Earlier  
Later
New Search
Posted Nick Remark
#openstack-sdks - 2026-08-19
16:36:14 opendevreview Merged openstack/openstacksdk master: cloud: Remove unnecessary use of _get_entity https://review.opendev.org/c/openstack/openstacksdk/+/1001476
16:36:17 opendevreview Merged openstack/openstacksdk master: cloud: Remove another unnecessary use of _get_entity https://review.opendev.org/c/openstack/openstacksdk/+/1001477
16:48:06 opendevreview Merged openstack/python-openstackclient master: Add leak-routes related options for subnets https://review.opendev.org/c/openstack/python-openstackclient/+/998212
18:19:15 opendevreview Merged openstack/openstacksdk master: baremetal: Add support for runbook traits and description https://review.opendev.org/c/openstack/openstacksdk/+/1000375
18:33:09 cardoe stephenfin: well if you're good with that approach I'll address rm_work's feedback
19:39:52 opendevreview Oria Weng proposed openstack/openstacksdk master: Identity: Add support for endpoint groups https://review.opendev.org/c/openstack/openstacksdk/+/995762
21:06:59 opendevreview Rajat Dhasmana proposed openstack/python-openstackclient master: Cinder: Add support for export/import replica https://review.opendev.org/c/openstack/python-openstackclient/+/1001076
21:07:34 opendevreview Rajat Dhasmana proposed openstack/openstacksdk master: Volume: Add support for export/import replica https://review.opendev.org/c/openstack/openstacksdk/+/1001075
22:10:36 rm_work cardoe: you are aware I think that most of my reviews on this topic are AI driven, but I do review all the reviews by hand and try to understand before posting, so I THINK everything I posted is legitimate, I've found it to be a good way to learn a new codebase to force the AI to explain it to me in different ways until I get it 😆
22:10:50 rm_work but I think you're having your agent review my agent reviews so I don't feel too bad
22:10:54 cardoe rm_work: so I agree with most of them
22:11:07 cardoe The one about the SSO token needing to change I don't.
22:11:36 rm_work hmmm
22:11:39 cardoe But that's where you have the escape hatch of "openstack cloud auth delete"
22:11:45 rm_work was that the thing with multiple cloud profiles?
22:12:07 cardoe Yeah I don't think it makes sense to tie one OS_CLOUD entry to one SSO and another to another SSO
22:12:16 rm_work ok well in my case
22:12:17 cardoe You don't have any visibility in doing that.
22:12:28 rm_work I had to scrub the internal example I have but
22:12:39 rm_work I have two profiles that I actually DO use separate SSO for within one cloud
22:12:52 rm_work so if it doesn't support that I may have to patch it internally or ... figure something out
22:13:19 rm_work if it tries to use my normal SSO profile for admin basically, it will cause issues
22:13:37 rm_work or if i login as admin first and then it uses that profile for my normal user cloud entry, that would be bad and somewhat silent
22:14:17 cardoe But there's no way to reasonably select that.
22:14:43 cardoe The selection of the SSO is going to be whatever browser based page you have
22:14:56 cardoe And we cannot pass along any values to the browser via the WebSSO protocol.
22:14:58 rm_work including the clouds.yaml profile name in the key splits them? and for most cases people will only have one or two, and a second login is usually quick
22:15:07 cardoe Hence the CSRF topic.
22:15:29 rm_work do we not build the cache key?
22:17:41 cardoe So I've got ~30 OS_CLOUD's in my clouds.yaml which will share the same SSO
22:19:22 cardoe So I guess I'd want it to be flexible.
