Posted	Nick	Remark
#openstack-sdks - 2019-03-10
16:25:36	openstackgerrit	Merged openstack/openstacksdk master: Fix some typos https://review.openstack.org/642239
16:32:41	openstackgerrit	Monty Taylor proposed openstack/openstacksdk master: Move pep8 requirements in to test-requirements https://review.openstack.org/640597
17:26:02	openstackgerrit	Merged openstack-infra/shade master: fix the word 'bandwith' https://review.openstack.org/616513
19:43:19	openstackgerrit	Monty Taylor proposed openstack/openstacksdk master: Collect request stats https://review.openstack.org/614834
22:17:31	openstackgerrit	Monty Taylor proposed openstack/openstacksdk master: Revert "Replace TaskManager with a keystoneauth concurrency" https://review.openstack.org/642298
22:17:32	openstackgerrit	Monty Taylor proposed openstack/openstacksdk master: Revert "Revert "Replace TaskManager with a keystoneauth concurrency"" https://review.openstack.org/642299
#openstack-sdks - 2019-03-11
02:41:39	openstackgerrit	Merged openstack/python-openstackclient master: Add 'security_group' type support to network rbac commands https://review.openstack.org/636760
07:45:57	openstackgerrit	Merged openstack/openstacksdk master: Revert "Replace TaskManager with a keystoneauth concurrency" https://review.openstack.org/642298
10:56:28	openstackgerrit	Jakub Jursa proposed openstack/openstacksdk master: added support for binding:profile parameter in create_port/update_port https://review.openstack.org/642418
11:39:16	openstackgerrit	Merged openstack/openstacksdk master: Revert "Revert "Replace TaskManager with a keystoneauth concurrency"" https://review.openstack.org/642299
11:39:41	openstackgerrit	Merged openstack/openstacksdk master: Deprecate ServerDetails class https://review.openstack.org/642094
11:51:51	openstackgerrit	Merged openstack/openstacksdk master: Move object methods to object_store proxy https://review.openstack.org/638731
11:58:04	dtantsur	mordred or Shrews, when you have a minute: https://review.openstack.org/#/c/641610/
12:01:21	openstackgerrit	Merged openstack/openstacksdk master: Swap human-facing links to use opendev.org https://review.openstack.org/642227
12:47:04	openstackgerrit	Glenn Van de Water proposed openstack/python-openstackclient master: Fix service discovery in functional tests https://review.openstack.org/642074
14:28:28	openstackgerrit	Merged openstack/openstacksdk master: baremetal: support server-side configdrive building (API 1.56) https://review.openstack.org/641610
15:12:41	openstackgerrit	Glenn Van de Water proposed openstack/python-openstackclient master: Fix service discovery in functional tests https://review.openstack.org/642074
15:31:36	openstackgerrit	Ed Leafe proposed openstack/api-sig master: Clarify the advice on tags when creating a resource https://review.openstack.org/642497
15:42:47	openstackgerrit	Monty Taylor proposed openstack/openstacksdk master: Collect request stats https://review.openstack.org/614834
15:42:47	openstackgerrit	Monty Taylor proposed openstack/openstacksdk master: Collapse OpenStackSDKAdapter into Proxy https://review.openstack.org/642231
15:50:06	openstackgerrit	Merged openstack/openstacksdk master: Remove outdated devstack section from docs https://review.openstack.org/642228
17:20:04	openstackgerrit	Merged openstack/openstacksdk master: Move pep8 requirements in to test-requirements https://review.openstack.org/640597
17:31:34	openstackgerrit	Glenn Van de Water proposed openstack/python-openstackclient master: Fix service discovery in functional tests https://review.openstack.org/642074
19:45:11	openstackgerrit	Monty Taylor proposed openstack/openstacksdk master: Collect request stats https://review.openstack.org/614834
19:45:11	openstackgerrit	Monty Taylor proposed openstack/openstacksdk master: Collapse OpenStackSDKAdapter into Proxy https://review.openstack.org/642231
#openstack-sdks - 2019-03-12
03:08:13	adriant	mordred: is there a way to initialise the SDK while specifying the identity url (or telling it to reuse the auth_url) so you can use it to query your own project list without having to scope? Because it fails if I don't give it a project ID when it tries to get identity url from the catalog.
