| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-sdks - 2018-03-27 | |||
| 00:03:46 | adriant | What was that initiative called? Am I misremembering something? OpenLabs or something? | |
| 00:04:59 | adriant | mrhillsman: You might be the person to bug about this! | |
| 00:05:07 | adriant | mrhillsman: ^ the above | |
| 00:26:26 | mrhillsman | just getting notification, reading | |
| 00:28:05 | mrhillsman | yes adriant you are absolutely right | |
| 00:29:02 | mrhillsman | not just auth but i spoke with mordred i think or maybe someone else about reference spec(s) for a number of "this is how x should work across all libraries" thing | |
| 00:31:55 | adriant | mrhillsman: yeah, we really do. I keep running into weird inconsistencies and it drives me mad :( | |
| 00:32:50 | mrhillsman | that ^ | |
| 00:33:08 | adriant | like terraform expects OS_AUTH_TOKEN while we've been using OS_TOKEN for ages | |
| 00:33:27 | adriant | and I can't find the terraform code or gophercloud where that is even being read in... | |
| 00:34:18 | adriant | At this point I assume os-client-config is the reference implementation, and everyone 'should' be based on that when it comes to auth and source variables and such | |
| 00:37:38 | mrhillsman | https://github.com/gophercloud/gophercloud/blob/master/openstack/auth_env.go | |
| 00:38:37 | adriant | mrhillsman: no token in there though | |
| 00:39:10 | adriant | terraform supports token auth with OS_AUTH_TOKEN so it has to exist somewhere | |
| 00:40:04 | mrhillsman | ah, i think i understand you now | |
| 00:42:48 | adriant | mrhillsman: or in today's case, os-client-config supports token in clouds.yaml, but gophercloud doesn't :P | |
| 00:43:06 | mrhillsman | ^ that might be the actual case | |
| 00:44:08 | adriant | well, sort of. It's both. Ideally terraform/gopherclouds should use both OS_TOKEN and OS_AUTH_TOKEN and try and deprecate the latter, and then ALSO should add token support to clouds.yaml | |
| 00:44:50 | mrhillsman | hmm. well, it says it does (terraform provider at least documents it) | |
| 00:45:34 | adriant | mrhillsman: https://www.terraform.io/docs/providers/openstack/#token | |
| 00:45:39 | adriant | just through OS_AUTH_TOKEN | |
| 00:46:52 | mrhillsman | ++ | |
| 00:48:02 | mrhillsman | the good thing is that jtopjian and in general the gophercloud folks are very responsive | |
| 00:48:15 | mrhillsman | and i do not think if you opened an issue it would take long to resolve | |
| 00:48:46 | mrhillsman | seems like a if you get one or the other do these things | |
| 00:49:02 | mrhillsman | unless there is something else offered by one vs the other | |
| 00:55:19 | mrhillsman | i'm creating an issue adriant | |
| 00:55:29 | mrhillsman | is ^ your github username? | |
| 00:56:06 | adriant | mrhillsman: adrian-turjak | |
| 00:56:15 | mrhillsman | thx | |
| 00:56:18 | adriant | mrhillsman: coworker already also opened: https://github.com/gophercloud/utils/issues/25 | |
| 01:02:29 | mrhillsman | cool | |
| 01:02:46 | adriant | hmmmm | |
| 01:02:50 | mrhillsman | i think that repo is only for figuring out if client config is being used and if so grab it | |
| 01:03:02 | adriant | mrhillsman: I've just realised something | |
| 01:03:33 | adriant | mrhillsman: https://github.com/terraform-providers/terraform-provider-openstack/blob/master/openstack/provider.go#L72-L77 | |
| 01:03:54 | adriant | the OS_AUTH_TOKEN is in the provider code. I was silly and looking in the wrong place | |
| 01:04:14 | adriant | but now I'm wondering, does that provider use gophercloud or write it's own stuff? | |
| 01:04:26 | adriant | I assumed (probably incorrectly) that it did | |
| 01:04:27 | mrhillsman | it uses gophercloud | |
| 01:04:34 | adriant | ok, then I'm not entirely mad | |
| 01:04:36 | mrhillsman | so you see the section right below that one | |
| 01:04:58 | mrhillsman | basically, the section you referenced would turn into multi like the one below | |
| 01:05:05 | mrhillsman | and OS_TOKEN as an option | |
| 01:05:32 | mrhillsman | and then - if i understand right - gophercloud needs to do the same essentially | |
| 01:05:39 | adriant | mrhillsman: so easy fix in the provide then | |
| 01:05:45 | adriant | provider* | |
| 01:05:49 | mrhillsman | for the provider yeah | |
| 01:06:09 | mrhillsman | looks like | |
| 01:06:43 | adriant | and that shouldn't need a change in gophercloud | |
| 01:07:02 | adriant | although we do want to add better clouds.yaml support there too | |
| 01:07:28 | mrhillsman | https://github.com/gophercloud/gophercloud/blob/master/auth_options.go | |
| 01:07:46 | mrhillsman | well, gophercloud will need to change | |
| 01:11:03 | adriant | although on the auth front... I have to apologise in advance because I'm probably going to end up adding a lot of extra complexity once https://review.openstack.org/#/c/553670 is merged and implemented | |
| 01:11:10 | adriant | mordred: ^ don't hate me too much :P | |
| 01:11:54 | adriant | but we need a much much better way of doing multi-method auth across all of OpenStack | |
| 08:44:50 | openstackgerrit | Romain Acciari proposed openstack-infra/shade master: create_subnet: Add filter on tenant_id if specified https://review.openstack.org/556782 | |
