Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2021-06-09
10:14:15 sean-k-mooney gibi: well ideally if they did want this it would be done on master first not on stable/train
10:14:24 gibi sean-k-mooney: yes.
10:14:26 sean-k-mooney with either a bug or blueprint
10:14:35 gibi sean-k-mooney: and zuul will also vote -1 as it is not a backport
10:14:53 gibi so we have automatic rejection for such cahnges
10:14:55 sean-k-mooney what this is doing is allowing you to look up the connection details if you happen to fined a token
10:14:55 gibi changes
10:15:44 sean-k-mooney gibi: beacuase of the pep8 cherry-pick check or something else
10:15:56 sean-k-mooney i was not aware of sometrhing that did that automatically
10:16:04 gibi sean-k-mooney: yepp
10:16:14 gibi sean-k-mooney: we have our own script
10:16:18 gibi sean-k-mooney: as part of pep8
10:16:38 gibi https://github.com/openstack/nova/blob/master/tools/check-cherry-picks.sh
10:16:41 sean-k-mooney i tought the cherry pick script would only detect this if you had cherry-pick lines
10:16:48 sean-k-mooney i did not think it would run on this patch
10:17:04 gibi sean-k-mooney: it reject things that does not have cherry-pick lines and does not have [stable only] heading
10:17:51 sean-k-mooney ah echo 'Stable branch requires either cherry-pick -x headers or [stable-only] tag!'
10:17:58 sean-k-mooney ya
10:18:11 sean-k-mooney ok i did not think we had that last bit. neet
10:30:04 swp20 sean-k-mooney: recently, our client meet the problem that the instance's owner has no permission to get console auth token with T version. From U we have used new policy rule, so i propose this patch base on Train branch: https://review.opendev.org/c/openstack/nova/+/795496
10:31:53 sean-k-mooney swp20: that cahnge does not allow them to get a console auth token
10:32:10 sean-k-mooney swp20: it allows them to use a token to get the connection info
10:32:57 swp20 we have tested this change works.
10:33:48 sean-k-mooney well you can do it in you policy.json without the code change but that is not what the rule is for
10:34:29 sean-k-mooney that is for https://docs.openstack.org/api-ref/compute/?expanded=show-console-connection-information-detail#show-console-connection-information
10:36:11 lyarwood sean-k-mooney: the host there is the compute host right?
10:37:10 sean-k-mooney i think its the proxy
10:37:21 sean-k-mooney but it could be
10:45:13 swp20 sean-k-mooney: how can i do in policy.json? does the instance's own donnot has the permission?
10:49:26 sean-k-mooney this is what i would have used in the past https://docs.openstack.org/api-ref/compute/?expanded=get-vnc-console-os-getvncconsole-action-deprecated-detail#get-vnc-console-os-getvncconsole-action-deprecated
10:49:42 sean-k-mooney that will give you the console url and the auth token
10:51:21 sean-k-mooney the newer way woudl be to use https://docs.openstack.org/api-ref/compute/?expanded=create-console-detail#create-console
10:53:08 swp20 this is no what we want.
10:53:57 sean-k-mooney swp20: to override the policy in policy.json you just do "rule name":["rules"]
10:54:43 sean-k-mooney swp20: it is what you said your customer wanted the creaqte api will return a new auth token/url for the server console
10:56:36 swp20 we have two platform A and B, A platform want use the console token to visit the instance on B platform, we need the host and port with the api https://docs.openstack.org/api-ref/compute/?expanded=show-console-connection-information-detail,create-console-detail#show-console-connection-information
10:57:17 sean-k-mooney swp20: why does A not just use the create api on b to get the url and token
10:57:25 sean-k-mooney swp20: is A unwaware of the server uuid
10:57:50 swp20 yes, A is unware of the server uuid.
10:58:52 sean-k-mooney i see well given the console_token is not intended to be used by normal users as a handel to identify a server im not conviced we should make that change in code
10:58:58 swp20 or A use no admin account.
10:59:09 sean-k-mooney you can do it locally on your cloud though
10:59:21 sean-k-mooney A presumable owns the server
10:59:24 sean-k-mooney correct
11:00:31 swp20 with the new policy rule, dose the system_reader has the permission?
11:01:09 sean-k-mooney in the patch you added
11:02:20 swp20 not in the patch. i find the rule change to SYSTEM_READER after U.
11:02:21 sean-k-mooney no it does no tsupport the new project scopes and roles
11:02:23 sean-k-mooney check_str='is_admin:True or project_id:%(project_id)s',
11:03:25 sean-k-mooney system_reader will not allow the owner of the token to use that endpoint no
11:03:56 swp20 ack, thanks.
