| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-sdks - 2024-02-22 | |||
| 12:25:04 | stephenfin | (btw, context is that gophercloud integration tests inside on a domain ID or name, but I've never seen a clouds.yaml with domain_id/domain_name defined so I'm trying to figure out why it needs it/if I can remove that requirement) | |
| 12:26:12 | gtema | OpenTelekomCloud uses domain scope actively and currently in Keystone there is work on improving it | |
| 12:26:21 | gtema | so you definitely should keep the stuff | |
| 12:27:40 | stephenfin | sorry for being slow on the uptake, but could you give me an example of an API that would use domain scope? | |
| 12:28:03 | stephenfin | you'd use it to...create a new project within a domain? | |
| 12:29:41 | gtema | in OTC all of the Identity ops require domain scope, but lemme check in Keystone what is currently in works | |
| 12:33:57 | gtema | https://review.opendev.org/c/openstack/keystone/+/908524 is one of the recent changes there | |
| 12:34:14 | gtema | it is currently under the RBAC hat | |
| 12:35:37 | gtema | but in principle you are right: creating a new user is a typical domain scope operation (it has no relation to the project) | |
| 14:27:12 | opendevreview | Mridula Joshi proposed openstack/python-openstackclient master: Add CLI support for adding multiple tags https://review.opendev.org/c/openstack/python-openstackclient/+/909870 | |
| 15:31:14 | opendevreview | jamesjordanblack604@gmail.com proposed openstack/python-openstackclient master: Bug Fix, Default SG Rule Custom SG https://review.opendev.org/c/openstack/python-openstackclient/+/909815 | |
| 15:32:51 | opendevreview | jamesjordanblack604@gmail.com proposed openstack/python-openstackclient master: Bug Fix, Default SG Rule Custom SG https://review.opendev.org/c/openstack/python-openstackclient/+/909899 | |
| 16:43:52 | johnsom | gtema On this DNS patch, what other methods are you talking about, can you provide an example? When this was added to the Designate API, designate was the only project that had this capability. | |
| 17:00:24 | gtema | jonsom: I disagree with this statement. Nova (i.e. list servers), Neutron (i.e. list networks), Cinder (i.e. list volumes) support either same or some form of filtering by project_id (independent on whether endpoint already contains project_id) and some also support "all_projects" query parameter. And this is like that since (maybe) beginning? | |
| 17:00:43 | gtema | johnsom ^^ (sorry for typo) | |
| 17:01:33 | johnsom | I think this is a meta-issue across all of the services and something that should be standardized via the api-wg (if there is a member left) | |
| 17:01:33 | johnsom | Likewise, nova has "all_tenants" as a query parameter on list, but neutron does not. | |
| 17:01:33 | johnsom | Nova for example, has no way to create a server on behalf of another project. | |
| 17:01:43 | johnsom | I was just adding that comment to the patch | |
| 17:02:11 | johnsom | This isn't for filtering, those query params are the same. | |
| 17:02:31 | johnsom | It's for impersonating a project or acting across projects | |
| 17:02:39 | gtema | I am left in api-wg, but something like that will not be easy: there is no power to force projects to follow it | |
| 17:03:06 | johnsom | Agreed, but if we at least document a "standard" it's a step in the right direction | |
| 17:03:21 | johnsom | Then it could become a "goal" (not that I am a fan of those) | |
| 17:03:33 | gtema | I agree with the problem and I see it in different places | |
| 17:03:47 | gtema | token scoping is something many people have problem with | |
| 17:03:53 | johnsom | I do | |
| 17:04:20 | johnsom | Don't get me started on system scoped tokens. lol | |
| 17:05:09 | gtema | I think idea of introducing headers is very bad, since once you go into the OpenAPI area this is just going to blow | |
| 17:05:28 | gtema | better approach would be (my personal opinion) is to address token scoping itself | |
| 17:06:20 | johnsom | At one time headers were all the rage in OpenStack. This is very old code in designate, at least 10 years old | |
| 17:06:43 | gtema | it is also unclear in the current implementation: what is the effect for the regular user, can he also use "x-auth-sudo-project" if he do not have roles on that project | |
| 17:07:10 | johnsom | We can't remove that, but if we standardize on another approach I think we would be open to adding it. token scoping is not the solution though, that just adds complexity | |
| 17:07:20 | gtema | really 10 years? I somehow never noticed those | |
| 17:07:48 | johnsom | sudo-project has RBAC rules in the middleware | |
| 17:09:14 | johnsom | Yeah, it was in havana | |
| 17:12:19 | gtema | hmm, I will need to think how to generally address that. I guess for listing "all_projects" and "project_id" as simple query parameter is a de-facto standard, and not headers. Impersonation is something we really need to discuss in wider round (maybe during vPTG) | |
