeting was not very clear. | |
| 13:17:26 | gibi | liuyulong: thanks for the info. we switched to zoom | |
| 13:22:35 | stephenfin | I assume I'm the only that is seeing a stutter every now and then? | |
| 13:30:57 | stephenfin | artom: I can still hear everyone | |
| 13:31:02 | stephenfin | so just you | |
| 13:31:07 | artom | stephenfin, I know | |
| 13:31:51 | dansmith | gibi: I just continue to get a spinning "connecting" trying to join the juno zoom room | |
| 13:32:07 | dansmith | ah, here we go.. it's crazy slo | |
| 13:33:50 | gibi | dansmith: I'm glad you could join | |
| 13:34:10 | dansmith | gibi: well, it is still just "connecting" and I have audio, but no video and no window to mute myself or anything like that | |
| 13:34:25 | dansmith | and I can't quit :) | |
| 13:34:46 | gibi | dansmith: strange, the room run well so far | |
| 13:34:54 | dansmith | how many people are in it? | |
| 13:35:59 | gibi | 23 | |
| 13:40:48 | gibi | dansmith: now you are in! | |
| 13:41:00 | dansmith | gibi: on a different computer :/ | |
| 13:41:12 | gibi | :/ | |
| 13:49:13 | bauzas | gosh, I'm seeing double now | |
| 13:52:17 | kashyap | For me audio is completely lost; /me just joined shortly... | |
| 13:52:41 | kashyap | Joinied via Linux Zoom app. (Yes, yes, I tried the "Windows solution" - turned it off and turned it back on) | |
| 13:53:35 | kashyap | Ah, fixed | |