Earlier  
Later
New Search
Posted Nick Remark
#openstack-sdks - 2023-05-17
15:39:09 opendevreview Stephen Finucane proposed openstack/python-openstackclient master: volume: Make better use of argparse https://review.opendev.org/c/openstack/python-openstackclient/+/883410
15:50:31 opendevreview Stephen Finucane proposed openstack/python-openstackclient master: docs: Migrate volume commands to autoprogram-cliff https://review.opendev.org/c/openstack/python-openstackclient/+/883361
15:50:31 opendevreview Stephen Finucane proposed openstack/python-openstackclient master: volume: Add 'volume qos set --no-property' option https://review.opendev.org/c/openstack/python-openstackclient/+/433451
16:25:24 opendevreview Stephen Finucane proposed openstack/python-openstackclient master: compute: Fix formatting of 'server show' https://review.opendev.org/c/openstack/python-openstackclient/+/879071
16:42:59 opendevreview Oleksandr Klymenko proposed openstack/python-openstackclient master: Host removed from AZ when service is manually disabled https://review.opendev.org/c/openstack/python-openstackclient/+/883417
16:46:14 opendevreview Oleksandr Klymenko proposed openstack/python-openstackclient master: Host removed from AZ when service is manually disabled https://review.opendev.org/c/openstack/python-openstackclient/+/883418
16:47:16 opendevreview Stephen Finucane proposed openstack/python-openstackclient master: Dropping the use of 'addFixedIp' server action https://review.opendev.org/c/openstack/python-openstackclient/+/878520
17:09:21 opendevreview Merged openstack/python-openstackclient master: Migrate 'volume revert' command to SDK https://review.opendev.org/c/openstack/python-openstackclient/+/883252
17:25:26 opendevreview Antonia Gaete proposed openstack/python-openstackclient master: Metadef resource type list working, and matches glance client output. Removed metadef_resource_type_create since this command is not supported by the SDK. https://review.opendev.org/c/openstack/python-openstackclient/+/883420
23:20:11 opendevreview Merged openstack/python-openstackclient master: Allow server rebuild --wait for SHUTOFF servers https://review.opendev.org/c/openstack/python-openstackclient/+/883154
23:20:17 opendevreview Merged openstack/python-openstackclient master: compute: Fix bug with start/stop server https://review.opendev.org/c/openstack/python-openstackclient/+/883347
23:20:29 opendevreview Merged openstack/python-openstackclient master: volume: Add 'volume qos set --no-property' option https://review.opendev.org/c/openstack/python-openstackclient/+/433451
#openstack-sdks - 2023-05-18
02:32:10 opendevreview Nobuto Murata proposed openstack/openstacksdk master: Bump the chunk_size to use CPU more efficiently https://review.opendev.org/c/openstack/openstacksdk/+/883461
02:53:01 opendevreview Nobuto Murata proposed openstack/openstacksdk master: Bump the chunk_size to use CPU more efficiently https://review.opendev.org/c/openstack/openstacksdk/+/883461
08:11:27 opendevreview Polina Gubina proposed openstack/openstacksdk master: Add find_share() for shared file system share resource https://review.opendev.org/c/openstack/openstacksdk/+/882979
10:14:13 opendevreview Stephen Finucane proposed openstack/python-openstackclient master: trivial: Remove duplicate definitions https://review.opendev.org/c/openstack/python-openstackclient/+/879451
11:52:01 opendevreview Stephen Finucane proposed openstack/openstacksdk master: Add 'callback' to 'wait_for_delete', 'wait_for_status' https://review.opendev.org/c/openstack/openstacksdk/+/868111
11:52:02 opendevreview Stephen Finucane proposed openstack/openstacksdk master: tests: Silence warning https://review.opendev.org/c/openstack/openstacksdk/+/883492
11:52:10 opendevreview Stephen Finucane proposed openstack/python-openstackclient master: compute: Migrate 'delete server' to SDK https://review.opendev.org/c/openstack/python-openstackclient/+/868116
11:52:57 opendevreview Merged openstack/python-openstackclient master: Dropping the use of 'addFixedIp' server action https://review.opendev.org/c/openstack/python-openstackclient/+/878520
11:55:53 opendevreview Mridula Joshi proposed openstack/openstacksdk master: image: Support for stores_info https://review.opendev.org/c/openstack/openstacksdk/+/883493
11:57:27 opendevreview Mridula Joshi proposed openstack/python-openstackclient master: Adding image stores info command https://review.opendev.org/c/openstack/python-openstackclient/+/883494
12:33:02 opendevreview Merged openstack/python-openstackclient master: trivial: Remove duplicate definitions https://review.opendev.org/c/openstack/python-openstackclient/+/879451
13:47:36 stephenfin gtema: Happy Friday. Finally got around to finishing this https://review.opendev.org/c/openstack/openstacksdk/+/868111 Care to take a look?