| 17:12:42 | johnsom | neutron does not use those query params | |
| 17:13:04 | gtema | it has tenant_id/project_id | |
| 17:13:34 | johnsom | as a filter on list maybe, but not for create, etc. | |
| 17:14:02 | gtema | right, creation everywhere (well except Designate) is based on the token scope for the current project | |
| 17:14:03 | johnsom | I think designate has that filter too, but they have different purposes. | |
| 17:14:56 | gtema | well, I see Neutron does support setting project_id also for create resources | |
| 17:14:58 | johnsom | Think of this use case, as an admin I want to create a zone for project 123 because they called the help line. | |
| 17:15:11 | gtema | it just states: "Only administrative and users with advsvc role can specify a project ID other than their own. You cannot change this value through authorization policies." | |
| 17:15:26 | johnsom | Right, and nova doesn't. It's just inconsistent across the projects. | |
| 17:16:20 | gtema | well right in that sense. Nova does not allow this | |
| 17:17:04 | gtema | cinder supports | |
| 17:17:35 | gtema | Octavia supports | |
| 17:17:54 | gtema | I think we can observe some mass of core projects that does support that | |
| 17:18:29 | johnsom | Yeah, octavia mirrors neutron in a lot of ways as it had to be API compatible with neutron-lbaas | |
| 17:19:13 | gtema | DNS is also related to networking ;-) | |
| 17:19:55 | johnsom | So, on the designate patch, is it the addition of "headers" the the list method that is of concern or was it just that you thought the headers were new in designate? | |
| 17:20:30 | gtema | as stated I thought it was something new | |
| 17:20:38 | johnsom | Can we move forward with this patch and then work on an api-wg "standard" we can move all of the project towards in the future? | |
| 17:21:40 | gtema | I think in this case it is "ok" | |
| 17:21:58 | gtema | but I am surely very unhappy with that style | |
| 17:23:48 | johnsom | Ok. I am also very happy to work together on creating a standard for this stuff. It would be nice to have a consistent way to do this across the projects. | |
| 17:24:38 | gtema | great | |
| 17:26:43 | johnsom | Hmmm, did the openstack/api-wg repo go away? | |
| 17:27:28 | gtema | https://opendev.org/openstack/api-sig | |
| 17:27:46 | johnsom | Yeah, just found that. The link on the https://specs.openstack.org/openstack/api-wg/ page is wrong | |
| #openstack-sdks - 2024-02-23 | |||
| 16:34:09 | opendevreview | jamesjordanblack604@gmail.com proposed openstack/python-openstackclient master: Bug Fix, Default SG Rule Custom SG https://review.opendev.org/c/openstack/python-openstackclient/+/909815 | |
| #openstack-sdks - 2024-02-26 | |||
| 09:16:41 | opendevreview | Joel Capitao proposed openstack/cliff master: Add fixtures explicitly in test requirements https://review.opendev.org/c/openstack/cliff/+/910152 | |
| 09:23:05 | opendevreview | Joel Capitao proposed openstack/cliff master: Add fixtures explicitly in test requirements https://review.opendev.org/c/openstack/cliff/+/910152 | |
| 10:09:35 | opendevreview | Frode Nordahl proposed openstack/python-openstackclient master: Add router default route BFD/ECMP options https://review.opendev.org/c/openstack/python-openstackclient/+/899382 | |
| 10:09:35 | opendevreview | Frode Nordahl proposed openstack/python-openstackclient master: Add support for managing external gateways https://review.opendev.org/c/openstack/python-openstackclient/+/887976 | |
| 11:13:41 | opendevreview | Mridula Joshi proposed openstack/openstacksdk master: Modified create_image https://review.opendev.org/c/openstack/openstacksdk/+/910218 | |
| 16:53:51 | opendevreview | Manuel Osorio proposed openstack/openstacksdk master: Add quota class set to shared file system https://review.opendev.org/c/openstack/openstacksdk/+/910248 | |
| 17:10:23 | opendevreview | Manuel Osorio proposed openstack/openstacksdk master: Add quota class set to shared file system https://review.opendev.org/c/openstack/openstacksdk/+/910248 | |
| 17:19:15 | opendevreview | Clark Boylan proposed openstack/openstacksdk master: Fix the mailing list domain in documentation link https://review.opendev.org/c/openstack/openstacksdk/+/910250 | |
| #openstack-sdks - 2024-02-27 | |||
| 06:53:35 | opendevreview | Manuel Osorio proposed openstack/openstacksdk master: Add quota class set to shared file system https://review.opendev.org/c/openstack/openstacksdk/+/910248 | |
| 07:17:19 | opendevreview | Manuel Osorio proposed openstack/openstacksdk master: Add quota class set to shared file system https://review.opendev.org/c/openstack/openstacksdk/+/910248 | |
