Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2026-08-26
11:16:01 stephenfin my understanding of those changes was that we needed to pre-build the auth plugin becuse one of the other services currently using SDK appear to be using service tokens
11:16:22 stephenfin (i.e. ironic and and manila)
11:16:58 sean-k-mooney so manila i think needed the service toke already
11:17:22 sean-k-mooney but in any case i can see that the new flow does build it correctly
11:17:37 sean-k-mooney the old flow might of or may have needed us to add it after the connection was created
11:17:59 sean-k-mooney so this is a bit cleaner in that when we get the adapter back we know it has it
11:18:12 sean-k-mooney but also less clean as it requires use to manually build it and pass it in
11:18:28 stephenfin we don't seem to be using service tokens for manila currently? https://github.com/openstack/nova/blob/master/nova/share/manila.py#L32-L48
11:19:11 stephenfin unless I'm missing something (that's what I was looking for)
11:19:11 sean-k-mooney we are ment ot use service tokesn for ever call ot other services if tis defiend in the config
11:19:20 sean-k-mooney and you cant talk to cinder or cyrbog without them
11:19:28 sean-k-mooney so the service user section is effectivly alwasy required now
11:19:55 sean-k-mooney stephenfin: i rememebr there was a lot of issues tryign to figurfe out how to make serivce user tokens work before with the sdk
11:20:08 sean-k-mooney so my guess is this nerver got wiered in and we hav ejust and a bug the hwole time
11:20:59 stephenfin I suspect so, though again I might be missing something
11:21:44 stephenfin You're likely right about this not being as simple as it could be. we probably should have get_sdk_adapter handle the whole service token logic for us (and I assume it should default to doing just that)
11:21:48 sean-k-mooney well i think in either case if tis not obviouysly using it its a opertunity to impvoe it
11:22:04 sean-k-mooney stephenfin: that is waht i was expecting
11:22:29 sean-k-mooney for the get_sdk_adapter to uncondtionally add the service token when its in the config
11:23:07 sean-k-mooney i think we can likely proceed with mels patch for now, and then we can do that cleanup with or after your cidner one
11:23:53 sean-k-mooney alsthough we can see what mel things ill leave a suggestion in the review
11:24:05 stephenfin Yes, we dont want to block the other cyborg work you've got going on. I'll pull that down and see if I can tidy it up somewhat. We've still got another day or two before freeze for SDK so if there are feature gaps there, we could close them out
11:25:28 sean-k-mooney i think in the long term it might be nice to have a more native way to do this in the sdk, ie and interface that allwo use to pass 2 config section and optionally an exisitng token when we want to use that as the user token
11:25:45 sean-k-mooney and jsut let the sdk deal with it but not right now
11:42:41 sean-k-mooney stephenfin: ok left my comments and +2'd ill hold +w unitil mel is aroudn and she can catchup
11:42:51 sean-k-mooney ill go look at your cidner patch next
11:43:38 sean-k-mooney stephenfin: oh that `'[cinder] catalog_info` ya that annorying and we shoudl fix that
11:44:17 sean-k-mooney it was "special" when we were creating the now redhat installer and i rememebr havign to confirue it differencly
11:45:11 sean-k-mooney that shoudl allwo use to clean up some fo this in devstack also
11:45:36 stephenfin sean-k-mooney: I agree RE: SDK support here. I forgot that I wrote docs on this back when Uggla was working on the Manila stuff, but I think he never got it work (?) https://review.opendev.org/c/openstack/openstacksdk/+/893505
11:45:37 sean-k-mooney we have some common fucntion for configruign the ksa sections which dont quite work with cidner if i recall
11:46:09 stephenfin sean-k-mooney: I looked at devstack and it doesn't set those weird Cinder options, thankfully
11:46:13 sean-k-mooney stephenfin: that or the patch is siting on review somewhere
11:46:32 sean-k-mooney stephenfin: oh good to know
11:47:13 sean-k-mooney https://github.com/openstack-k8s-operators/nova-operator/blob/main/templates/nova/nova.conf#L362-L377
11:47:17 stephenfin well good and not good. not good because the manila integration currently doesn't use service tokens so it suffers from the token expiry issues service tokens are supposed to work around
11:47:27 stephenfin good because Mel's changes should let us fix that?
11:47:27 sean-k-mooney we needed to use the internal endpoint in our installer so i had to set them
11:48:12 sean-k-mooney yes
11:48:18 sean-k-mooney if we passk in the ksa_auth
11:48:25 sean-k-mooney or if we do my suggetion and inline it
11:48:29 sean-k-mooney then it woudl "just work"
11:48:39 stephenfin why not just set interface instead of catalog_info?
