| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2017-03-08 | |||
| 07:24:28 | alex_xu | Qiming: the hash is done by the keystoneauth, for hide the secret thing. if you paste that into the curl, you can't pass the auth | |
| 07:24:39 | Qiming | yes, I realized that | |
| 07:25:02 | Qiming | I was comparing the ways requests are sent from OSC and from cURL | |
| 07:25:38 | Qiming | I believe you can reproduce this easily? | |
| 07:26:34 | alex_xu | Qiming: yea, i'm trying | |
| 07:26:58 | Qiming | thanks! | |
| 07:28:01 | arne_r | If someone could help me get this change into newton, newton is broken on our system without it: https://review.openstack.org/#/c/436868/ | |
| 07:28:09 | openstackgerrit | jichenjc proposed openstack/nova master: Clean up metadata param in doc https://review.openstack.org/442981 | |
| 07:29:51 | alex_xu | Qiming: your command like this "openstack --os-compute-api-version 2.3 --debug server show 940562c1-71c6-4dcf-83be-eeb2a22b5ca0"? | |
| 07:30:02 | Qiming | yep | |
| 07:30:18 | alex_xu | Qiming: I can see... the user_data field | |
| 07:31:17 | Qiming | oh? what's your magic? | |
| 07:31:26 | alex_xu | Qiming: both from the cli display and raw data | |
| 07:32:17 | alex_xu | Qiming: can you sure you request is send to a v2.1 endpoint, not the legacy v2 endpoint | |
| 07:32:59 | Qiming | from debug log, I can see the request sent (by OSC) this way: curl -g -i -X GET http://192.168.42.11:8774/v2.1/servers/59a17d5a-c27a-4301-b6f2-19dd128f24df -H "openstack-api-version: compute 2.3" -H "User-Agent: openstacksdk/0.9.14 keystoneauth1/2.18.0 python-requests/2.12.4 CPython/2.7.12" -H "X-Auth-Token: {SHA1}e216eff934c3484e8bc2cf1642c736e215c8c369" | |
| 07:33:50 | alex_xu | Qiming: looks like it is 2.1 endpoint | |
| 07:33:55 | alex_xu | my one is same "curl -g -i -X GET http://hp-pc:8774/v2.1/servers/940562c1-71c6-4dcf-83be-eeb2a22b5ca0 -H "User-Agent: python-novaclient" -H "Accept: application/json" -H "X-OpenStack-Nova-API-Version: 2.3" -H "X-Auth-Token: | |
| 07:33:57 | alex_xu | gAAAAABYv7cy3iWBliuTe8Htsg6-G8bMGJPYMAAW2H55dUBMOYuNzh-uP5o5p0DqxymiA6qqaBAdNPp1bRtJmN9Vv7q_cnDVAxk3nuSA4B_1d0v4opEl3EIWwMvT1SbDlFpwIVcAONtXfz5iV_pA86ZtKqgttDuCuzwb5CA1dQ7iKXpUCufTo0s"" | |
| 07:34:28 | alex_xu | Qiming: why my agent is python-novaclient? | |
| 07:34:30 | Qiming | em, you token is not hashed | |
| 07:34:44 | alex_xu | Qiming: i have a modified version of keystoneauth | |
| 07:34:58 | alex_xu | i hack the code directly... | |
| 07:35:24 | Qiming | your osc version? | |
| 07:35:42 | alex_xu | Qiming: 3.8.1 | |
| 07:36:29 | openstackgerrit | Alin Balutoiu proposed openstack/os-vif master: vif_plug_ovs: Skip setting MTU on Windows when plugging devices https://review.openstack.org/441855 | |
| 07:37:02 | Qiming | my command dump: curl -g -i -X GET http://192.168.42.11:8774/v2.1/servers/59a17d5a-c27a-4301-b6f2-19dd128f24df -H "User-Agent: python-novaclient" -H "Accept: application/json" -H "X-OpenStack-Nova-API-Version: 2.3" -H "X-Auth-Token: {SHA1}104a24f12ee85b77464fc36037dccbf5cf2beb45" | |
| 07:38:23 | alex_xu | Qiming: that looks same | |
| 07:38:36 | Qiming | so ... the responses differ if token is provided in different ways? | |
| 07:39:03 | alex_xu | Qiming: i don't think so, I just hack the code to not hide the real token in the log | |
| 07:40:07 | alex_xu | Qiming: the client pass the real token not the hash one. the hashed token is only for the log | |
| 07:40:19 | Qiming | alright | |
| 07:40:42 | Qiming | alex_xu, keystoneauth version? | |
| 07:40:43 | alex_xu | Qiming: can you paste your raw response | |
| 07:41:18 | alex_xu | Qiming: 2.18.0 | |
| 07:41:47 | Qiming | alex_xu, http://paste.openstack.org/show/601879/ | |
| 07:43:05 | Qiming | alex_xu, keystoneauth version match | |
| 07:43:35 | alex_xu | Qiming: do you have modified api-paste.ini for nova? | |
| 07:43:42 | Qiming | no | |
| 07:43:52 | Qiming | but my nova version is ... very old | |
| 07:44:28 | alex_xu | Qiming: paste your api-paste.ini to me? | |
| 07:45:46 | Qiming | alex_xu, http://paste.openstack.org/show/601881/ | |
| 07:46:20 | openstackgerrit | zhaolihui proposed openstack/nova master: Fix keypair quota error https://review.openstack.org/403529 | |
| 07:46:26 | openstackgerrit | jichenjc proposed openstack/nova master: remove a TODO as all set for tags https://review.openstack.org/442984 | |
| 07:47:53 | alex_xu | Qiming: are you using admin user in OSC? | |
| 07:48:03 | openstackgerrit | Hidekazu Nakamura proposed openstack/nova master: Do not attempt volume swap when guest is stopped https://review.openstack.org/389798 | |
| 07:48:07 | Qiming | no, I have all kinds of admins | |
