| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-sdks - 2018-03-28 | |||
| 14:01:12 | mordred | THAT SAID - obviously token auth should work - and if it doesn't we should fix it | |
| 14:59:20 | openstackgerrit | Sami Makki proposed openstack/python-openstackclient master: Fix the `role implies list` command. https://review.openstack.org/557359 | |
| 15:25:05 | EmilienM | dtroyer: do you think it would be possible to cut a tag on osc (based on latest patch that landed: https://review.openstack.org/#/c/553374/)? It's currently blocking TripleO to move forward in Rocky | |
| 18:39:57 | openstackgerrit | Merged openstack/keystoneauth master: Be more helpful when version discovery fails https://review.openstack.org/554044 | |
| 18:56:37 | dtroyer | mordred: having your +1 on https://review.openstack.org/557479 (DevStack, one more SDK rename) might be nice | |
| 18:57:01 | dtroyer | it's why osc's -tips jobs are failing | |
| 19:05:19 | mordred | dtroyer: oh poo. sorry - I thought I'd gotten them all | |
| 21:22:27 | adriant | mordred: ty! That makes more sense, if not also being confusing... | |
| 21:24:14 | mordred | adriant: I would have liked them better if they had been called "realm" I think | |
| 21:24:27 | mordred | adriant: but yeah | |
| 21:24:32 | adriant | domains are already projects, but.. the painful and confusing fact that you can scope to a domain, and a project that is a domain... | |
| 21:24:36 | adriant | is evil | |
| 21:24:43 | adriant | EVIL | |
| 21:25:24 | adriant | and as it turns out by giving yourself a role assignment on the same domain/project with both scopes breaks keystone :P | |
| 21:25:38 | adriant | you now have a role assignment you can't remove! | |
| 21:27:01 | mordred | yay! | |
| 21:27:11 | adriant | and mordred: regarding tokens being the answer to MFA. I disagree that appcreds are the answer. When you're using the CLI you don't really want to use app creds. For services, yes, and then you wouldn't do MFA. | |
| 21:27:32 | adriant | but for using your own account and needing to do stuff... having to provide a password+totp every time is a nope | |
| 21:28:04 | adriant | so basically with my own CLI use, I do it like horizon does. Auth first, store token, use APIs. | |
| 21:28:21 | adriant | and MFA in horizon will do the same | |
| 21:28:57 | adriant | you front load the MFA, and then once you have a token, everything just works. | |
| 21:29:23 | mordred | adriant: what happens when your token expires? | |
| 21:29:29 | adriant | I get a new one | |
| 21:29:45 | adriant | horizon does the same :P | |
| 21:29:48 | adriant | it logs me out | |
| 21:29:48 | mordred | nod | |
| 21:29:54 | mordred | well - yah - but horizon is different :) | |
| 21:30:26 | adriant | but using a command line utility is not different than using horizon really | |
| 21:30:27 | mordred | it's possible that I have a warped view of cloud interactions as well | |
| 21:30:50 | adriant | you have a token based session, but in the case of the cli, it's one token per command | |
| 21:31:06 | adriant | that's a lot of tokens | |
| 21:31:10 | mordred | adriant: my typical usage locally is either an ansible playbook, or python loaded in a repl | |
| 21:32:07 | mordred | so I guess I usually tend to behave more like an automated service than like an interactive user ... | |
| 21:32:26 | adriant | yeah, and I use my silly interpreter thing, but off the cli | |
| 21:32:32 | mordred | in any case - you make good points, so I will stop telling people they're wrong when they use token directly :) | |
| 21:33:32 | adriant | basically one of the things I'll end up doing as part of the MFA work in keystone is an eventual follow up to the openstackclient that adds support for catching and handling the auth-receipts. | |
| 21:33:44 | adriant | either into an interactive set of prompts to ask for MFA details | |
| 21:34:00 | adriant | or at least just a good error output of what methods were missing | |
| 21:34:25 | adriant | with a potential extra command added to the openstack cli that authenticates you, and sets/unsets the right values needed for token auth for future commands | |
| 21:34:31 | EmilienM | would it be possible to have a release of osc once https://review.openstack.org/557479 is merged? | |
| 21:36:01 | adriant | mordred: so MFA related interactions with the openstackcli consist of: "openstack authenticate" followed by an interactive MFA prompt or two, and then following commands work off token auth. | |
| 21:36:31 | adriant | maybe, we need to work out what makes sense once the auth-receipt stuff is implemented in keystone and keystoneauth | |
| 22:52:02 | dtroyer | EmilienM: looks like it merged, I need to get some things going yet, will request the release tomorrow, it's queued up and ready to fire | |
| 22:52:20 | EmilienM | woot | |
| 22:52:25 | EmilienM | dtroyer: thank you, i'll help a lot | |
| 22:52:31 | EmilienM | it'll help a lot I mean | |
| 22:56:45 | dtroyer | my apologies for this taking so long… my time for OSC is down to $FAR_TOO_LITTLE | |
| 23:01:19 | EmilienM | no worries :) | |
| #openstack-sdks - 2018-03-29 | |||
| 01:15:42 | openstackgerrit | Merged openstack/osc-lib master: add lower-constraints job https://review.openstack.org/556059 | |
| 04:03:54 | openstackgerrit | Logan V proposed openstack/os-client-config master: Add Limestone Networks vendor info https://review.openstack.org/557139 | |