03:09:26	adriant	connection.Connection(auth=dict(...with no project id), identity_url='https://auth.example.com') ?
03:09:26	adriant	can I just do:
03:17:05	adriant	Not sure if that's ultimately a keystoneauth thing
05:44:50	openstackgerrit	Ian Wienand proposed openstack/openstacksdk master: Replace openstack.org git:// URLs with https:// https://review.openstack.org/642652
09:47:32	openstackgerrit	Kailun Qin proposed openstack/python-openstackclient master: Fix: set invalid None project_id on range creation https://review.openstack.org/642707
09:49:33	openstackgerrit	Kailun Qin proposed openstack/python-openstackclient master: Fix: incorrect check when no shared/private input https://review.openstack.org/642708
10:10:08	openstackgerrit	Kailun Qin proposed openstack/python-openstackclient master: Fix: incorrect check when no shared/private input https://review.openstack.org/642708
10:36:02	openstackgerrit	Glenn Van de Water proposed openstack/python-openstackclient master: Fix service discovery in functional tests https://review.openstack.org/642074
11:48:27	openstackgerrit	Merged openstack/openstacksdk master: Replace openstack.org git:// URLs with https:// https://review.openstack.org/642652
11:48:31	openstackgerrit	Merged openstack/openstacksdk master: Deprecate VolumeDetail and BackupDetail classes https://review.openstack.org/642107
12:20:26	openstackgerrit	Glenn Van de Water proposed openstack/python-openstackclient master: Fix service discovery in functional tests https://review.openstack.org/642074
13:04:48	mordred	adriant: hrm. that's a good question. I would assume we're just passing through to ksa - but we might be doing something wrong there
13:06:24	mordred	adriant: that said - the unscoped keystone actions may need some thought - because we do try to run discovery when conn.identity gets created. let's see if we can't come up with a solution :)
15:54:05	openstackgerrit	Artem Goncharov proposed openstack/openstacksdk master: WIP Split OpenStackCloud into reasonable pieces https://review.openstack.org/642218
16:30:00	openstackgerrit	Glenn Van de Water proposed openstack/python-openstackclient master: Fix service discovery in functional tests https://review.openstack.org/642074
17:30:43	mordred	gtema: no - there will be no git:// protocol support from opendev - so if you wanna try it out, cloning over https:// is the way to go (it'll also be the only way to go in the future)
20:54:44	adriant	mordred: for context, in cases where you are doing multi-project actions, or writing tools for them, you don't really need to know ahead of time what projects you have. So you can auth, get a list, and then create an SDK per project (per region), and do your actions.
20:56:04	adriant	the solution I've helped someone go with is to use keystone auth to get a session, get the token from that, then use raw requests against the auth url (and correct user_projects path) to then get their project list, and then use that to further make their SDKs per project.
20:56:40	adriant	It's not a terrible solution, but the need to actually go directly to the endpoint and handle the json yourself is lacking a bit of elegance
20:57:02	adriant	although... I wonder
20:57:12	adriant	kmalloc: can you list your projects via KeystoneAuth?
20:58:46	mordred	adriant: cause if I don't have a project id when I get the token, I don't get a catalog, right? thus the "re-use the auth_url as the identity_url" piece, yeah?
20:58:57	adriant	yep
20:59:02	adriant	you have an empty catalog
20:59:10	adriant	so it need to do discovery
20:59:16	adriant	i want a way to bypass that step
20:59:27	adriant	"use this custom catalog instead" potentially
20:59:29	mordred	adriant: so - if you set identity_endpoint_override to the auth_url - it'll skip discovery
20:59:40	adriant	ah!
20:59:43	adriant	perfect
21:00:09	adriant	so "<service_type>_endpoint_override" works?
