| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-sdks - 2018-05-16 | |||
| 12:42:57 | dtantsur | folks, who knows what magic to add to keystoneauth Session to make it work with custom SSL certificates that are installed in the system? | |
| 12:43:17 | mordred | dtantsur: morning! | |
| 12:43:22 | dtantsur | I know that openstackclient, ironicclient, etc work correctly, but a naively written application does not.. | |
| 12:43:30 | dtantsur | hey mordred | |
| 12:44:08 | dtantsur | (it's not impossible that tripleo sets up certificates in a weird way, but everything seems okay with it...) | |
| 12:44:26 | mordred | dtantsur: verify and cert are the arguments you want | |
| 12:44:42 | dtantsur | mordred: okay, but what do I set them to? | |
| 12:44:54 | mordred | dtantsur: they take weird argugments - one sec | |
| 12:45:44 | mordred | dtantsur: https://docs.openstack.org/keystoneauth/latest/api/keystoneauth1.html#keystoneauth1.session.Session | |
| 12:45:58 | mordred | dtantsur: verify takes either True or False of the path to a CA bundle | |
| 12:46:26 | dtantsur | here's a funny thing: just using plain requests works, various CLI work, my application trying to pass a Session to ironicclient does not... | |
| 12:46:26 | mordred | dtantsur: cert is either a path to a single bundle with cert and key, or a tuple of (cert_path, key_path) | |
| 12:47:21 | dtantsur | so yeah, I know this one, but I don't know where to get these parameters.. should they come from CLI args? | |
| 12:47:29 | dtantsur | like where in https://review.openstack.org/#/c/568688/8/metalsmith/_cmd.py do I wire them in? | |
| 12:47:53 | mordred | dtantsur: oh - you're using openstack.config (good) - one sec | |
| 12:48:09 | dtantsur | mordred: I tried before that patch (with directly using Session) and with it | |
| 12:48:22 | dtantsur | maybe ditching ironicclient will help, dunno :) | |
| 12:48:33 | mordred | it will - but let's get this one working :) | |
| 12:49:44 | dtantsur | another fun fact: it Works On DevStack (tm) | |
| 12:50:10 | mordred | :) | |
| 12:51:44 | mordred | dtantsur: it should be --os-cacert --os-cert and --os-key | |
| 12:52:23 | dtantsur | okay, but what I don't understand is *why* I have to provide it | |
| 12:52:46 | dtantsur | the certificate is (apparently) in the system store, and devstack is fine with what I'm doing | |
| 12:52:58 | mordred | I would say that it's not actually in the system store | |
| 12:53:42 | mordred | by default with no parameters everything should be set up to look for CAs in the system store | |
| 12:53:54 | dtantsur | right, so I wonder what magic tripleo uses | |
| 12:55:01 | mordred | it's possible this is related to the weirdness with requests bundling certs | |
| 12:55:33 | dtantsur | mmm, possibly. because I try metalsmith from a venv | |
| 12:55:42 | mordred | I can't remember all the details, but in some combos the 'system' ca bundles requests looks for are not the system ca bundles but are instead the built-in vendored ca bundles in requests | |
| 12:56:01 | mordred | because *bong* | |
| 12:56:08 | dtantsur | AHA! | |
| 12:56:17 | dtantsur | I tried 'ironic' command from venv and it failed as well | |
| 12:56:26 | mordred | yah. it'll be the vendored bundles thing | |
| 12:56:44 | dtantsur | so I guess no one is to blame, I'm just unlucky? | |
| 12:56:44 | mordred | I always just put a path to the ca into my clouds.yaml just to be sure | |
| 12:56:57 | mordred | well - I think someone is to blame ... but blaming them won't fix anything :) | |
| 12:57:03 | dtantsur | fair | |
| 12:57:17 | mordred | apparently "finding system installed ca bundles on all platforms is too hard" | |
| 12:57:31 | dtantsur | okay, I guess my patch is ready to land (unless you want to review it) | |
| 12:57:41 | mordred | neat - lemme look just for fun | |
| 12:58:01 | mordred | your commit message makes me happy | |
| 12:58:36 | dtantsur | follow-up patches will make you even happier :) | |
| 13:02:11 | dtantsur | mordred: something in openstacksdk confuses me. we have connection.update_machine (for example) and connection.baremetal.update_node | |
| 13:02:22 | mordred | dtantsur: those all look great! there's a stack of sdk patches that should put us in a good position to support what you need from microversions for ironic | |
| 13:02:24 | dtantsur | which one is supposed to be used? connection.baremetal does not have many eatures | |
| 13:02:29 | dtantsur | cool! | |
| 13:02:52 | mordred | dtantsur: yah - so - connection.update_machine is the shade method that TheJulia wrote | |
| 13:03:26 | mordred | connection.baremetal is the support for ironic that was in the sdk before the merge - we still have work to do to merge the two of them into a single piece of sanity | |
| 13:04:14 | dtantsur | mordred: and which one will be the final? | |
| 13:04:19 | mordred | but if there is a method directly on connection, I'd use it - it'll be the same code that backs up the ansible modules/bifrost | |
| 13:04:59 | dtantsur | sure, it's just confusing. and I don't want to start relying on something that is pending deprecation | |
| 13:05:31 | mordred | yah - you should be safe with the connection methods- they're not going to get deprecated | |
| 13:06:18 | mordred | it'll either remain different or might become just a convenience wrapper around connection.baremetal - but it won't go away | |
| 13:07:34 | dtantsur | neat! while we're here: are you open to adding things like "deploy_machine", "provide_machine", etc? essentially, convenience wrappers around node_set_provision_state, similar to inspect_machine? | |
| 13:07:43 | mordred | absolutely! | |
