TSC Meeting (11 Apr 2023)

[cognifloyd]

April 2023 @StackStorm/tsc 1 hour meeting plan:

• Tuesday, 14 February 2023, 09:30 AM US Pacific.
• See StackStorm TSC Meetings #33 for the schedule.
• TLDR; Zoom link: https://us02web.zoom.us/j/81082101702?pwd=N1V4TWdYRVQ4SXBsaFh1TFYvVDA0UT09

Meeting Agenda Notes

We did not have a meeting agenda ahead of time. So, this is what we talked about:

Attendees

@armab, @amanda11, @cognifloyd, eduardtamsa, @mickmcgrath13, @nzlosh, @winem

Topics discussed

• New StackStorm Deploy Action for GHA:

  • about:
    • https://github.com/marketplace/actions/deploy-single-vm-stackstorm-to-aws-ec2
    • https://www.youtube.com/watch?v=e3XEstD0Uzk
  • Not ready for prod use. Needs dialing in of the cluster size.
  • Uses Terraform and Ansible.
  • demonstrates viability of multi-instance approach (vs figuring out multi-tenant approach)

• Pants migration / the next release:

  • Nothing major needs to be released right away, so we agreed to delay the next release, waiting for the pants integration to complete.
  • PR waiting for review (@armab reviewed and approved during the meeting): pants: pin versions of pip and setuptools st2#5949
  • Next PR will be marked ready for review shortly: Upgrade pants from 2.16.0a0 to 2.16.0rc0 st2#5950
  • @cognifloyd asked about how we want to proceed to get access to "editable installs in exported virtualenvs", a new feature merged in pants yesterday: python_distribution editable installs in exports pantsbuild/pants#18639
    • This is blocking running our tests on a virtualenv exported by pants.
    • Options:
      1. wait for the next pants release that includes this feature.
         • Pants does dev releases almost every week, but we normally wait for at least an alpha or release candidate before using it with StackStorm. This means that waiting could delay the release further.
         • In general, we agreed that the release is already delayed, so waiting for this is ok.
      2. Extract the changes in pants into a pants-plugin we can include in the st2 repo.
         • This is a fairly large plugin at around 1k lines because it has to copy a lot of the modified pants rules.
         • @cognifloyd will watch the release cycle of pants - if it looks like the release is going to be delayed, then he'll create a PR to pull the plugin into st2.
  • @nzlosh asked about the feasibility of cutting a release based on pants soonish
    • We don't want to do an official release until we can test it with our current tests as-is. This is blocked by the editable installs feature.
    • However, we do have the bits to install the virtualenv in /opt/stackstorm/st2. So, @cognifloyd will work on the packaging parts of the release workflow while we wait for the testing parts.
      • This includes packaging a virtualenv (generated from the pants-generated wheels) into deb/rpm similar to our current release process.
      • Some of the end-to-end testing will probably not be doable until we can run our unit tests (blocked, see above).
      • But that does not block working on the rest of packaging.

• SSO/SAML:

  • Awesome set of PRs we need to review:
    • SSO/SAML support st2#5625
    • Implementing SSO/SAML login :) st2#5664
    • Feat/saml st2web#983
    • Implementing SAML integration with st2 st2-auth-backend-sso-saml2#16
    • adding sso / saml support st2-docker#246
  • @cognifloyd has been focused on the pants+CI+release workflow changes and hasn't had a chance to review
  • We want the changes, just need review time bandwidth and some of the CI needs to be fixed.

• Painful upgrades are coming:

  • python 3.9, 3.10
  • mongo 4.4 is reac hing EOL
  • updating ubuntu and EL involves bumping the python version
  • we want to get the pants stuff in to facilitate all of this work.
  • python 3.10 is blocked on our use of nosetest

• RBAC K/V issues

  • We need someone from ochestral to take a look at adding list all secrets or similar permissions for rbac policies that apply to non-admin users. Keystore RBAC Configuration Issues st2#5908