14:38:05 gtema Yupp, looking
14:41:47 gtema You should be having holiday too, aren't you?
15:09:08 stephenfin nope, no holiday in Ireland, sadly. Didn't realise there was one there. Sorry for bothering you!
15:14:54 gtema No problem.
17:05:43 opendevreview Antonia Gaete proposed openstack/python-openstackclient master: Metadef resource type list working, and matches glance client output. Removed metadef_resource_type_create since this command is not supported by the SDK. https://review.opendev.org/c/openstack/python-openstackclient/+/883420
17:13:57 opendevreview Antonia Gaete proposed openstack/python-openstackclient master: Add image metadef resource type commands {list, create, delete, set} https://review.opendev.org/c/openstack/python-openstackclient/+/883279
17:21:36 opendevreview Merged openstack/openstacksdk master: Add 'callback' to 'wait_for_delete', 'wait_for_status' https://review.opendev.org/c/openstack/openstacksdk/+/868111
#openstack-sdks - 2023-05-19
06:52:00 opendevreview Mridula Joshi proposed openstack/openstacksdk master: Adding support for image upload https://review.opendev.org/c/openstack/openstacksdk/+/881939
07:08:05 opendevreview Mridula Joshi proposed openstack/openstacksdk master: image: Support for stores_info https://review.opendev.org/c/openstack/openstacksdk/+/883493
08:57:27 opendevreview Polina Gubina proposed openstack/ansible-collections-openstack master: Shared file system module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/883201
10:06:31 opendevreview Merged openstack/openstacksdk master: Add find_share() for shared file system share resource https://review.opendev.org/c/openstack/openstacksdk/+/882979
10:13:50 opendevreview Merged openstack/openstacksdk master: ironic: Add support for Introspection Rules https://review.opendev.org/c/openstack/openstacksdk/+/775878
10:37:35 opendevreview Polina Gubina proposed openstack/ansible-collections-openstack master: Shared file system module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/883201
12:59:04 thomasb06 gtema: hey
12:59:27 thomasb06 gtema: eventually setting up an OpenStack prototype...
12:59:55 thomasb06 What's up here since last year?
16:20:20 noonedeadpunk hey there! I was trying to re-use issued tokens in openstackclient in client 6.2.0 using https://docs.openstack.org/python-openstackclient/latest/cli/authentication.html#authentication-plugins and smth feels quite off
16:22:54 noonedeadpunk So, assuming I issue token like that: token=$(openstack token issue -c id -f value --os-cloud default)
16:23:10 noonedeadpunk openstack --os-auth-url http://172.29.236.101:5000/v3 --os-token $token image list does ask for password
16:24:23 noonedeadpunk ok, adding `--os-auth-type token`, but that results in `The service catalog is empty.`
16:24:42 gtema Hmm, i never tried it this way. Will try in next days. Can you maybe try also setting --os-auth-type token (or smth like that)
16:24:45 noonedeadpunk `openstack catalog list --os-cloud default` ofc prints out catalog including image
16:25:31 gtema Aaah, that would be a really interesting case. Catalog is being received with auth response, which you in this case don't issue
16:25:41 noonedeadpunk then I've tried to add more scope, like --os-project-name and --os-domain-name, but that get even weirder
16:26:27 gtema No, scopes are only going into the auth
16:26:45 noonedeadpunk As eventually issuing tokens takes quite some time, and when couple of actions need to be done in a row, it makes sense to re-use tokens...
16:27:26 noonedeadpunk Ofc I tried that with openstack.cloud.auth module and feed token to other modules, which didn't work as well
16:27:26 gtema For that you can use auth caching
16:27:49 noonedeadpunk but auth caching happens on keystone side?