| 13:09:41 | dtantsur | okay, I may be able to carve some time for these | |
| 13:10:03 | dtantsur | actually, I'd rename node_set_provision_state to something, because consistency | |
| 13:10:08 | mordred | woot! | |
| 13:10:51 | mordred | machine_set_provision_state perhaps? | |
| 13:12:12 | mordred | or, honestly, I think set_machine_provision_state is more in keeping with the verb_noun pattern | |
| 13:17:51 | dtantsur | yeah, I like the latter more | |
| 13:30:32 | frickler | dtantsur: mordred: this might be related to the ca issue, but also doesn't have a solution yet https://storyboard.openstack.org/#!/story/1756723 | |
| 13:31:12 | dtantsur | not wow | |
| 13:34:01 | mordred | frickler: that's awesome | |
| 13:35:13 | mordred | frickler: so - I think that's going to be an issue with parameter exchange between osc and sdk ... and should be a thing we can fix as part of the rework of how the config is processed and objects get created in osc 4 | |
| 13:42:08 | frickler | mordred: so when should this "osc 4" thing happen? I'm having a hard time already finding reviewers for small patches to current OSC | |
| 13:44:23 | mordred | frickler: I think it's a thing dtroyer has already started in on ... are you going to be in vancouver next week? | |
| 13:45:26 | frickler | nope | |
| 13:46:34 | mordred | darn. well - after I finish debugging this morning's sdk patch, lemme see if I can spot an easier path to fixing yourbug | |
| 13:47:24 | openstackgerrit | Monty Taylor proposed openstack/openstacksdk master: Rename service_key to service_type https://review.openstack.org/558049 | |
| 13:47:24 | openstackgerrit | Monty Taylor proposed openstack/openstacksdk master: Pass default_microversion to adapter constructor https://review.openstack.org/557935 | |
| 15:16:35 | openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Collect timing information for API calls https://review.openstack.org/568877 | |
| 15:16:36 | openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Add oslo.config option for split-loggers https://review.openstack.org/568878 | |
| 15:30:58 | openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Return the endpoint_override from EndpointData https://review.openstack.org/491947 | |
| 15:56:46 | openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Stop using pbr autodoc https://review.openstack.org/568889 | |
| 16:20:56 | openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Allow registering additional plugin loaders https://review.openstack.org/333126 | |
| 17:33:13 | openstackgerrit | Colleen Murphy proposed openstack/keystoneauth master: [DNM] See if latest pbr is causing our docs problems https://review.openstack.org/568909 | |
| 20:44:43 | openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Collect timing information for API calls https://review.openstack.org/568877 | |
| 20:44:44 | openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Add oslo.config option for split-loggers https://review.openstack.org/568878 | |
| 20:45:07 | openstackgerrit | Merged openstack/keystoneauth master: Fix logging of encoded headers https://review.openstack.org/568365 | |
| 21:52:28 | openstackgerrit | Merged openstack/keystoneauth master: Return the endpoint_override from EndpointData https://review.openstack.org/491947 | |
| #openstack-sdks - 2018-05-17 | |||
| 09:58:54 | openstackgerrit | Stephen Breyer-Menke proposed openstack/openstacksdk master: Support add/remove user to/from group https://review.openstack.org/569080 | |
| 10:17:01 | openstackgerrit | Stephen Breyer-Menke proposed openstack/openstacksdk master: Support add/remove user to/from group https://review.openstack.org/569082 | |
| 12:04:33 | openstackgerrit | Stephen Breyer-Menke proposed openstack/openstacksdk master: Support add/remove user to/from group https://review.openstack.org/569097 | |
| 15:56:20 | gtema | mordred: what is the default python version for shade-ansible tests? Is it the one from system? In openstacksdk tox it is set by default for python2, but not in shade. There is an issue in Ansible (https://github.com/ansible/ansible/issues/39472), which makes keypair role fail for me with python 3.6 | |
| 16:02:26 | mordred | gtema: yeah - we're not setting it explicitly in the tox config. we should definitely fix that module with the fix in that issue ... do you have any interest in making a PR to ansible and I can approve it? (otherwise I can get it up there) | |
| 16:10:30 | gtema | mordred: making it currently. Will be in couple of minutes | |
| 16:18:32 | gtema | mordred: https://github.com/ansible/ansible/pull/40341 | |
| 16:32:45 | edleafe | elmiko: too late - the session was just announced: http://lists.openstack.org/pipermail/openstack-dev/2018-May/130617.html | |
| 16:36:03 | elmiko | edleafe: thanks for the heads up, and no worries | |
| 16:36:21 | elmiko | i'm gonna see if i can just stay till thursday | |
| 16:42:52 | elmiko | cdent edleafe dtantsur, ready for review: https://etherpad.openstack.org/p/api-sig-newsletter | |
| 16:43:54 | elmiko | how did i drop bof from there... i had it in originally | |
| 16:44:54 | elmiko | ++ good additions | |
| 16:45:23 | edleafe | elmiko: done | |
| 16:45:42 | elmiko | thanks edleafe ! | |
| 16:47:56 | cdent | not much to add beyond what edleafe has said. what's there is fine, but if you want to make the second session sound more exciting you could order it a bit differently: it is _explicitly_ about how to drop old functionality | |
| 16:48:46 | cdent | elmiko: ^ | |
| 16:48:58 | edleafe | cdent: you should add wording to that effect then | |
| 16:49:15 | cdent | i'm not sure how to say it. thus bouncing the idea here | |