22:19:40 rm_work hmmm
22:19:58 rm_work let me see what the cache key is again
22:20:14 rm_work maybe if it includes like ... query params i could just add like ?admin or something
22:20:20 rm_work to the URL lol
22:20:34 rm_work trying to find which CR that was in
22:24:22 rm_work ah got it
22:26:03 rm_work hmmm no that wouldn't work T_T
22:30:46 rm_work could you add like auth_cache_namespace to the clouds.yaml profile and then use hash(auth_cache_namespace + keystoneauth configuration ID)
22:31:13 rm_work which I guess then leads to "which is default"
22:32:48 rm_work I would prefer "explicitly share cache namespace" as required or else don't... so like, defaulting cache namespace to the cloud profile name 😄 because that seems like the least likely to be a security-oops, but I do understand that is the more tedious option for the average user who likely doesn't care (I assume I'm the outlier)
22:54:42 opendevreview Merged openstack/openstacksdk master: [typing] Add proper type hints for role assignment functions https://review.opendev.org/c/openstack/openstacksdk/+/1000095
#openstack-sdks - 2026-08-20
00:49:31 cardoe rm_work: but it’s not a security oops when you are using SSO in a browser you are not prompted to change auth or select auth. It’s using that. The clouds.yaml implies no credentials or permissions. Your SSO token is unscoped and all that happens with clouds.yaml is that it tries to do is rescope the unscoped token to what clouds.yaml has.
00:51:05 rm_work hmmm mine usually asks if i want to use the current identity and i click no and type my other one
00:51:09 rm_work (in the browser)
00:51:29 rm_work but if it doesn't re-pop the browser for the other profile i wouldn't get that chance
00:52:44 rm_work or for some i have to clear my cookies before re-auth with is already annoying
09:37:19 opendevreview Oria Weng proposed openstack/openstacksdk master: Identity: Add support for endpoint group/endpoint and endpoint group/project associations https://review.opendev.org/c/openstack/openstacksdk/+/999040
10:27:30 opendevreview Vladislav Terekhov proposed openstack/openstacksdk master: identity: Add federated attribute support to User https://review.opendev.org/c/openstack/openstacksdk/+/1001638
10:57:22 opendevreview Stephen Finucane proposed openstack/openstacksdk master: Pass segment_size in create_object https://review.opendev.org/c/openstack/openstacksdk/+/931575
12:27:23 opendevreview Merged openstack/openstacksdk master: Migrate requirements to pyproject.toml https://review.opendev.org/c/openstack/openstacksdk/+/953484
12:27:40 opendevreview Merged openstack/keystoneauth master: Add HTTP 429 Too Many Requests support https://review.opendev.org/c/openstack/keystoneauth/+/997255
13:37:28 opendevreview Merged openstack/keystoneauth master: Terminate the elements hashed into the cache id https://review.opendev.org/c/openstack/keystoneauth/+/1000843
13:37:30 opendevreview Merged openstack/keystoneauth master: pre-commit: Bump versions https://review.opendev.org/c/openstack/keystoneauth/+/1001538
14:59:57 opendevreview Merged openstack/openstacksdk master: Identity: Add support for endpoint groups https://review.opendev.org/c/openstack/openstacksdk/+/995762
15:27:53 opendevreview Thomas Sell proposed openstack/ansible-collections-openstack master: Fix subnet module when subnet already exists https://review.opendev.org/c/openstack/ansible-collections-openstack/+/1001685
15:30:26 opendevreview Thomas Sell proposed openstack/ansible-collections-openstack master: Fix subnet module when subnet already exists https://review.opendev.org/c/openstack/ansible-collections-openstack/+/1001685
15:39:15 opendevreview Merged openstack/openstacksdk master: Identity: Add support for endpoint group/endpoint and endpoint group/project associations https://review.opendev.org/c/openstack/openstacksdk/+/999040
16:27:16 stephenfin cardoe: jfyi stevedore 5.9.1 is out and should be in u-c soon https://review.opendev.org/c/openstack/releases/+/1001666
16:27:24 stephenfin https://review.opendev.org/c/openstack/releases/+/1001666
16:27:46 stephenfin that adds docs for and fixes the conflict resolution stuff, so you should be able to rely on it in KSA
16:27:46 cardoe stephenfin: you got any examples of how to use or drive it?