11:48:42 sean-k-mooney because we woudl start sendign it when ever it was enabled in the config
11:48:58 stephenfin in https://github.com/openstack-k8s-operators/nova-operator/blob/main/templates/nova/nova.conf#L362-L377
11:49:00 opendevreview Balazs Gibizer proposed openstack/nova master: Stabilize TestSerialConsoleLiveMigrate https://review.opendev.org/c/openstack/nova/+/1002477
11:49:01 sean-k-mooney so the standard field is valid_interfaces = internal
11:49:07 sean-k-mooney which is a list ans we coudl not use that
11:49:19 stephenfin interface also works though, I believe?
11:49:24 sean-k-mooney interface may have worksed but i just used what was in kolla or tripleo
11:49:36 gibi sean-k-mooney: stephenfin: https://review.opendev.org/c/openstack/nova/+/1002477 is yet another gate stabilization patch if you have a bit of spare cycles
11:50:12 sean-k-mooney stephenfin: https://docs.openstack.org/nova/latest/configuration/config.html#cinder its not one of the document options
11:50:18 sean-k-mooney stephenfin: so i didnt use it
11:50:35 stephenfin fair. interface is disabled tbf, but we nothing ever gets removed in ksa 😅
11:50:51 stephenfin okay that's an oversight. devstack sets `interface`, fwiw
11:50:53 stephenfin gibi: looking
11:51:02 sean-k-mooney stephenfin: by the way it loks like barbica is also slightly special
11:51:10 sean-k-mooney https://github.com/openstack-k8s-operators/nova-operator/blob/main/templates/nova/nova.conf#L394
11:51:21 sean-k-mooney but that is coming form castalean
11:51:39 stephenfin gibi: done. dead simple
11:53:05 sean-k-mooney gibi: dont we alrady have a wait_for_migration_status in the integrate helpers
11:54:02 stephenfin sean-k-mooney: read the commit message :)
11:54:03 sean-k-mooney we copy that function in some of the regression tets and we reuse it in others
11:54:04 gibi sean-k-mooney: as I noted in the commit message this regression does not use our helper mixing
11:54:09 gibi s/g//
11:54:21 gibi hence I vendored the helper
11:54:39 gibi I didn't wanted the bigger change to pull in a new base class
11:55:09 sean-k-mooney ya i was just debating the value of that vs the copy
11:55:11 sean-k-mooney +2w
11:55:34 gibi thanks
11:58:09 sean-k-mooney im alway 50:50 on that, i perfer when our regression tests follow our docs and inherit form our base test case with minimal depency on those deper classes, on the other hand the integrate heleprs mixin is very useful and keeps them small
11:58:47 sean-k-mooney so i prefer reading them when it uses it :) and writeing them i guess but it creats more depencnece on the internals
11:59:39 sean-k-mooney stephenfin: so just to confirm with the cinder change i should now be able to use valid_interface internal,public for cidner right
11:59:49 sean-k-mooney we get that for free form ksa
12:00:38 sean-k-mooney i think in our installer we woudl still jut have it defautl to only internal
12:00:53 sean-k-mooney but its nice to have the option to have it be a list
12:03:27 stephenfin without the change you can use interface already. I'm not sure about valid_interface
12:03:34 stephenfin but with the change, you can use either
12:03:39 sean-k-mooney interface is not a list
12:03:53 sean-k-mooney so withoug the change you can have a list of endpoint to fall back on
12:04:13 sean-k-mooney valid_interfaces allwos you to do internal,public,admin
12:04:23 sean-k-mooney and it will try them in that order
12:04:39 sean-k-mooney well try to resovle them in that order
12:04:56 sean-k-mooney i.e. it check if there is an internal endpoint in the catalong and ifn not i twill check for public
12:05:04 sean-k-mooney it wont change the number of requests
12:05:27 stephenfin oh yeah I know there's a difference. What I don't know is whether cinderclient supported it
12:05:33 sean-k-mooney but it allwos you to write yoru config a bit more geneircally
12:06:35 sean-k-mooney i think that is resoveld before the cindercient but not sure, in anycasye the cidner change looks good to me
12:08:22 stephenfin looks like if you pass a list of strings to cinderclient's Client, it will pass it straight through to ksa's LegacyJsonAdapter
12:08:58 sean-k-mooney i tought it was ksa that handeedl this to be honest
12:09:14 sean-k-mooney i.e. that it was chooing the endpoint to use rather then the client
12:09:25 stephenfin but I guess you'd need a ListOpt to ensure the nova.conf value is transformed to a list instead of being given as a string
12:09:30 sean-k-mooney since its realy just the url for the request form the catalog that this is selecting
12:09:32 stephenfin yeah, that's been ksa for years
12:09:43 stephenfin and keystoneclient before that, iirc
12:10:13 sean-k-mooney ya so it should "just work" vai the common shared code path
12:10:27 sean-k-mooney cinder client is really just dealing with formating the payload
12:11:43 sean-k-mooney so my meta hope is to move placement and cybrog to using the sdk and proxy apis in 2027.1
12:12:02 sean-k-mooney and then all that is left i think is neutron and cidner to have nova fully using the sdk
12:12:22 sean-k-mooney bar barbican with goes via castalan

Earlier   Later