| 12:57:35 | openstackgerrit | Romain Acciari proposed openstack-infra/shade master: create_subnet: Add filter on tenant_id if specified https://review.openstack.org/556782 | |
| 15:00:35 | openstackgerrit | Merged openstack/openstacksdk master: add lower-constraints job https://review.openstack.org/556173 | |
| 21:41:46 | openstackgerrit | Hongbin Lu proposed openstack/python-openstackclient master: Disallow setting default on internal network https://review.openstack.org/539303 | |
| 21:41:58 | openstackgerrit | Hongbin Lu proposed openstack/python-openstackclient master: Add option '--mtu' to network create/set https://review.openstack.org/540530 | |
| #openstack-sdks - 2018-03-28 | |||
| 03:44:39 | openstackgerrit | Logan V proposed openstack/os-client-config master: Add Limestone Networks vendor info https://review.openstack.org/557139 | |
| 04:17:13 | mrhillsman | adriant see - https://github.com/gophercloud/utils/pull/26 | |
| 04:17:25 | mrhillsman | generally quick response :) | |
| 04:18:10 | mrhillsman | you may be able to help push it through by reviewing/trying it even though jtopjian may not merge it until after jrperritt review | |
| 04:25:59 | adriant | mrhillsman: looks good, code (despite not entirely understanding go) makes sense. | |
| 04:26:27 | mrhillsman | ++ | |
| 04:28:08 | adriant | mrhillsman: and did you file a bug to terraform for the OS_TOKEN value? | |
| 04:28:31 | mrhillsman | i did not | |
| 04:28:45 | adriant | it might also be worth asking terraform/gophercloud peeps why gophercloud and terraform both differently handle environment variables. | |
| 04:28:48 | mrhillsman | jtopjian maintains that as well | |
| 04:29:48 | mrhillsman | unfortunately i do not know go well enough to know | |
| 04:29:58 | adriant | mrhillsman: want me to submit that bug and potentially ask at the same time? | |
| 04:30:06 | mrhillsman | i just started working on learning it about a month ago | |
| 04:30:24 | mrhillsman | yeah, i think you should and reference the issue and pr | |
| 04:30:29 | adriant | kk | |
| 04:30:35 | mrhillsman | thx adriant | |
| 05:31:56 | adriant | mrhillsman: https://github.com/terraform-providers/terraform-provider-openstack/issues/271 | |
| 05:35:42 | adriant | mordred, dtroyer: what exactly is the precedence between: domain_id vs user_domain_id, and project_domain_id ? And the same with domain_name vs user_domain_name, and project_domain_name ? | |
| 05:36:46 | adriant | I'd assume (and probably incorrectly) that domain_id comes first in our tools and then if one of the other two is set, they take precedence? | |
| 05:38:08 | adriant | mordred: does os-client-config even use OS_DOMAIN_ID and OS_DOMAIN_NAME or the user/project specific ones? I may take a gander at the code | |
| 05:38:11 | mrhillsman | cool, thanks for leading the charge on this adriant | |
| 05:38:36 | adriant | mrhillsman: np | |
| 05:38:58 | adriant | mrhillsman: with MFA slowly becoming a thing in openstack token auth in these tools will be VERY important | |
| 05:39:03 | adriant | so it needs to work | |
| 05:39:19 | adriant | because screw entering your password + MFA things for every commands | |
| 05:39:23 | adriant | that way madness lies | |
| 05:40:09 | adriant | I want a nice easy way to auth in the CLI, save me auth'd token somewhere, and then use that, and ideally have that experience consistent. | |
| 05:40:31 | mrhillsman | willing to bet quite a few folks are going to be happy as a result | |
| 08:10:30 | openstackgerrit | Chen Hanxiao proposed openstack/python-openstackclient master: Add --image-property parameter in 'server create' https://review.openstack.org/535664 | |
| 09:12:52 | openstackgerrit | Chris Dent proposed openstack/api-wg master: Add guidance on needing cache-control headers https://review.openstack.org/550468 | |
| 09:22:52 | openstackgerrit | OpenStack Proposal Bot proposed openstack/python-openstackclient master: Updated from global requirements https://review.openstack.org/553257 | |
| 10:02:31 | openstackgerrit | OpenStack Proposal Bot proposed openstack/python-openstackclient master: Updated from global requirements https://review.openstack.org/553257 | |
| 10:37:02 | openstackgerrit | OpenStack Proposal Bot proposed openstack/python-openstackclient master: Updated from global requirements https://review.openstack.org/553257 | |
| 13:55:58 | mordred | adriant: the user and project versions | |
| 13:56:30 | mordred | adriant: OS_DOMAIN_ID and OS_DOMAIN_NAME _can_ be used, but they actually commuicate different information than OS_PROJECT_DOMAIN_NAME and OS_USER_DOMAIN_NAME | |
| 13:56:57 | mordred | adriant: OS_DOMAIN_ID and OS_DOMAIN_NAME (or, rather, the keystoneauth parameters domain_name and domain_id) are used to create a domain-scoped token | |
| 13:57:54 | mordred | adriant: so, domain_name is not a way to set domain for both user and project - it has a whole other meaning | |
| 13:58:28 | mordred | adriant: I *think* somewhere (it might be python-openstackclient) there was an addition of default_domain_name - that could be used to set domain name once for both user and project | |
| 14:00:29 | mordred | adriant, mrhillsman: also - token auth is not the answer for api access for MFA clouds ... I'd actually argue that any time anyone (who is not already an openstack service) directly uses token auth something else has fundamentally broken | |