| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2020-06-03 | |||
| 12:34:19 | johnthetubaguy | yeah, that is why I was so keen to get this done, the policy checks are basically non-sense by default | |
| 12:34:26 | johnthetubaguy | to be clear, owner is the project | |
| 12:34:30 | johnthetubaguy | the user only owns keypairs | |
| 12:34:40 | johnthetubaguy | we have not changed that at all | |
| 12:35:18 | johnthetubaguy | (there is a way to break your API and make the user sort of own things, but it was a compromise while we don't have hierarchical quotas) | |
| 12:35:26 | stephenfin | Okay, I don't know how I never got that nuance reading the specs | |
| 12:35:48 | johnthetubaguy | that is more the history of the API, project owns things, not users | |
| 12:36:02 | johnthetubaguy | (expect keypairs) | |
| 12:36:15 | stephenfin | so for everything != keypairs, admin_or_owner is really admin_or_project_member? | |
| 12:36:27 | johnthetubaguy | if it worked properly, yes | |
| 12:36:43 | johnthetubaguy | right now its admin_or_anyone_in_the_project | |
| 12:37:01 | johnthetubaguy | hopefully by V or W we can make it admin_or_project_memeber | |
| 12:37:08 | stephenfin | sorry, yeah, by project_member I was talking in general, not in terms of keystone roles | |
| 12:37:27 | stephenfin | admin_or_is_in_project | |
| 12:37:29 | johnthetubaguy | i.e. the role reader can delete any instance in a project, right now | |
| 12:37:35 | johnthetubaguy | ack | |
| 12:37:42 | stephenfin | okay, cool | |
| 12:37:52 | sean-k-mooney | johnthetubaguy: ya that is a bug | |
| 12:37:57 | stephenfin | johnthetubaguy++ thanks for the clarification. I'll try find somewhere to slot that into the docs | |
| 12:38:03 | sean-k-mooney | isnt there a patch to fix that | |
| 12:38:31 | johnthetubaguy | sean-k-mooney: which bit? the policy work last cycle was all to try and make this sane... eventually, after a transition period | |
| 12:38:48 | stephenfin | sean-k-mooney: We have proper role-based policy support integrated now, if that's what you mean | |
| 12:39:02 | sean-k-mooney | johnthetubaguy: there is a patch to make ti so that the reader role can not delete instances | |
| 12:39:04 | stephenfin | the work gmann and others did last cycle | |
| 12:39:52 | sean-k-mooney | i was looking at it last week i think it came up downstream and we were debaing if we caould backport it or not | |
| 12:40:09 | stephenfin | sean-k-mooney: we're talking about the same thing here, I suspect | |
| 12:40:21 | stephenfin | sean-k-mooney: read the scrollback | |
| 12:40:59 | stephenfin | tl;dr: the reader role is completely ignored until Ussuri and is then opt-in in Ussuri | |
| 12:41:09 | sean-k-mooney | yes | |
| 12:41:28 | stephenfin | all that matters is whether the user is an admin or a member of the project that the instance is part of | |
| 12:41:37 | sean-k-mooney | be consulting worte kcs articles of how to hack one in and our customer always mess it up | |
| 12:41:58 | sean-k-mooney | so it will be nice when we can jsut use the reader role in osp | |
| 12:42:07 | stephenfin | so a user that is a member of project foo will be able to delete any instance in project foo, even if they only have the reader role | |
| 12:42:21 | sean-k-mooney | stephenfin: well that is a bug | |
| 12:42:51 | sean-k-mooney | if a user is part of a project but only has the reader role they should not be able to delete the instnace | |
| 12:43:02 | sean-k-mooney | if the have teh member and reader role then the can | |
| 12:43:14 | sean-k-mooney | but if they only have the reader role they should not be able to do the delete | |
| 12:43:27 | sean-k-mooney | that was fixed by adding an new policy defintion | |
| 12:43:30 | sean-k-mooney | for server delete | |
| 12:44:10 | sean-k-mooney | this one i think https://github.com/openstack/nova/blob/master/nova/policies/servers.py#L319-L328 | |
| 12:44:15 | stephenfin | sean-k-mooney: that's my understanding, yes | |
| 12:44:54 | stephenfin | this was the policy-defaults-refresh blueprint | |
| 12:45:10 | gibi | nova session starts in 15 minutes | |
| 12:45:26 | gibi | please note that we switched back to Zoom | |
| 12:45:35 | sean-k-mooney | stephenfin: this is what fixed it https://github.com/openstack/nova/commit/c3fcc31d5f74e45e6c8eeadf3e45a53c194e08ab | |
| 12:45:52 | stephenfin | yup | |
| 12:46:03 | sean-k-mooney | it changed form check_str=RULE_AOO, to check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN, | |
