Earlier  
Later
New Search
Posted Nick Remark
#openstack-sdks - 2019-03-11
02:41:39 openstackgerrit Merged openstack/python-openstackclient master: Add 'security_group' type support to network rbac commands https://review.openstack.org/636760
07:45:57 openstackgerrit Merged openstack/openstacksdk master: Revert "Replace TaskManager with a keystoneauth concurrency" https://review.openstack.org/642298
10:56:28 openstackgerrit Jakub Jursa proposed openstack/openstacksdk master: added support for binding:profile parameter in create_port/update_port https://review.openstack.org/642418
11:39:16 openstackgerrit Merged openstack/openstacksdk master: Revert "Revert "Replace TaskManager with a keystoneauth concurrency"" https://review.openstack.org/642299
11:39:41 openstackgerrit Merged openstack/openstacksdk master: Deprecate ServerDetails class https://review.openstack.org/642094
11:51:51 openstackgerrit Merged openstack/openstacksdk master: Move object methods to object_store proxy https://review.openstack.org/638731
11:58:04 dtantsur mordred or Shrews, when you have a minute: https://review.openstack.org/#/c/641610/
12:01:21 openstackgerrit Merged openstack/openstacksdk master: Swap human-facing links to use opendev.org https://review.openstack.org/642227
12:47:04 openstackgerrit Glenn Van de Water proposed openstack/python-openstackclient master: Fix service discovery in functional tests https://review.openstack.org/642074
14:28:28 openstackgerrit Merged openstack/openstacksdk master: baremetal: support server-side configdrive building (API 1.56) https://review.openstack.org/641610
15:12:41 openstackgerrit Glenn Van de Water proposed openstack/python-openstackclient master: Fix service discovery in functional tests https://review.openstack.org/642074
15:31:36 openstackgerrit Ed Leafe proposed openstack/api-sig master: Clarify the advice on tags when creating a resource https://review.openstack.org/642497
15:42:47 openstackgerrit Monty Taylor proposed openstack/openstacksdk master: Collapse OpenStackSDKAdapter into Proxy https://review.openstack.org/642231
15:42:47 openstackgerrit Monty Taylor proposed openstack/openstacksdk master: Collect request stats https://review.openstack.org/614834
15:50:06 openstackgerrit Merged openstack/openstacksdk master: Remove outdated devstack section from docs https://review.openstack.org/642228
17:20:04 openstackgerrit Merged openstack/openstacksdk master: Move pep8 requirements in to test-requirements https://review.openstack.org/640597
17:31:34 openstackgerrit Glenn Van de Water proposed openstack/python-openstackclient master: Fix service discovery in functional tests https://review.openstack.org/642074
19:45:11 openstackgerrit Monty Taylor proposed openstack/openstacksdk master: Collapse OpenStackSDKAdapter into Proxy https://review.openstack.org/642231
19:45:11 openstackgerrit Monty Taylor proposed openstack/openstacksdk master: Collect request stats https://review.openstack.org/614834
#openstack-sdks - 2019-03-12
03:08:13 adriant mordred: is there a way to initialise the SDK while specifying the identity url (or telling it to reuse the auth_url) so you can use it to query your own project list without having to scope? Because it fails if I don't give it a project ID when it tries to get identity url from the catalog.
03:09:26 adriant can I just do:
03:09:26 adriant connection.Connection(auth=dict(...with no project id), identity_url='https://auth.example.com') ?
03:17:05 adriant Not sure if that's ultimately a keystoneauth thing
05:44:50 openstackgerrit Ian Wienand proposed openstack/openstacksdk master: Replace openstack.org git:// URLs with https:// https://review.openstack.org/642652
09:47:32 openstackgerrit Kailun Qin proposed openstack/python-openstackclient master: Fix: set invalid None project_id on range creation https://review.openstack.org/642707
09:49:33 openstackgerrit Kailun Qin proposed openstack/python-openstackclient master: Fix: incorrect check when no shared/private input https://review.openstack.org/642708
10:10:08 openstackgerrit Kailun Qin proposed openstack/python-openstackclient master: Fix: incorrect check when no shared/private input https://review.openstack.org/642708
10:36:02 openstackgerrit Glenn Van de Water proposed openstack/python-openstackclient master: Fix service discovery in functional tests https://review.openstack.org/642074
11:48:27 openstackgerrit Merged openstack/openstacksdk master: Replace openstack.org git:// URLs with https:// https://review.openstack.org/642652
11:48:31 openstackgerrit Merged openstack/openstacksdk master: Deprecate VolumeDetail and BackupDetail classes https://review.openstack.org/642107
12:20:26 openstackgerrit Glenn Van de Water proposed openstack/python-openstackclient master: Fix service discovery in functional tests https://review.openstack.org/642074
13:04:48 mordred adriant: hrm. that's a good question. I would assume we're just passing through to ksa - but we might be doing something wrong there
13:06:24 mordred adriant: that said - the unscoped keystone actions may need some thought - because we do try to run discovery when conn.identity gets created. let's see if we can't come up with a solution :)
15:54:05 openstackgerrit Artem Goncharov proposed openstack/openstacksdk master: WIP Split OpenStackCloud into reasonable pieces https://review.openstack.org/642218
16:30:00 openstackgerrit Glenn Van de Water proposed openstack/python-openstackclient master: Fix service discovery in functional tests https://review.openstack.org/642074
17:30:43 mordred gtema: no - there will be no git:// protocol support from opendev - so if you wanna try it out, cloning over https:// is the way to go (it'll also be the only way to go in the future)
20:54:44 adriant mordred: for context, in cases where you are doing multi-project actions, or writing tools for them, you don't really need to know ahead of time what projects you have. So you can auth, get a list, and then create an SDK per project (per region), and do your actions.
