| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-sdks - 2026-08-17 | |||
| 14:24:48 | stephenfin | cardoe: I missed my opportunity to do so and now GitHub is down 😅 | |
| 14:25:06 | cardoe | alas it is a day that ends in Y | |
| 14:26:00 | cardoe | Well if ya want to comment on the Python version at https://review.opendev.org/c/openstack/keystoneauth/+/1000759 I'm happy to make changes there. | |
| 16:34:56 | stephenfin | cardoe: I took a look through that ksa change and left some comments | |
| 16:39:25 | cardoe | Thank you | |
| 16:49:46 | cardoe | stephenfin: so I personally cache it through OSC and not via ksa | |
| 17:08:38 | stephenfin | wdym? There's caching code in the Plugin in that change? | |
| 17:39:14 | cardoe | yeah I can figure out why. | |
| 17:40:54 | cardoe | stephenfin: btw github is back if you wanna let that gophercloud one run | |
| 22:06:40 | cardoe | stephenfin: oh I had to do some digging get_cache_id() doesn't work cause it encodes scope in there. The token we cache is unscoped. Honestly scope sucks the way clouds.yaml does it. I really want 1 OS_CLOUD entry which would allow my user to get a system-scope or project-scope token in the future anyway. That was one of the reasons why adopting system-scope failed. | |
| #openstack-sdks - 2026-08-18 | |||
| 15:48:03 | opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Add a v3websso authentication plugin https://review.opendev.org/c/openstack/keystoneauth/+/1000759 | |
| 16:11:20 | cardoe | stephenfin: any chance you've had a moment to think about the scope question above? | |
| 16:23:17 | cardoe | So I dug a bit further. get_auth_state() and set_auth_state() always return the scoped token. get_cache_id() is also required by design to return NotImplemented for federated plugins because we're not suppose to cache scoped tokens. | |
| 16:44:50 | opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Rescope federated tokens to a system scope https://review.opendev.org/c/openstack/keystoneauth/+/1001382 | |
| 20:04:21 | opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Let a caller hold the unscoped token of a federated plugin https://review.opendev.org/c/openstack/keystoneauth/+/1001419 | |
| 20:11:09 | opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Let a caller hold the unscoped token of a federated plugin https://review.opendev.org/c/openstack/keystoneauth/+/1001419 | |
| 20:15:46 | cardoe | Silly robots don't listen., | |
| 20:23:15 | opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Expose the unscoped token of a federated plugin https://review.opendev.org/c/openstack/keystoneauth/+/1001419 | |
| 20:35:25 | opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Add a v3websso authentication plugin https://review.opendev.org/c/openstack/keystoneauth/+/1000759 | |
| 20:43:36 | cardoe | stephenfin: so I've validated the keystoneauth changes without caching | |
| 20:47:19 | opendevreview | Doug Goldstein proposed openstack/openstacksdk master: Keep the unscoped credential of a federated plugin https://review.opendev.org/c/openstack/openstacksdk/+/1001423 | |
| 20:48:25 | cardoe | The cache works but minimally tested... like I dunno what's gonna happen once my token expires... will it clean it up properly or not. | |
| 20:50:21 | cardoe | I suspect it'll work poorly since there's no mechanism to evict entries from the keyring | |
| 21:10:52 | cardoe | While you're at it, mind looking at https://review.opendev.org/c/openstack/python-openstackclient/+/1000146 as well? | |
| 21:11:48 | opendevreview | Doug Goldstein proposed openstack/openstacksdk master: Add a way to discard the authentication cached for a cloud https://review.opendev.org/c/openstack/openstacksdk/+/1001431 | |
| 21:16:01 | cardoe | I picked "cloud" as my top-level command because I've locally got a number of other commands under "cloud" which interact with your clouds.yaml | |
| 21:17:37 | opendevreview | Oria Weng proposed openstack/openstacksdk master: Identity: Add support for endpoint group/endpoint and endpoint group/project associations https://review.opendev.org/c/openstack/openstacksdk/+/999040 | |
| 21:17:37 | opendevreview | Oria Weng proposed openstack/openstacksdk master: Identity: Add support for endpoint groups https://review.opendev.org/c/openstack/openstacksdk/+/995762 | |
| 21:23:11 | opendevreview | Doug Goldstein proposed openstack/python-openstackclient master: Add a "cloud cache delete" command https://review.opendev.org/c/openstack/python-openstackclient/+/1001433 | |
| 22:07:49 | TheJulia | Its a very warm jacket :) | |
| 22:14:53 | rm_work | darn no chat history | |
| 22:15:05 | rm_work | there's still a logs site somewhere right | |
| 22:20:31 | TheJulia | rm_work: yes, eavesdrop.openstack.org | |