| 04:23:16 | openstackgerrit | Merged openstack/python-openstackclient master: Fix additional output encoding issues https://review.openstack.org/554698 | |
| 07:46:08 | openstackgerrit | Sami Makki proposed openstack/python-openstackclient master: Fix the `role implies list` command. https://review.openstack.org/557359 | |
| 13:21:04 | openstackgerrit | Merged openstack/python-openstackclient master: add lower-constraints job https://review.openstack.org/556172 | |
| 13:23:21 | openstackgerrit | Merged openstack/python-openstackclient master: Updated from global requirements https://review.openstack.org/553257 | |
| 13:24:10 | jpich | dtroyer: Hi! I'm told RDO needs tagged releases to be able to consume backports on stable branches so I took the liberty to post a couple of release patches for osc and cliff. Hopefully that's ok, I'm not sure if that helps or if it's just as much work on your side - please let me know if there's something I could do differently! Thank you. | |
| 13:24:39 | jpich | dhellmann: I see you're the release liaison for OSC so this may be relevant ^, just fyi and fmi too on the preferred way to handle things! :) | |
| 13:55:21 | dtroyer | jpich: I am planning an OSC release today anyway, just now getting back to check if the reviews I was waiting on passed... | |
| 13:55:41 | dtroyer | \o/ | |
| 13:56:30 | dtroyer | Oh, yes, I missed you were talking about stable, I'll look at that next. thanks | |
| 13:57:05 | jpich | Awesome!! And no problems, good luck with all the releasing :) | |
| 13:57:43 | dtroyer | thanks, we're way overdue. | |
| 14:22:44 | dtroyer | EmilienM: osc 3.15.0 on its way https://review.openstack.org/557716 \o/ finally | |
| 14:24:57 | dtroyer | jpich: +! on both pike releases… there was an SDK compat issue in stable/queens so OSC 3.14.1 is in the queue too | |
| 14:40:53 | EmilienM | dtroyer: thanks a lot! | |
| 14:42:19 | jpich | dtroyer: Awesome, thank you! | |
| 14:42:59 | dtroyer | I just found a backport of the —mtu option to queens, will merge that before the 3.14.1 release | |
| 14:50:44 | dtantsur | cdent: hey! our meeting is in 1:10, right? /me has summer time now | |
| 14:51:28 | cdent | dtantsur: yeah, that's right. I'm disoriented too | |
| 14:51:48 | dtantsur | cool! my calendar shows it correctly, but it was incorrect for another meeting, soooo... :) | |
| 15:49:24 | openstackgerrit | Merged openstack/python-openstackclient master: Update help text for encryption provider https://review.openstack.org/545459 | |
| 15:53:03 | openstackgerrit | Monty Taylor proposed openstack/openstacksdk master: Run normalize_keys on config for session codepath https://review.openstack.org/547159 | |
| 16:00:27 | elmiko | cdent: around? | |
| 16:00:41 | cdent | sigh, this is going to happen every week | |
| 16:01:01 | elmiko | lol, only till the fall =) | |
| 16:05:21 | cdent | no, it's because of tc office hours being right before api-sig, and they move in sync | |
| 16:05:25 | cdent | elmiko: ^ | |
| 16:05:35 | elmiko | ahhh | |
| 16:06:21 | openstackgerrit | Monty Taylor proposed openstack/openstacksdk master: Remove the need for OpenStackConfig in CloudRegion https://review.openstack.org/547488 | |
| 16:08:14 | openstackgerrit | Monty Taylor proposed openstack/openstacksdk master: Add image_format for VEXXHOST profile https://review.openstack.org/557748 | |
| 16:08:40 | openstackgerrit | Monty Taylor proposed openstack/os-client-config master: Replace guts with openstack.config https://review.openstack.org/549307 | |
| 16:11:49 | mordred | SamYaple, Shrews, rods, slaweq: if you have a sec, I'd like to land 547159, 547488, 556089 and 555710 and then cut an sdk release | |
| 16:17:21 | SamYaple | mordred: 547488 is in merge conflict | |
| 16:22:47 | mordred | bother | |
| 16:46:29 | openstackgerrit | Monty Taylor proposed openstack/api-wg master: Update parameter names in microversion sdk spec https://review.openstack.org/557773 | |
| 16:46:47 | mordred | dtantsur, elmiko, cdent, edleafe: ^^ there's one | |
| 16:47:33 | elmiko | mordred: wow, quick draw mcmordred! | |
| 16:48:02 | dtantsur | mordred: to be honest, I hate it | |
| 16:48:28 | dtantsur | I guess you were not in the room in Dublin when I was ranting about "micro"? | |
| 16:48:38 | openstackgerrit | Merged openstack/api-wg master: Add guideline on exposing microversions in SDKs https://review.openstack.org/532814 | |
| 16:48:53 | dtantsur | tl;dr "micro" only makes any sense to 3-6 people involved in API SIG, and absolutely no sense to everyone else | |
| 16:50:18 | mordred | dtantsur: that's fair - but we have two completely different types of versions with completely different semantics | |
| 16:50:24 | mordred | dtantsur: I mean, I don't like the name either | |
| 16:50:53 | dtantsur | mordred: similarly to what we discussed today, I would like the major version to be taken from the "just version" | |
| 16:51:08 | dtantsur | it would be different if we did not include the major version in the microversion | |
| 16:51:21 | dtantsur | (see it already makes little sense - a major version is contained in a micro!) | |
| 16:51:47 | mordred | dtantsur: so - unfortunately, we have services that didn't implement microversions (yet) and include minor versions in their api versions | |
| 16:52:03 | dtantsur | oh | |
| 16:52:04 | mordred | glance 2.8, for instance | |
| 16:52:05 | dtantsur | my | |
| 16:52:07 | dtantsur | god | |