| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-sdks - 2017-04-06 | |||
| 13:47:29 | dtroyer | 13 minutes left, anything that needs to be in meeting minutes? | |
| 13:48:29 | RuiChen | no from me, I just have a patch need to review https://review.openstack.org/#/c/438141/ | |
| 13:49:37 | dtroyer | ok, FWIW I'm working to prepare the next release of OSC and osc-lib…need to get the -tips jobs passing first | |
| 13:51:11 | briancurtin | malloc83: didn't i show you how to do that yesterday? | |
| 13:51:25 | malloc83 | briancurtin: that doesnt re-use the token... | |
| 13:51:35 | malloc83 | it actually uses the token to create another token :-( | |
| 13:52:09 | malloc83 | so if i provide tenant and old token, it actually goes and scopes the token again and uses a new one temporary | |
| 13:52:14 | malloc83 | but the temporary tokens could build up. | |
| 13:52:22 | dtroyer | malloc83: what is the concern about re-using tokens? | |
| 13:52:25 | malloc83 | you could end up with thousands of tokens :) | |
| 13:52:51 | malloc83 | dtroyer: so we have a portal we use with our OSS system and BSS and we use the same dashboard for openstack, not using horizon | |
| 13:52:58 | malloc83 | and the issue is every time a user switches a project | |
| 13:53:05 | malloc83 | we need to scope a token which is fine and works as expected | |
| 13:53:19 | malloc83 | so we store the token in a session for the projects | |
| 13:53:27 | malloc83 | but now the SDK keeps creating new tokens when we provide the old working token | |
| 13:53:29 | briancurtin | maybe this is more of a keystoneauth question then. sdk doesn't really do anything with auth, it offloads it all to that lib | |
| 13:53:51 | briancurtin | or maybe we're using KSA wrong? | |
| 13:53:55 | dtroyer | that lib is keystoneauth, which handles all of the token work for you | |
| 13:54:09 | dtroyer | briancurtin: are you re-using the ksa session in Connection? | |
| 13:54:14 | malloc83 | dtroyer: so via the SDK how do i get keystoneauth not to use a new token? :) and use the one provided. | |
| 13:54:27 | briancurtin | malloc83: fix it? i don't know | |
| 13:54:40 | dtroyer | I don't know much about actually using the SDK at that level…let me find how we set it up in openstackclient | |
| 13:54:48 | malloc83 | i could fix it... but hoping i was just being silly... and there was an obvious solution. | |
| 13:54:52 | briancurtin | dtroyer: we subclass ksa session | |
| 13:55:11 | malloc83 | one sec one of our guys has a solution ... just checking code. | |
| 13:55:12 | rabel | RuiChen: left you a comment in the change | |
| 13:55:32 | dtroyer | ok, so as long as that is persisted the token should hang around, only being re-issued after it expires | |
| 13:55:35 | briancurtin | maybe we're not passing the right stuff into it while init'ing. i'm on my phone right now, will be back at a real computer shortly | |
| 13:56:37 | dtroyer | briancurtin: all we do in OSC is create Connection with authentication=<the session.auth from our KSA session> | |
| 13:57:41 | dtroyer | I haven't sniffed that for long-running operations, but I don't think it re-auths for every call with that. We're managing the Session in OSC directly, but I understood that Connection would do that too as long as the Connection object was around | |
| 13:58:48 | RuiChen | rabel: got it | |
| 13:58:53 | briancurtin | yep, it only reauths at expiration | |
| 13:59:22 | malloc83 | guys so there is a fix for doing this, using keystoneauth1 directly... | |
| 13:59:28 | malloc83 | but i would like to use the sdk... | |
| 13:59:35 | malloc83 | can i pastebin it? | |
| 13:59:43 | dtroyer | malloc83: so part of what I understand you are doing is calling the N different library clients in your app | |
| 13:59:43 | malloc83 | and perhaps you will understand what i am trying todo with the sdk | |
| 13:59:45 | briancurtin | sure, can make it work | |
| 13:59:54 | briancurtin | probably | |
| 14:00:02 | malloc83 | lemme paste bin, and you guys tell me how to do the same with the sdk.. | |
| 14:00:49 | malloc83 | https://pastebin.com/KmGqeM9s | |
| 14:01:01 | malloc83 | how do i achieve that using SDK? :) and not python clients directly. | |
| 14:01:43 | malloc83 | cause when providing token to SDK it actually throws a new token... i am not sure if we checking it correctly, but i saw this when we tried the get_token method on the session.. there is different token from the one we provided to it on the connection | |
| 14:02:21 | malloc83 | if it keeps generating new tokens.. :) it could cause a scaling issue.. or perhaps i am not looking at the right place. to see what token it is using currently. | |
| 14:02:38 | rabel | dtroyer: could you have another look at https://review.openstack.org/#/c/444924/ ? i think we are nearly done there, but there are some smaller questions. | |
| 14:03:01 | dtroyer | malloc83: in openstackclient (OSC) here is how we set up the SDK Connection object: | |
| 14:03:04 | dtroyer | https://github.com/openstack/python-openstackclient/blob/master/openstackclient/network/client.py#L40 | |
| 14:03:06 | malloc83 | guys gotta go.. ill be back later or tomorrow... | |
| 14:03:10 | malloc83 | i am savint the link dtroyer | |