| #openstack-sdks - 2026-08-19 | |||
| 00:33:34 | opendevreview | Oria Weng proposed openstack/python-openstackclient master: [WIP] Migrate 'endpoint group' commands to SDK https://review.opendev.org/c/openstack/python-openstackclient/+/1001447 | |
| 00:34:26 | opendevreview | Oria Weng proposed openstack/python-openstackclient master: [WIP] Migrate 'endpoint group' commands to SDK https://review.opendev.org/c/openstack/python-openstackclient/+/1001447 | |
| 08:48:37 | rm_work | cardoe: had my agent get back to your agent 😛 | |
| 09:42:22 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Enable G, LOG ruff rules https://review.opendev.org/c/openstack/openstacksdk/+/1000828 | |
| 09:42:22 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Simplify ruff configuration https://review.opendev.org/c/openstack/openstacksdk/+/1000827 | |
| 09:42:23 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Drop setup.py, setup.cfg https://review.opendev.org/c/openstack/openstacksdk/+/1000825 | |
| 09:42:23 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Migrate requirements to pyproject.toml https://review.opendev.org/c/openstack/openstacksdk/+/953484 | |
| 10:00:27 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove unnecessary/unused utils https://review.opendev.org/c/openstack/openstacksdk/+/1001475 | |
| 10:00:28 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove another unnecessary use of _get_entity https://review.opendev.org/c/openstack/openstacksdk/+/1001477 | |
| 10:00:28 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove unnecessary use of _get_entity https://review.opendev.org/c/openstack/openstacksdk/+/1001476 | |
| 10:07:50 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove unnecessary use of _get_entity https://review.opendev.org/c/openstack/openstacksdk/+/1001476 | |
| 10:07:58 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove another unnecessary use of _get_entity https://review.opendev.org/c/openstack/openstacksdk/+/1001477 | |
| 10:35:40 | stephenfin | cardoe: I've sent https://review.opendev.org/c/openstack/python-openstackclient/+/1000146 on its way, and I'll come back to the websso thing either later today or early tomorrow | |
| 10:38:11 | stephenfin | I'll grab the precursor patches for ksa now though: they look much less involved | |
| 10:40:12 | stephenfin | Ah, looks like you've given the caching situation some thought and come up with https://review.opendev.org/c/openstack/keystoneauth/+/1001419 🙏 That (reworking or extending the existing caching logic) was going to be my proposal, but I wanted to spend some time making sure it made sense before throwing a potentially nonsensical idea out there | |
| 11:10:15 | opendevreview | Merged openstack/openstacksdk master: config: Add profiles helper https://review.opendev.org/c/openstack/openstacksdk/+/1001153 | |
| 11:10:17 | opendevreview | Merged openstack/openstacksdk master: docs: Use literals, not italics https://review.opendev.org/c/openstack/openstacksdk/+/1001154 | |
| 11:10:19 | opendevreview | Merged openstack/openstacksdk master: docs: Rework config guide https://review.opendev.org/c/openstack/openstacksdk/+/1001155 | |
| 11:45:46 | opendevreview | Merged openstack/openstacksdk master: Omit keystone admin endpoint in heat job https://review.opendev.org/c/openstack/openstacksdk/+/1000695 | |
| 11:45:49 | opendevreview | Merged openstack/openstacksdk master: Defer missing-catalog errors until proxy use. https://review.opendev.org/c/openstack/openstacksdk/+/997117 | |
| 11:45:51 | opendevreview | Merged openstack/openstacksdk master: Add extra param fields to get_xy networking methods https://review.opendev.org/c/openstack/openstacksdk/+/995724 | |
| 11:45:54 | opendevreview | Merged openstack/python-openstackclient master: Add network trunk subport commands https://review.opendev.org/c/openstack/python-openstackclient/+/1000146 | |
| 12:21:47 | opendevreview | Merged openstack/openstacksdk master: Simplify ruff configuration https://review.opendev.org/c/openstack/openstacksdk/+/1000827 | |
| 12:28:16 | opendevreview | Merged openstack/openstacksdk master: Enable G, LOG ruff rules https://review.opendev.org/c/openstack/openstacksdk/+/1000828 | |
| 12:33:32 | opendevreview | Merged openstack/openstacksdk master: cloud: Remove unnecessary/unused utils https://review.opendev.org/c/openstack/openstacksdk/+/1001475 | |
| 13:09:07 | opendevreview | Merged openstack/python-openstackclient master: Support compute microversion 2.94 https://review.opendev.org/c/openstack/python-openstackclient/+/872420 | |
| 13:21:05 | opendevreview | Merged openstack/openstacksdk master: block_storage: Add add/remove volumes fields to Group https://review.opendev.org/c/openstack/openstacksdk/+/995940 | |
