| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2017-03-08 | |||
| 07:51:22 | Qiming | nonono | |
| 07:51:40 | Qiming | a user with admin role suffice | |
| 07:52:04 | alex_xu | Qiming: yes | |
| 07:52:48 | alex_xu | but the admin role in the nova is equal to super admin, there is only one global admin | |
| 07:52:50 | Qiming | 1 min | |
| 07:53:27 | Qiming | you are right ... | |
| 07:53:53 | alex_xu | Qiming: :) | |
| 07:54:06 | Qiming | alex_xu, I have a pure shell script doing API calls -- sometimes I don't trust any software | |
| 07:54:38 | alex_xu | Qiming: ah, that is what i'm thinking, how you construct a curl with different user than osc | |
| 07:54:42 | Qiming | alex_xu, that script always generate the expected results, because .... I set USERNAME=admin | |
| 07:54:55 | alex_xu | heh | |
| 07:56:08 | Qiming | alex_xu, so ... I created an instance with user_data set to something, later on, I have to ask the admin guy to tell me what that user_data is ... | |
| 07:56:34 | Qiming | alex_xu, sounds like I was creating something I can never read back | |
| 07:56:48 | alex_xu | Qiming: yea, i agree that is a little strange. | |
| 07:56:59 | alex_xu | Qiming: the 2.3 is added for compatible ec2 API | |
| 07:57:21 | Qiming | alex_xu, it is not a requirement related to EC2 compatibility | |
| 07:57:24 | alex_xu | i guess compatible ec2 API only use that for admin user, i'm not sure why | |
| 07:58:13 | alex_xu | Qiming: yea, i agree | |
| 07:58:33 | Qiming | alex_xu, it is a requirement for portraying an existing server by describing its current attributes as closely as possible | |
| 07:58:57 | Qiming | alex_xu, then I can create another instance as its shadow | |
| 07:59:06 | alex_xu | Qiming: yes, i guess when we added that for admin, we didn't think about whether normal user need it | |
| 07:59:40 | alex_xu | Qiming: is there any requirement from senlin? | |
| 07:59:45 | Qiming | alex_xu, now you realize how badly I want the user_data back? it is MY instance, not the admin's, :D | |
| 07:59:48 | alex_xu | Qiming: or that is a requirement from senlin? | |
| 08:00:26 | bauzas | p!spy | |
| 08:00:26 | Qiming | alex_xu, em ... you can say that, senlin is a user of nova | |
| 08:00:40 | alex_xu | Qiming: ok | |
| 08:01:12 | alex_xu | Qiming: it isn't so hard to add that, just need a spec and a microversion... | |
| 08:01:30 | Qiming | just tried, a user with admin role doesn't help | |
| 08:01:46 | Qiming | alex_xu, the user's full name has to be 'admin' | |
| 08:02:01 | alex_xu | Qiming: no, just admin role | |
| 08:02:13 | Qiming | alex_xu, service account doesn't work either | |
| 08:02:25 | alex_xu | Qiming: yes | |
| 08:05:27 | Qiming | alex_xu, a minute, I was concluding too fast | |
| 08:05:48 | alex_xu | Qiming: yea | |
| 08:05:54 | Qiming | alex_xu, trying admin role now, let me what happens if 'demo' is an 'admin' on 'demo' | |
| 08:07:54 | Qiming | alex_xu, \o/, admin role does work | |
| 08:08:35 | alex_xu | Qiming: congrats :) | |
| 08:09:15 | Qiming | http://paste.openstack.org/show/601882/, it is there now | |
| 08:43:23 | openstackgerrit | Qiming Teng proposed openstack/nova master: Fix API doc about server attributes (2.3 API) https://review.openstack.org/443000 | |
| 08:44:09 | Qiming | alex_xu, for you ^ | |
| 08:45:44 | alex_xu | Qiming: thanks for that patch | |
| 08:46:23 | openstackgerrit | huangtianhua proposed openstack/nova master: Update quota usage when delete an instance without host https://review.openstack.org/443003 | |
| 08:47:53 | alex_xu | Qiming: just think we should clear that it is admin-only in the default policy configration, it is configurable thing https://review.openstack.org/#/c/443000/1/api-ref/source/parameters.yaml | |
| 08:53:02 | openstackgerrit | huangtianhua proposed openstack/nova master: [DNM] Update quota usage when delete an instance without host https://review.openstack.org/443003 | |
| 08:56:21 | Qiming | really? | |
| 08:58:05 | Qiming | alex_xu, trying tox -e genpolicy | |
| 08:59:17 | openstackgerrit | Sivasathurappan Radhakrishnan proposed openstack/nova-specs master: Live Migration of Rescued Instances https://review.openstack.org/347161 | |
| 08:59:37 | alex_xu | Qiming: yes, but that single rule contorl multiple fields. you may want to expose "userdata" to the normal user, but you won't want to expose other fields like hypervisor_hostname to the normal user | |
| 09:00:12 | Qiming | alex_xu, wrt those two I agree | |