16:28:13 stephenfin https://docs.openstack.org/stevedore/latest/user/conflict_resolution.html
16:28:18 cardoe perfect
16:28:54 cardoe stephenfin: as an aside... can you merge keystonemiddleware too?
16:29:11 stephenfin this can probably be another standalone precursor patch. easier to merge that way
16:29:16 stephenfin cardoe: afraid not :(
16:29:31 stephenfin gtema can though
16:30:05 cardoe well there's a lot of cleanups that tkajinam and I have pitched out and gtema says its a lack of reviewers
16:30:18 cardoe a lot of its cleanups to pyproject.toml and such
16:30:21 cardoe but that's an aside
16:30:49 opendevreview Vladislav Terekhov proposed openstack/openstacksdk master: compute: Fix server create attribute https://review.opendev.org/c/openstack/openstacksdk/+/1001700
16:31:16 cardoe I'll get https://review.opendev.org/c/openstack/keystoneauth/+/1001419 cleaned up today and I saw it's parent you added David and gtema... I assume getting their +2 is the blocker.
16:31:46 stephenfin I can review middleware changes, but I can't commit to reviewing keystone itself and I think the two go hand-in-hand currently
16:32:17 stephenfin and unlike ksa it doesn't have a natural home in SDK
16:33:42 stephenfin cardoe: Not a blocker, no. I'd just like to give them some chance to weigh in
16:34:07 cardoe okay sounds good.
16:34:36 cardoe My plan is to follow up on the WebSSO protocol and formalize that a bit better with a spec. I plan on fixing the CSRF issue by allowing a nonce in the protocol.
16:35:11 opendevreview Vladislav Terekhov proposed openstack/openstacksdk master: compute: Fix server create attribute https://review.opendev.org/c/openstack/openstacksdk/+/1001700
16:38:12 stephenfin makes sense 👌
16:38:20 cardoe Another aside... "openstack subnet pool set" and "openstack subnet pool unset" aren't complementary. You have to delete a subnet pool to change most of the settings. I've got a patch series coming to fix that up.
16:39:15 cardoe Just lemme know how I can help. I'd like to see gophercloud and openstacksdk be pretty feature parity and us to clean up the typing and api stuff.
16:39:35 cardoe One area I'd appreciate you input on is going to be some of the scope changed I'd like to do.
16:40:06 cardoe So maybe sometime when you have 30 minutes we can setup a meetpad and talk?
16:40:39 cardoe Cause I'd like to propose some specs and I'm not sure of the right places for that either.
16:43:02 stephenfin Sure. This week is almost over and I've got some Mythos findings to finish working through, but I could do something towards the end of next week
16:43:30 stephenfin though I will say async might be better if we starting getting too into the weeds, since it affords time to actually go and research things
16:43:36 stephenfin s/if/once/
16:44:30 stephenfin I had never really considered the fact that unscoped tokens are a thing and that the shape of clouds.yaml entires isn't necessarily as good as it should be
16:44:46 stephenfin ...before starting on reviews for this websso work
16:53:18 cardoe yeah so that was actually one of the struggles in the original scope adoption failure review.
16:53:40 cardoe That people had to flip flop between three OS_CLOUD entries to be able to run commands.
16:57:22 cardoe I'm happy to post something async but it's a bit more than can fit into a few lines of IRC
16:57:35 cardoe How would you like to get that? email? etherpad?
16:57:56 stephenfin etherpad? At least to start
16:58:53 cardoe Will do.
17:06:59 cardoe I'll share that tomorrow or so.
17:20:22 opendevreview Merged openstack/openstacksdk master: identity: Add federated attribute support to User https://review.opendev.org/c/openstack/openstacksdk/+/1001638
17:37:45 cardoe rm_work: so your identities are tied back to the same identity_provider and protocol values in clouds.yaml?
17:38:26 cardoe rm_work: cause I've got other identities too but they have different values for one of those.

Earlier   Later