| 13:31:23 | opendevreview | Merged openstack/openstacksdk master: block_storage: Forward list_volume query param in get_group https://review.opendev.org/c/openstack/openstacksdk/+/995937 | |
| 16:10:11 | opendevreview | Stephen Finucane proposed openstack/keystoneauth master: typing: Use objects from typing https://review.opendev.org/c/openstack/keystoneauth/+/994713 | |
| 16:10:12 | opendevreview | Stephen Finucane proposed openstack/keystoneauth master: pre-commit: Bump versions https://review.opendev.org/c/openstack/keystoneauth/+/1001538 | |
| 16:36:14 | opendevreview | Merged openstack/openstacksdk master: cloud: Remove unnecessary use of _get_entity https://review.opendev.org/c/openstack/openstacksdk/+/1001476 | |
| 16:36:17 | opendevreview | Merged openstack/openstacksdk master: cloud: Remove another unnecessary use of _get_entity https://review.opendev.org/c/openstack/openstacksdk/+/1001477 | |
| 16:48:06 | opendevreview | Merged openstack/python-openstackclient master: Add leak-routes related options for subnets https://review.opendev.org/c/openstack/python-openstackclient/+/998212 | |
| 18:19:15 | opendevreview | Merged openstack/openstacksdk master: baremetal: Add support for runbook traits and description https://review.opendev.org/c/openstack/openstacksdk/+/1000375 | |
| 18:33:09 | cardoe | stephenfin: well if you're good with that approach I'll address rm_work's feedback | |
| 19:39:52 | opendevreview | Oria Weng proposed openstack/openstacksdk master: Identity: Add support for endpoint groups https://review.opendev.org/c/openstack/openstacksdk/+/995762 | |
| 21:06:59 | opendevreview | Rajat Dhasmana proposed openstack/python-openstackclient master: Cinder: Add support for export/import replica https://review.opendev.org/c/openstack/python-openstackclient/+/1001076 | |
| 21:07:34 | opendevreview | Rajat Dhasmana proposed openstack/openstacksdk master: Volume: Add support for export/import replica https://review.opendev.org/c/openstack/openstacksdk/+/1001075 | |
| 22:10:36 | rm_work | cardoe: you are aware I think that most of my reviews on this topic are AI driven, but I do review all the reviews by hand and try to understand before posting, so I THINK everything I posted is legitimate, I've found it to be a good way to learn a new codebase to force the AI to explain it to me in different ways until I get it 😆 | |
| 22:10:50 | rm_work | but I think you're having your agent review my agent reviews so I don't feel too bad | |
| 22:10:54 | cardoe | rm_work: so I agree with most of them | |
| 22:11:07 | cardoe | The one about the SSO token needing to change I don't. | |
| 22:11:36 | rm_work | hmmm | |
| 22:11:39 | cardoe | But that's where you have the escape hatch of "openstack cloud auth delete" | |
| 22:11:45 | rm_work | was that the thing with multiple cloud profiles? | |
| 22:12:07 | cardoe | Yeah I don't think it makes sense to tie one OS_CLOUD entry to one SSO and another to another SSO | |
| 22:12:16 | rm_work | ok well in my case | |
| 22:12:17 | cardoe | You don't have any visibility in doing that. | |
| 22:12:28 | rm_work | I had to scrub the internal example I have but | |
| 22:12:39 | rm_work | I have two profiles that I actually DO use separate SSO for within one cloud | |
| 22:12:52 | rm_work | so if it doesn't support that I may have to patch it internally or ... figure something out | |
| 22:13:19 | rm_work | if it tries to use my normal SSO profile for admin basically, it will cause issues | |
| 22:13:37 | rm_work | or if i login as admin first and then it uses that profile for my normal user cloud entry, that would be bad and somewhat silent | |
| 22:14:17 | cardoe | But there's no way to reasonably select that. | |
| 22:14:43 | cardoe | The selection of the SSO is going to be whatever browser based page you have | |
| 22:14:56 | cardoe | And we cannot pass along any values to the browser via the WebSSO protocol. | |
| 22:14:58 | rm_work | including the clouds.yaml profile name in the key splits them? and for most cases people will only have one or two, and a second login is usually quick | |
| 22:15:07 | cardoe | Hence the CSRF topic. | |
| 22:15:29 | rm_work | do we not build the cache key? | |
| 22:17:41 | cardoe | So I've got ~30 OS_CLOUD's in my clouds.yaml which will share the same SSO | |
| 22:19:22 | cardoe | So I guess I'd want it to be flexible. | |
| 22:19:40 | rm_work | hmmm | |
| 22:19:58 | rm_work | let me see what the cache key is again | |
| 22:20:14 | rm_work | maybe if it includes like ... query params i could just add like ?admin or something | |
| 22:20:20 | rm_work | to the URL lol | |
| 22:20:34 | rm_work | trying to find which CR that was in | |
| 22:24:22 | rm_work | ah got it | |