| 12:16:24 | opendevreview | Rajesh Tailor proposed openstack/openstacksdk master: Add support for showing requested az in output https://review.opendev.org/c/openstack/openstacksdk/+/904490 | |
| 16:25:01 | opendevreview | Jan Hartkopf proposed openstack/openstacksdk master: Allow project switching for Designate API https://review.opendev.org/c/openstack/openstacksdk/+/899027 | |
| 19:11:53 | opendevreview | Mridula Joshi proposed openstack/python-openstackclient master: Adding CLI support for ``glance image-create-via-import`` https://review.opendev.org/c/openstack/python-openstackclient/+/893022 | |
| 19:22:05 | opendevreview | Mridula Joshi proposed openstack/python-openstackclient master: Adding client support for ``glance image-upload`` https://review.opendev.org/c/openstack/python-openstackclient/+/882938 | |
| 19:26:50 | opendevreview | Mridula Joshi proposed openstack/openstacksdk master: Adding SDK support for glance md-tags https://review.opendev.org/c/openstack/openstacksdk/+/897276 | |
| 19:49:38 | opendevreview | Mridula Joshi proposed openstack/python-openstackclient master: Adds CLI support for ``glance md-namespace-properties-delete`` https://review.opendev.org/c/openstack/python-openstackclient/+/905746 | |
| 22:58:16 | opendevreview | Manuel Osorio proposed openstack/openstacksdk master: Add quota class set to shared file system https://review.opendev.org/c/openstack/openstacksdk/+/910248 | |
| #openstack-sdks - 2024-02-28 | |||
| 04:11:48 | opendevreview | Steve Baker proposed openstack/ansible-collections-openstack master: Add application_credential module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/910463 | |
| 06:17:05 | opendevreview | Mridula Joshi proposed openstack/openstacksdk master: Fixed update_metadef_object https://review.opendev.org/c/openstack/openstacksdk/+/908916 | |
| 06:21:00 | opendevreview | Frode Nordahl proposed openstack/python-openstackclient master: Add router default route BFD/ECMP options https://review.opendev.org/c/openstack/python-openstackclient/+/899382 | |
| 06:21:00 | opendevreview | Frode Nordahl proposed openstack/python-openstackclient master: Add support for managing external gateways https://review.opendev.org/c/openstack/python-openstackclient/+/887976 | |
| 15:08:32 | opendevreview | Konrad Gube proposed openstack/openstacksdk master: Add os-extend_volume_completion volume action. https://review.opendev.org/c/openstack/openstacksdk/+/910522 | |
| #openstack-sdks - 2024-02-29 | |||
| 11:56:13 | opendevreview | Rodolfo Alonso proposed openstack/python-openstackclient master: Add NUMA affinity policy options "socket" https://review.opendev.org/c/openstack/python-openstackclient/+/910596 | |
| 13:16:04 | opendevreview | Konrad Gube proposed openstack/openstacksdk master: Add os-extend_volume_completion volume action. https://review.opendev.org/c/openstack/openstacksdk/+/910522 | |
| 16:36:27 | opendevreview | Dr. Jens Harbott proposed openstack/osc-lib master: zuul: Use openstack-python3-jobs template https://review.opendev.org/c/openstack/osc-lib/+/910646 | |
| 16:36:27 | opendevreview | Dr. Jens Harbott proposed openstack/osc-lib master: Fix branch selection in zuul config https://review.opendev.org/c/openstack/osc-lib/+/910645 | |
| 20:37:08 | opendevreview | Merged openstack/osc-lib master: Fix branch selection in zuul config https://review.opendev.org/c/openstack/osc-lib/+/910645 | |
| 20:58:16 | opendevreview | Merged openstack/osc-lib master: zuul: Use openstack-python3-jobs template https://review.opendev.org/c/openstack/osc-lib/+/910646 | |
| 21:18:55 | opendevreview | Oria Weng proposed openstack/python-openstackclient master: Migrate role_assignment commands to SDK https://review.opendev.org/c/openstack/python-openstackclient/+/910664 | |
| 21:18:55 | opendevreview | Oria Weng proposed openstack/python-openstackclient master: tests: Add identity v2, v3 FakeClientMixin https://review.opendev.org/c/openstack/python-openstackclient/+/909035 | |
| 21:23:54 | opendevreview | Steve Baker proposed openstack/ansible-collections-openstack master: Add application_credential module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/910463 | |
| #openstack-sdks - 2024-03-01 | |||
| 08:23:56 | opendevreview | Dr. Jens Harbott proposed openstack/osc-lib stable/2023.2: Fix branch selection in zuul config https://review.opendev.org/c/openstack/osc-lib/+/910610 | |
| 13:50:38 | opendevreview | Dr. Jens Harbott proposed openstack/osc-lib stable/2023.2: Drop master-only job from zuul config https://review.opendev.org/c/openstack/osc-lib/+/910610 | |
| 17:17:27 | frickler | gtema: stephenfin: seems osc(-lib) stable CI is broken, maybe one of you has time to check this? https://review.opendev.org/c/openstack/osc-lib/+/910610 | |
| 17:18:13 | gtema | wow, implied roles test | |
| 17:18:25 | gtema | will have a deeper look on monday, frickler | |
| 17:20:31 | frickler | thx | |