20:56:04 adriant the solution I've helped someone go with is to use keystone auth to get a session, get the token from that, then use raw requests against the auth url (and correct user_projects path) to then get their project list, and then use that to further make their SDKs per project.
20:56:40 adriant It's not a terrible solution, but the need to actually go directly to the endpoint and handle the json yourself is lacking a bit of elegance
20:57:02 adriant although... I wonder
20:57:12 adriant kmalloc: can you list your projects via KeystoneAuth?
20:58:46 mordred adriant: cause if I don't have a project id when I get the token, I don't get a catalog, right? thus the "re-use the auth_url as the identity_url" piece, yeah?
20:58:57 adriant yep
20:59:02 adriant you have an empty catalog
20:59:10 adriant so it need to do discovery
20:59:16 adriant i want a way to bypass that step
20:59:27 adriant "use this custom catalog instead" potentially
20:59:29 mordred adriant: so - if you set identity_endpoint_override to the auth_url - it'll skip discovery
20:59:40 adriant ah!
20:59:43 adriant perfect
21:00:09 adriant so "<service_type>_endpoint_override" works?
21:00:18 adriant for all services?
21:00:18 mordred let me know if that works - if it does, I think it might be nice to figure out how to make conn.identity.list_projects - or at least conn.list_projects be able to do this without the user needing to know that specific piece of magic
21:00:21 mordred adriant: yes!
21:00:31 adriant cool
21:00:53 adriant and yeah, ideally having the unscoped actions able to natively reuse the auth_url for identity could be cool
21:01:09 adriant but that could also be a pain
21:01:21 mordred yeah. the biggest hurdle would be getting conn.identity to not fall over when it gets created
21:01:43 mordred which is why this one might be better up at the Connection layer so we can bypass that stuff
21:04:23 adriant identity_endpoint_override seems to work
21:06:03 mordred \o/
21:06:25 mordred cool. then I think we should definitely update Connection.list_projects to do the right thing
21:07:29 mordred that said - I wonder if we can make the proxy creation smarter if service_type is identity - and to look at the auth stuff, look for project info, and if it's not there go ahead and set the endpoint_override ...
21:09:20 adriant mordred: specifically the endpoint I'm actually after for this use case is conn.identity.user_projects() which is the non-admin one
21:09:40 adriant one*
21:09:54 mordred hrm. we might not have that one in the cloud layer ... but that's a really good point
21:10:07 adriant if one exists in the connection layer for listing a user's own projects then that would work too
21:10:07 mordred I think it's worth making conn.identity work without project info then
21:10:35 mordred it shouldn't be too hard - just need to inspect the auth args a smidge :)
21:10:58 adriant although it could end up a lot of work, might be worth investigating if other projects have any unscope APIs :/
21:11:11 mordred it's a good question
21:11:31 mordred kmalloc, cmurphy: ^^ ? do we know if non-keystone use unscoped apis?
21:11:33 adriant I have a feeling probably not many
21:11:55 mordred yeah - seems more like a thing that's needed for keystone and doesn't make a TON of sense elsewhere
21:12:12 mordred maybe the nova calls that deal with hosts and hypervisors?
21:12:20 adriant those would be system scope
21:13:13 adriant Yeah, i think there probably aren't many.
21:13:34 cmurphy mordred: adriant no, only keystone uses unscoped tokens, it's only useful for getting a scoped token
21:14:18 adriant although some of the Keystone APIs don't need scope: list (user) projects, change password, etc?
21:15:45 cmurphy you can list your own projects with an unscoped token, change password i'm not 100% sure though it would make sense
21:16:51 cmurphy oh change password doesn't require a token at all
21:20:06 adriant yeah, that's right, you just need your old password
21:41:01 kmalloc mordred: what cmurphy said
21:41:20 kmalloc unscoped tokens should die IMO
21:41:25 kmalloc but we can't make them go away
21:41:56 kmalloc I *think* someone was originally trying to use unscoped tokens like we use systemscope going forward, but that might require asking folks that no longer work on OpenStack
21:52:16 mordred kmalloc: so - you and adriant have both mentioned this "system" scoped token
21:52:30 mordred how does one get one of those? are we missing anything to use those with sdk?
21:59:08 adriant kmalloc: I don't think unscoped tokens can go away really if you need to query which project you want to scope to first
22:01:22 adriant for things like Horizon (or any GUI) you won't ever provide a project as part of auth. So some auth flow that includes: "here are your projects" and then allows you to scope into one will always be needed
22:01:49 adriant we even have some cli tools that only ask for password and username, and then provide you with a list of project options to scope to
22:03:00 kmalloc mordred: system scope is new, as in as of Stein. It's done just like scope: {project_id: xxx}
22:03:15 cmurphy mordred: it's supported in ksa so it should be transparent to openstacksdk, instead of setting project-id in clouds.yaml you set system-scope
22:03:31 kmalloc mordred: ^ what cmurphy said, she's faster at typing than I am clearly
22:03:34 mordred neat!
22:03:46 mordred it's almost like building these things on top of each other is worth-while!
22:03:52 kmalloc right?!
22:03:53 kmalloc :)
22:04:06 kmalloc some APIs will become system, this is to solve the "Admin" problem
22:04:19 kmalloc meaning you wont need an "admin project" for things that are clearly not project/domain scoped

Earlier   Later