| 12:47:22 | stephenfin | which was added by bee15b56814673e784ec18a7b92cbf4974fa6628 | |
| 12:52:57 | johnthetubaguy | stephenfin: sean-k-mooney: that all sounds like what I was meaning | |
| 12:53:07 | stephenfin | \o/ | |
| 12:53:10 | stephenfin | phew | |
| 12:53:41 | sean-k-mooney | johnthetubaguy: we also told our downstream folks that its not backportable so we are good there too :) | |
| 12:53:55 | johnthetubaguy | reader and member should work in ussri I think | |
| 12:53:59 | johnthetubaguy | sean-k-mooney: +1 | |
| 13:00:09 | gibi | it time | |
| 13:00:12 | gibi | it is time | |
| 13:00:20 | artom | There's a meeting password? | |
| 13:00:56 | gibi | PTG2020 | |
| 13:04:37 | bauzas | stephenfin: we need you ^ | |
| 13:05:12 | gmann | stephenfin: yeah what johnthetubaguy mentioned. in addition we had few bugs where admin_owner was open to everyone because project_id was not passed as policy target which were fixed in our policy work in ussuri. you might get 404 from DB etc but not 403 | |
| 13:08:32 | artom | Zoom is not cooperating | |
| 13:13:28 | stephenfin | artom: I had to use Chrome | |
| 13:13:36 | stephenfin | Firefox insisted on me installing stuff | |
| 13:15:13 | artom | stephenfin, yeah, I ended up installing the client | |
| 13:15:21 | artom | Neither Chrome nor Firefox were working | |
| 13:15:32 | artom | FWIW, Jitsi was just fine in the browser *ahem AHEM* | |
| 13:15:34 | artom | ;) | |
| 13:15:59 | liuyulong | gibi, alex_xu, meetpad does not work fine if without a proxy. So I setup a socket5 proxy VM from a public cloud in Singapore, it does not work fine either. The voice of the meeting was not very clear. | |
| 13:17:26 | gibi | liuyulong: thanks for the info. we switched to zoom | |
| 13:22:35 | stephenfin | I assume I'm the only that is seeing a stutter every now and then? | |
| 13:30:57 | stephenfin | artom: I can still hear everyone | |
| 13:31:02 | stephenfin | so just you | |
| 13:31:07 | artom | stephenfin, I know | |
| 13:31:51 | dansmith | gibi: I just continue to get a spinning "connecting" trying to join the juno zoom room | |
| 13:32:07 | dansmith | ah, here we go.. it's crazy slo | |
| 13:33:50 | gibi | dansmith: I'm glad you could join | |
| 13:34:10 | dansmith | gibi: well, it is still just "connecting" and I have audio, but no video and no window to mute myself or anything like that | |
| 13:34:25 | dansmith | and I can't quit :) | |
| 13:34:46 | gibi | dansmith: strange, the room run well so far | |
| 13:34:54 | dansmith | how many people are in it? | |
| 13:35:59 | gibi | 23 | |
| 13:40:48 | gibi | dansmith: now you are in! | |
| 13:41:00 | dansmith | gibi: on a different computer :/ | |
| 13:41:12 | gibi | :/ | |
| 13:49:13 | bauzas | gosh, I'm seeing double now | |
| 13:52:17 | kashyap | For me audio is completely lost; /me just joined shortly... | |
| 13:52:41 | kashyap | Joinied via Linux Zoom app. (Yes, yes, I tried the "Windows solution" - turned it off and turned it back on) | |
| 13:53:35 | kashyap | Ah, fixed | |
| 13:56:13 | kashyap | sean-k-mooney: Are we talking about default machine type change? | |
| 14:08:00 | dansmith | For anyone that was suffering the same thing as me, | |
| 14:08:35 | dansmith | the only way I was able to get zoom to not hang on connect is to start zoom itself, grab the meeting ID out of the link, and join the conference by id instead of the automatic linky thing | |
| 14:08:53 | dansmith | on my other machine just clicking the link works fine, so I dunno if it's a browser thing or a zoom thing or what | |
| 14:09:25 | sean-k-mooney | dansmith: are you using firefox or chome | |
| 14:09:34 | sean-k-mooney | chrome seam to be working better for people | |
| 14:09:45 | dansmith | chrome (of course) and I've never had this problem with zoom until today | |
| 14:09:52 | sean-k-mooney | that said i clinked the screen share button just now and it hard locked | |
| 14:10:18 | sean-k-mooney | is there a way to get the tile view of multiple people by the way | |
| 14:10:45 | sean-k-mooney | its nice to be able to see people to see queue of if they are trying to speak so i dont speak over people | |
| 14:12:03 | sean-k-mooney | if that is only in the app i might download the flatpack or snap assuming there is one | |
| 14:12:40 | mordred | artom: left a comment on https://review.opendev.org/#/c/733151 - thanks for working on that! | |