| 07:48:13 | Qiming | s/have/hate | |
| 07:49:01 | alex_xu | Qiming: looks like the fields added by 2.3 only can seeable for admin user | |
| 07:49:09 | Qiming | what?! | |
| 07:49:23 | Qiming | lemme check | |
| 07:50:41 | alex_xu | Qiming: just ensure that, it only expose to admin user | |
| 07:51:22 | Qiming | nonono | |
| 07:51:40 | Qiming | a user with admin role suffice | |
| 07:52:04 | alex_xu | Qiming: yes | |
| 07:52:48 | alex_xu | but the admin role in the nova is equal to super admin, there is only one global admin | |
| 07:52:50 | Qiming | 1 min | |
| 07:53:27 | Qiming | you are right ... | |
| 07:53:53 | alex_xu | Qiming: :) | |
| 07:54:06 | Qiming | alex_xu, I have a pure shell script doing API calls -- sometimes I don't trust any software | |
| 07:54:38 | alex_xu | Qiming: ah, that is what i'm thinking, how you construct a curl with different user than osc | |
| 07:54:42 | Qiming | alex_xu, that script always generate the expected results, because .... I set USERNAME=admin | |
| 07:54:55 | alex_xu | heh | |
| 07:56:08 | Qiming | alex_xu, so ... I created an instance with user_data set to something, later on, I have to ask the admin guy to tell me what that user_data is ... | |
| 07:56:34 | Qiming | alex_xu, sounds like I was creating something I can never read back | |
| 07:56:48 | alex_xu | Qiming: yea, i agree that is a little strange. | |
| 07:56:59 | alex_xu | Qiming: the 2.3 is added for compatible ec2 API | |
| 07:57:21 | Qiming | alex_xu, it is not a requirement related to EC2 compatibility | |
| 07:57:24 | alex_xu | i guess compatible ec2 API only use that for admin user, i'm not sure why | |
| 07:58:13 | alex_xu | Qiming: yea, i agree | |
| 07:58:33 | Qiming | alex_xu, it is a requirement for portraying an existing server by describing its current attributes as closely as possible | |
| 07:58:57 | Qiming | alex_xu, then I can create another instance as its shadow | |
| 07:59:06 | alex_xu | Qiming: yes, i guess when we added that for admin, we didn't think about whether normal user need it | |
| 07:59:40 | alex_xu | Qiming: is there any requirement from senlin? | |
| 07:59:45 | Qiming | alex_xu, now you realize how badly I want the user_data back? it is MY instance, not the admin's, :D | |
| 07:59:48 | alex_xu | Qiming: or that is a requirement from senlin? | |
| 08:00:26 | bauzas | p!spy | |
| 08:00:26 | Qiming | alex_xu, em ... you can say that, senlin is a user of nova | |
| 08:00:40 | alex_xu | Qiming: ok | |
| 08:01:12 | alex_xu | Qiming: it isn't so hard to add that, just need a spec and a microversion... | |
| 08:01:30 | Qiming | just tried, a user with admin role doesn't help | |
| 08:01:46 | Qiming | alex_xu, the user's full name has to be 'admin' | |
| 08:02:01 | alex_xu | Qiming: no, just admin role | |
| 08:02:13 | Qiming | alex_xu, service account doesn't work either | |
| 08:02:25 | alex_xu | Qiming: yes | |
| 08:05:27 | Qiming | alex_xu, a minute, I was concluding too fast | |
| 08:05:48 | alex_xu | Qiming: yea | |
| 08:05:54 | Qiming | alex_xu, trying admin role now, let me what happens if 'demo' is an 'admin' on 'demo' | |
| 08:07:54 | Qiming | alex_xu, \o/, admin role does work | |
| 08:08:35 | alex_xu | Qiming: congrats :) | |
| 08:09:15 | Qiming | http://paste.openstack.org/show/601882/, it is there now | |
| 08:43:23 | openstackgerrit | Qiming Teng proposed openstack/nova master: Fix API doc about server attributes (2.3 API) https://review.openstack.org/443000 | |
| 08:44:09 | Qiming | alex_xu, for you ^ | |
| 08:45:44 | alex_xu | Qiming: thanks for that patch | |
| 08:46:23 | openstackgerrit | huangtianhua proposed openstack/nova master: Update quota usage when delete an instance without host https://review.openstack.org/443003 | |
| 08:47:53 | alex_xu | Qiming: just think we should clear that it is admin-only in the default policy configration, it is configurable thing https://review.openstack.org/#/c/443000/1/api-ref/source/parameters.yaml | |
| 08:53:02 | openstackgerrit | huangtianhua proposed openstack/nova master: [DNM] Update quota usage when delete an instance without host https://review.openstack.org/443003 | |
| 08:56:21 | Qiming | really? | |
| 08:58:05 | Qiming | alex_xu, trying tox -e genpolicy | |
| 08:59:17 | openstackgerrit | Sivasathurappan Radhakrishnan proposed openstack/nova-specs master: Live Migration of Rescued Instances https://review.openstack.org/347161 | |
| 08:59:37 | alex_xu | Qiming: yes, but that single rule contorl multiple fields. you may want to expose "userdata" to the normal user, but you won't want to expose other fields like hypervisor_hostname to the normal user | |