16:28:01 noonedeadpunk so you still need to issue that API request
16:28:35 gtema https://docs.openstack.org/openstacksdk/latest/user/config/configuration.html#cache-settings
16:29:08 gtema But it requires you have keering lib installed
16:29:29 gtema It is not described precisely sadly
16:29:31 noonedeadpunk I'm not sure that will help with my ansible usecase
16:29:49 noonedeadpunk well, it uses clouds.yaml though...
16:29:56 gtema Right, in pure server usage will not that much
16:30:28 noonedeadpunk can oslo.cache drivers be used there?
16:30:35 gtema Keering requires some backend, which on server side is itself eventually require "unsealing"
16:30:48 gtema No, oslo.cache is not used
16:31:34 gtema You can build such backend plugin though
16:33:36 noonedeadpunk As I was thinking to use memcahced with encryption like keystone does
16:34:30 gtema I am sure you can build such plugin for keering
16:34:36 noonedeadpunk But yeah, I guess my main thing was that this module seems pretty much useless now https://opendev.org/openstack/ansible-collections-openstack/src/branch/master/plugins/modules/auth.py
16:35:07 noonedeadpunk as re-using token you get like this is not trivial at all
16:35:17 gtema Well, for that case we could improve SDK to try to fetch catalog when it is not present yet
16:35:48 gtema There is sadly no guarantee this can be received, since not every cloud may allow this call
16:37:42 noonedeadpunk you mean some super old crappy clouds?:)
16:38:13 gtema Yes, or ones with not proper identify policies
16:39:05 noonedeadpunk um, but if it's policy - then you won't be able to get catalog at all?
16:42:50 gtema Not definitely, catalog in the auth response it is not managed by policies afaik
16:43:26 gtema And anyway - if no catalog => try fetch. If not available=> fail
16:43:42 gtema It is anyway already some exception handling case
16:45:30 noonedeadpunk Well, responding with catalog when policy disallows that is kinda weird from keystone side then....
16:45:59 noonedeadpunk but yeah, I never tried that
16:46:51 noonedeadpunk but catalog is weird overall I'd say....
17:06:27 gtema Catalog is one of the best things of Openstack in my eyes. It is not without issues, but still is a very good thing
17:08:45 noonedeadpunk The problem I have with it, is that it exposes internal/admin endpoints
17:09:11 noonedeadpunk Which is weird, as I'd say it should return only endpoint that was in request (or was accessed through)
17:09:53 noonedeadpunk like if you pass interface: public, in return you get internal&admin as well
17:11:13 noonedeadpunk and that disables ability to do some kind of reselling, ie create random interfaces and URI's for it (with different FQDNs). But then you ask for catalog and in return you have like everything...
17:11:55 gtema I guess this will not be a hard stuff to fix, and I agree, this is one of the issues
17:12:48 gtema At a very least it is very easy to build a filtering proxy to be deployed for public
17:18:58 noonedeadpunk ugh, wrappers
17:19:48 noonedeadpunk very-very slippery path
17:19:59 noonedeadpunk anyway :)
17:20:10 noonedeadpunk have a good weekend!
17:22:39 gtema thks, you too
#openstack-sdks - 2023-05-20
06:57:54 frickler noonedeadpunk: gtema: you can define endpoint filters in keystone in order to drop internal/admin endpoints per project. the problem is that things like nova break then, if they are configured to use the internal endpoints to talk to other services, since they will query the catalog with the user creds, too
07:23:45 gtema frickler, but they are using service accounts. It should be possible to hide non public data with a regular access and expose them on other access types. But I agree this is all bit tricky, at least how should osc differentiate an admin willing to do some service configuration from regular user.
09:25:25 noonedeadpunk I would say it smth that could be covered by policy
09:25:53 noonedeadpunk or based on passed `endpoint` in credentials or whenever
09:26:40 gtema I would suggest we can implement default filter = public in the OSC so that by default user will not get other EPs, only when explicitly requested
09:27:16 gtema this will surely not properly hide all other EPs, but at least can be treated as first step on filtering stuff not usefull for end user by default
09:27:37 noonedeadpunk Well, I don't think it's smth that should be done on client side to be frank
09:27:49 noonedeadpunk Maybe endpoint filtering is a thing indeed, need to play with that
09:28:27 gtema I mean before something is done on the server it can be filtered on client side (same as we go in publiccloud with flavors and images while waiting for serverside to be extended)

Earlier   Later