21:00:18	mordred	let me know if that works - if it does, I think it might be nice to figure out how to make conn.identity.list_projects - or at least conn.list_projects be able to do this without the user needing to know that specific piece of magic
21:00:18	adriant	for all services?
21:00:21	mordred	adriant: yes!
21:00:31	adriant	cool
21:00:53	adriant	and yeah, ideally having the unscoped actions able to natively reuse the auth_url for identity could be cool
21:01:09	adriant	but that could also be a pain
21:01:21	mordred	yeah. the biggest hurdle would be getting conn.identity to not fall over when it gets created
21:01:43	mordred	which is why this one might be better up at the Connection layer so we can bypass that stuff
21:04:23	adriant	identity_endpoint_override seems to work
21:06:03	mordred	\o/
21:06:25	mordred	cool. then I think we should definitely update Connection.list_projects to do the right thing
21:07:29	mordred	that said - I wonder if we can make the proxy creation smarter if service_type is identity - and to look at the auth stuff, look for project info, and if it's not there go ahead and set the endpoint_override ...
21:09:20	adriant	mordred: specifically the endpoint I'm actually after for this use case is conn.identity.user_projects() which is the non-admin one
21:09:40	adriant	one*
21:09:54	mordred	hrm. we might not have that one in the cloud layer ... but that's a really good point
21:10:07	mordred	I think it's worth making conn.identity work without project info then
21:10:07	adriant	if one exists in the connection layer for listing a user's own projects then that would work too
21:10:35	mordred	it shouldn't be too hard - just need to inspect the auth args a smidge :)
21:10:58	adriant	although it could end up a lot of work, might be worth investigating if other projects have any unscope APIs :/
21:11:11	mordred	it's a good question
21:11:31	mordred	kmalloc, cmurphy: ^^ ? do we know if non-keystone use unscoped apis?
21:11:33	adriant	I have a feeling probably not many
21:11:55	mordred	yeah - seems more like a thing that's needed for keystone and doesn't make a TON of sense elsewhere
21:12:12	mordred	maybe the nova calls that deal with hosts and hypervisors?
21:12:20	adriant	those would be system scope
21:13:13	adriant	Yeah, i think there probably aren't many.
21:13:34	cmurphy	mordred: adriant no, only keystone uses unscoped tokens, it's only useful for getting a scoped token
21:14:18	adriant	although some of the Keystone APIs don't need scope: list (user) projects, change password, etc?
21:15:45	cmurphy	you can list your own projects with an unscoped token, change password i'm not 100% sure though it would make sense
21:16:51	cmurphy	oh change password doesn't require a token at all
21:20:06	adriant	yeah, that's right, you just need your old password
21:41:01	kmalloc	mordred: what cmurphy said
21:41:20	kmalloc	unscoped tokens should die IMO
21:41:25	kmalloc	but we can't make them go away
21:41:56	kmalloc	I *think* someone was originally trying to use unscoped tokens like we use systemscope going forward, but that might require asking folks that no longer work on OpenStack
21:52:16	mordred	kmalloc: so - you and adriant have both mentioned this "system" scoped token
21:52:30	mordred	how does one get one of those? are we missing anything to use those with sdk?
21:59:08	adriant	kmalloc: I don't think unscoped tokens can go away really if you need to query which project you want to scope to first
22:01:22	adriant	for things like Horizon (or any GUI) you won't ever provide a project as part of auth. So some auth flow that includes: "here are your projects" and then allows you to scope into one will always be needed
22:01:49	adriant	we even have some cli tools that only ask for password and username, and then provide you with a list of project options to scope to
22:03:00	kmalloc	mordred: system scope is new, as in as of Stein. It's done just like scope: {project_id: xxx}
22:03:15	cmurphy	mordred: it's supported in ksa so it should be transparent to openstacksdk, instead of setting project-id in clouds.yaml you set system-scope
22:03:31	kmalloc	mordred: ^ what cmurphy said, she's faster at typing than I am clearly

Earlier   Later