| 14:03:25 | dtroyer | that is using an externally created KSA Session | |
| 14:03:26 | dtroyer | kk | |
| 14:03:29 | briancurtin | i know nothing about other clients FYI | |
| 14:03:33 | dtroyer | save this too: | |
| 14:03:42 | dtroyer | https://github.com/openstack/osc-lib/blob/master/osc_lib/clientmanager.py | |
| 14:03:52 | dtroyer | a lot of what I think you are trying to do has been already done | |
| 14:04:02 | malloc83 | got it.. ill be back. sorry really late for meeting :) | |
| 14:04:12 | dtroyer | it may not fit your case exactly but you may find it interesting to see how we did it | |
| 14:20:11 | mordred | malloc83: you also may enjoy https://docs.openstack.org/developer/os-client-config/#constructing-openstack-sdk-object and https://docs.openstack.org/developer/os-client-config/#constructing-legacy-client-objects | |
| 14:20:27 | mordred | depending on which thing you want to accomplish | |
| 14:22:16 | dtroyer | rabel: 444924 looking good | |
| 14:29:56 | openstackgerrit | David Rabel proposed openstack/python-openstackclient master: Add --network and --port to server create https://review.openstack.org/444924 | |
| 14:30:07 | rabel | dtroyer: thanks for reviewing. | |
| 14:37:42 | openstackgerrit | Dean Troyer proposed openstack/python-openstackclient master: Allow override of distributed router flag https://review.openstack.org/433442 | |
| 14:51:59 | reedip | rabel ...all done with 444294 ? | |
| 14:53:02 | rabel | reedip: not quite, but i think i am close. :) | |
| 14:54:12 | openstackgerrit | Nakul Dahiwade proposed openstack/python-openstacksdk master: Introduce L7Policy for Octavia (load balancing) https://review.openstack.org/451980 | |
| 14:58:00 | openstackgerrit | David Rabel proposed openstack/python-openstackclient master: Add --network and --port to server create https://review.openstack.org/444924 | |
| 15:13:43 | openstackgerrit | Sean McCully proposed openstack/keystoneauth master: KeystoneAuth should default to system CAFile. https://review.openstack.org/452585 | |
| 15:15:43 | sdague | cdent: in your thinking about capabilities, had you thought about hypermedia for it? There was a blog post about swagger limitations the other day which mentioned that, and I wondered why I didn't think I'd seen that on the table anywhere | |
| 15:17:51 | openstackgerrit | Nakul Dahiwade proposed openstack/python-openstacksdk master: Introduce L7Rule for Octavia (load balancing) https://review.openstack.org/452832 | |
| 15:29:17 | cdent | sdague: I had, but there's never been a lot of support for that kind of thing in these discussions. Even when we we talk about policies we tend to talk with names of services and functionality rather than URIs, which has confused me | |
| 15:30:14 | cdent | sdague: I've not pushed much on the capabilities stuff, just listened. Much earlier on I'd said "shouldn't this stuff be in the existing representation as links?" and got quite a bit of pushback so decided to wait and see | |
| 15:31:02 | sdague | cdent: yeh, I just was curious | |
| 15:32:10 | cdent | sdague: I think there are some conflated use cases that we haven't properly teased out yet and what we've got on the table now is a solution looking for all the problems it might be able to solve. so you and john's suggestion at ptg to just focus on the narrow horizon case is probably wise | |
| 15:32:25 | sdague | yeh | |
| 15:47:44 | openstackgerrit | Valery Tschopp proposed openstack/python-openstacksdk master: Whitelist query parameter 'project_id' https://review.openstack.org/454241 | |
| 15:49:17 | openstackgerrit | Brian Curtin proposed openstack/python-openstacksdk master: Add 'project_id' to Server query parameters https://review.openstack.org/454241 | |
| 17:23:07 | openstackgerrit | Dean Troyer proposed openstack/python-openstackclient master: Split security group tests https://review.openstack.org/454262 | |
| 17:37:23 | cdent | elmiko, edleafe, anyone else: quick proofread of https://etherpad.openstack.org/p/api-wg-newsletter please? | |
| 17:39:33 | openstackgerrit | Ankur proposed openstack/python-openstackclient master: Add support for Octavia Plugin https://review.openstack.org/447068 | |
| 17:44:43 | cdent | elmiko, edleafe too late | |
| 17:44:56 | elmiko | lol | |
| 17:44:59 | elmiko | just saw the first ping! | |
| 17:45:06 | elmiko | thanks though =) | |
| 17:54:46 | edleafe | cdent: sorry, just got back online | |
| 17:55:03 | elmiko | cdent: fwiw, the copy looks ok to me | |
| 17:55:09 | cdent | no worries edleafe, elmiko: it's probably fine, and if it's not, that's probably fine too | |
| 17:55:20 | elmiko | lol | |
| 17:55:22 | elmiko | so true | |
| 18:08:39 | edleafe | heh, not like anyone reads those things anyway | |
| 18:59:56 | stevemar | dtroyer: deanoooo | |
| 19:00:53 | dtroyer | heyo | |
| 19:01:12 | dtroyer | heh, it was at 9:00 (for you) | |
| 19:01:21 | dtroyer | I missed it anyway :( | |
| 19:01:32 | dtroyer | stevemar: ^^ | |
| 19:01:55 | stevemar | dtroyer: novaclient 8.0.0 dropped today and borked osc commands | |
| 19:03:48 | dtroyer | yup, I'm working on them… has anyone else proposed a cap yet? | |
| 19:05:00 | dtroyer | lemme post a snapshot of what I'm doing | |
| 19:05:13 | stevemar | sure thing | |
| 19:05:19 | stevemar | re:cap, not that i know of | |