| 09:00:21 | Qiming | alex_xu, how about others? | |
| 09:01:11 | Qiming | alex_xu, filed a bug on this, https://bugs.launchpad.net/nova/+bug/1670978 | |
| 09:01:11 | openstack | Launchpad bug 1670978 in OpenStack Compute (nova) "most of extended server attributes returned in 2.3 api versions should not require admin role" [Undecided,New] | |
| 09:01:42 | alex_xu | Qiming: ah, wait, that hostname is the instance's hostname | |
| 09:02:08 | alex_xu | Qiming: I feel we can expose all of them to the normal user. | |
| 09:04:06 | Qiming | alex_xu, glad to know that | |
| 09:37:21 | openstackgerrit | Li Yingjun proposed openstack/nova master: Error message should not include SQL command https://review.openstack.org/436773 | |
| 09:39:12 | johnthetubaguy | alex_xu: I thought hostname was the hypervisor hostname, is that a different one? | |
| 09:39:39 | alex_xu | johnthetubaguy: that is the different one, it comes from objects.Instance.hostname | |
| 09:40:02 | johnthetubaguy | oh, OK | |
| 09:40:18 | johnthetubaguy | thats the possibly truncated name I guess | |
| 09:41:11 | alex_xu | johnthetubaguy: yea, https://github.com/openstack/nova/blob/master/nova/compute/api.py#L590 | |
| 09:41:44 | alex_xu | johnthetubaguy: so we can change some admin fields to non-admin fields without microversion, right? | |
| 09:41:48 | johnthetubaguy | yeah, seems like the policy default is wrong then | |
| 09:41:57 | johnthetubaguy | alex_xu: yeah, just a release note about the upgrade impact | |
| 09:42:48 | alex_xu | johnthetubaguy: yes, capabilities API, remove all my confuse | |
| 09:42:51 | alex_xu | :) | |
| 09:42:56 | johnthetubaguy | :) | |
| 09:43:06 | alex_xu | johnthetubaguy: few thinking https://review.openstack.org/#/c/433037/12/specs/pike/approved/policy-remove-scope-checks.rst | |
| 09:44:33 | johnthetubaguy | alex_xu: yeah, scope is a tricky one, if we do hierarchy too | |
| 09:45:16 | johnthetubaguy | alex_xu: probably "global visibility = TRUE/FALSE" might be worth adding in the extended list | |
| 09:45:32 | alex_xu | johnthetubaguy: do you have example what scope will looks like with hierarchy? i can't image that, maybe I should think about more hierarchy first | |
| 09:45:51 | johnthetubaguy | so project A is parent of B and C | |
| 09:46:01 | johnthetubaguy | you login as global read of project A | |
| 09:46:16 | johnthetubaguy | maybe you should be able to also read servers in B and C | |
| 09:46:29 | johnthetubaguy | maybe all_tenants=True gives you a list of all servers across A, B and C | |
| 09:46:37 | johnthetubaguy | alex_xu: does that make any sense? | |
| 09:47:10 | alex_xu | johnthetubaguy: yea, that make sense | |
| 09:47:11 | johnthetubaguy | oops, I said global read of project A | |
| 09:47:18 | johnthetubaguy | I meant read in project A | |
| 09:47:36 | alex_xu | i think i got that | |
| 09:47:49 | johnthetubaguy | now I am not 100% if we want to do that, but good to leave the door open to that | |
| 09:47:53 | alex_xu | try to think about how to match that into scope check | |
| 09:48:04 | johnthetubaguy | think of a server GET | |
| 09:48:13 | johnthetubaguy | you have a token for project A | |
| 09:48:20 | johnthetubaguy | but you GET an instance in project B | |
| 09:48:47 | johnthetubaguy | because A is parent of B, we could make the scope check pass, even though token.project_id != server.project_id and token is not global scoped | |
| 09:49:45 | alex_xu | at that time, we should depend on context.project_id anymore I guess | |
| 09:49:57 | alex_xu | s/should/shouldn't/ | |
| 09:50:50 | bauzas | alex_xu: objects.Instance.hostname ? OMG, what's this ? | |
| 09:51:06 | alex_xu | bauzas: https://github.com/openstack/nova/blob/master/nova/compute/api.py#L590, the hostname of guest | |
| 09:51:09 | johnthetubaguy | alex_xu: right, the scope check checks the hierarchy and the project | |
| 09:51:32 | bauzas | alex_xu: ah the instance name, gotcha | |
| 09:51:45 | bauzas | oh wait, no | |
| 09:52:29 | bauzas | yeah, not the display name, some weird thing | |
| 09:54:22 | alex_xu | johnthetubaguy: ok, i guess scope parameter still be the {"project_id": project_id}, then context object have attribute about hierarchy projects. Then check_scope proably can do the hierarchy check | |
| 09:54:34 | alex_xu | bauzas: yea | |
| 09:55:10 | alex_xu | johnthetubaguy: bauzas have to leave now. back later | |
| 09:55:30 | johnthetubaguy | alex_xu: yeah, thats totally it | |
| 09:55:36 | johnthetubaguy | alex_xu: catch you later | |