11:04:04 sean-k-mooney swp20: this api endpoint was only intended to help admins debug console issues
11:04:48 swp20 but maybe the user has the requirement.
11:05:39 sean-k-mooney how does A get the console token for the server on B
11:06:06 sean-k-mooney the console tokens expire and are only valid for a short period of time so they are not ment to be used to identify the server
11:07:04 sean-k-mooney the default token time to live is 10 minutes https://docs.openstack.org/nova/latest/configuration/config.html#consoleauth.token_ttl
11:07:09 swp20 and the doc has no desciption.
11:07:58 swp20 i will ask the client what's his scenes.
11:08:55 swp20 i rememered, they just want to visit the instance through host and port.
11:09:23 sean-k-mooney well a normal end user shoudl not know the host on which the instnace is running
11:09:37 sean-k-mooney unless its a private cloud that is a pretty big security risk
11:10:11 swp20 yeah, it's a really a private cloud.:')
11:11:08 sean-k-mooney the sample policy.json is rendered here https://docs.openstack.org/nova/latest/configuration/sample-policy.html
11:11:57 sean-k-mooney they just need to put that in /etc/nova/policy.json and uncomment #"os_compute_api:os-console-auth-tokens": "rule:system_reader_api"
11:12:03 sean-k-mooney then update the rule
11:12:11 swp20 got it, thanks.
11:13:55 sean-k-mooney just make sure you customer is aware of the console auth token ttl and the fact that in theory the tokens could be resused
11:14:06 sean-k-mooney its very unlikely but it can happen
11:14:29 swp20 yeah, right.
11:14:44 sean-k-mooney if they are storing the token in a db somewhere and expecting to be able to use it days later its going to break there usecase
11:16:17 swp20 ack
11:17:40 swp20 i'll abandon this patch and talk to my customer.
12:45:35 opendevreview Stephen Finucane proposed openstack/nova master: requirements: Add typing-paramiko https://review.opendev.org/c/openstack/nova/+/795533
12:45:47 stephenfin gate is down - we need that (and the related requirements fix) to unblock it ^
12:46:24 stephenfin s/down/broken/
12:49:01 opendevreview Stephen Finucane proposed openstack/nova master: requirements: Add types-paramiko https://review.opendev.org/c/openstack/nova/+/795533
13:03:19 lyarwood stephenfin: Why the Depends-On?
13:03:36 stephenfin because we need to get it in u-c before the requirements job will pass, no?
13:06:27 lyarwood stephenfin: ah does that actually fail if we don't have a uc for a given test-requirement?
13:06:36 lyarwood TIL
13:06:39 stephenfin I'm pretty sure it does, yeah
13:08:33 amodi lyarwood: hi, can u help out with the issue in https://review.opendev.org/c/openstack/whitebox-tempest-plugin/+/786979, when u can. i don't have a devstack env to debug
13:08:50 lyarwood stephenfin: requirements-check looks like it's failing in the nova change
13:09:18 lyarwood ERROR: Package 'types-paramiko' is used in test-requirements.txt but not in lower-constraints.txt
13:09:30 stephenfin drat, will fix
13:10:09 gibi stephenfin: what is the way to reproduce the issue? I run tox -e mypy -r locally but it passes on nova master
13:10:10 lyarwood amodi: looking
13:11:26 stephenfin gibi: that did the trick for me. Only odd thing for me is the use of Python 3.9
13:11:30 stephenfin since it's F34
13:11:50 opendevreview Stephen Finucane proposed openstack/nova master: requirements: Add types-paramiko https://review.opendev.org/c/openstack/nova/+/795533
13:11:55 stephenfin lyarwood: ^
13:11:57 gibi gibizer@riverbed:~/upstream/git/nova [master] [000] [15:09:30]
13:12:01 gibi $ source .tox/shared/bin/activate
13:12:03 gibi gibizer@riverbed:~/upstream/git/nova (shared)[master] [000] [15:11:46]
13:12:07 gibi $ python --version
13:12:09 gibi I use python 3.9 too
13:12:12 gibi Python 3.9.2
13:12:14 gibi gibizer@riverbed:~/upstream/git/nova (shared)[master] [000] [15:11:48]
13:12:22 stephenfin odd
13:12:30 stephenfin here's the first failing job I saw https://review.opendev.org/c/openstack/nova/+/778547

Earlier   Later