Earlier  
Later
New Search
Posted Nick Remark
#openstack-sdks - 2019-08-14
19:12:39 efried mordred: I haven't fully nailed it down yet, just have a local repro. It's because of this code path:
19:12:39 efried # We don't know anything about this service, so the user is
19:12:39 efried # explicitly just using us for a passthrough REST adapter.
19:12:39 efried # Skip all the lower logic.
19:12:39 efried if not self.supported_versions:
19:12:40 efried temp_client = config.get_session_client(
19:12:40 efried self.service_type,
19:12:41 efried allow_version_hack=True,
19:12:41 efried )
19:12:42 efried # trigger EndpointNotFound exception if this is bogus
19:12:42 efried temp_client.get_endpoint()
19:12:43 efried return temp_client
19:13:15 efried That temp_client.get_endpoint is raising MissingAuthPlugin from ksa
19:14:54 efried I have a fix...
19:14:58 mordred cool
19:36:03 openstackgerrit Sean McGinnis proposed openstack/python-openstackclient master: Default to Cinder v3 API https://review.opendev.org/676505
21:55:14 openstackgerrit Steve Baker proposed openstack/openstacksdk master: Add 'node' attribute to baremetal Allocation https://review.opendev.org/676521
#openstack-sdks - 2019-08-15
01:44:00 openstackgerrit Merged openstack/keystoneauth master: add support for auth_receipts and multi-method auth https://review.opendev.org/675049
02:04:21 adriant mordred, dtroyer: I assume the two of you are who I need to bug about MFA in the sdk and osc?
02:06:03 adriant I'm thinking, if I can focus on Horizon, I can probably get that done before Train release (hopefully)
02:06:18 adriant so I don't know if I can do the sdk and osc work, but I can review it
04:34:22 adriant dtroyer, mordred: I kind of am imagining we eventually do something like this:
04:34:22 adriant http://paste.openstack.org/show/757171/
04:34:41 adriant which maybe even generates and saves (based on an option) a clouds.yaml file with the values you enter
04:35:09 adriant additionally we may want to think about how we want to handle the MFA error from keystoneauth when it gets raised
04:35:54 adriant and... lastly I don't think we have any SDK or CLI ways to enable MFA for a user and manage their auth rules?
04:36:05 adriant but I'm not 100% sure on that
05:18:38 adriant yeah, doesn't look like the SDK supports user options as a value on the user object
05:18:55 adriant but user options lets you patch a dict so i think you can update them
05:19:06 adriant https://github.com/openstack/openstacksdk/blob/master/openstack/identity/v3/_proxy.py#L673
05:19:31 adriant ^ I think. I'm not 100% sure if that will fail because options doesn't exist as an option on the user object
08:43:02 openstackgerrit Rabi Mishra proposed openstack/keystoneauth master: Allow initializing session with connection retries https://review.opendev.org/676648
10:45:18 mordred adriant: yeah- I've actually wanted a login command for a while - I think if we do it right it could also be used to add a clouds.yaml entry - like from openrc values - or maybe like kubectl setcontext to set a "default" flag in the clouds.yaml (*waves hands*)
12:37:50 openstackgerrit Monty Taylor proposed openstack/openstacksdk master: Make block-storage work with proxies https://review.opendev.org/675382
12:38:38 mordred Shrews, dtantsur|afk: ^^ I think that should work now - but we might need to squash it with the previous patch to make it all work happily. I figure reviewing separate before the squash would be friendlier
12:53:51 Shrews mordred: okie dokie. will take a peek shortly
12:54:22 mordred Shrews: you're going to "love" it
12:55:18 Shrews like i "love" getting punched in the face?
13:01:10 mordred Shrews: yeah. pretty much just like that
14:14:21 openstackgerrit Monty Taylor proposed openstack/openstacksdk master: Make block-storage work with proxies https://review.opendev.org/675382
14:16:16 mordred stupid pep8
14:52:32 Shrews mordred: i left you a question/comment on that
15:01:29 openstackgerrit David Shrewsbury proposed openstack/openstacksdk master: Add header to auto-delete image upload objects https://review.opendev.org/676714
15:30:46 mordred corvus: ^^ might be the rare SDK patch you want to review
15:33:04 corvus mordred, Shrews: ++
15:33:26 openstackgerrit Monty Taylor proposed openstack/openstacksdk master: Make block-storage work with proxies https://review.opendev.org/675382
15:33:35 mordred corvus: I don't know why it took us so long to think of that :)
15:59:46 openstackgerrit David Shrewsbury proposed openstack/openstacksdk master: Avoid unnecessary object meta prefix in proxy https://review.opendev.org/676726
16:00:01 edleafe Shout out to all the API-SIG Offcie Hour people! Take a number and queue politely!
16:06:45 edleafe ok, mriedem, back of the line!
17:11:21 mordred Shrews: zomg. https://review.opendev.org/#/c/675382 worked
17:20:21 mordred Shrews: there's also two patches before the fixture patch - https://review.opendev.org/#/c/675178 and https://review.opendev.org/#/c/675130 that are ready whenever
18:10:07 openstackgerrit Monty Taylor proposed openstack/openstacksdk master: Replace catalog-v3.json with keystoneauth fixture https://review.opendev.org/675187
18:11:09 mordred Shrews: thanks! ^^ merged the block-storage patch into the catalog fixture patch
18:11:23 mordred (which is still a net-reduction in LOC)
19:14:54 efried mordred: Still that first ironic-sdk-in-nova patch succeeds but the second one fails. Do you have a minute to help me debug?
19:24:35 openstackgerrit Merged openstack/openstacksdk master: Avoid unnecessary object meta prefix in proxy https://review.opendev.org/676726
19:24:36 openstackgerrit Merged openstack/openstacksdk master: Add header to auto-delete image upload objects https://review.opendev.org/676714
19:36:59 openstackgerrit Merged openstack/openstacksdk master: Validate that connect_as connects as the project https://review.opendev.org/675178
20:55:50 mordred efried: poop - was AFK - can you point me at the failng patch?
20:56:13 efried https://zuul.opendev.org/t/openstack/build/fcf71dbb7bd743249b69c83c8f2ba72a/log/controller/logs/screen-n-cpu.txt.gz?severity=3
20:56:50 efried mordred: From what I can tell, we're (correctly) getting a conn error while the service is still coming up
20:56:50 efried BUT
20:56:50 efried because allow_version_hack=True we're actually returning an adapter rather than raising an exception.
20:56:50 mordred efried: cool thanks
20:56:59 mordred oh
20:57:02 mordred that's ...
20:57:42 efried I noticed there's a few places we explicitly set allow_version_hack=True, but afaict that's the default in ksa anyway.
20:57:46 mordred this is really a behavior design issue that I think we're going to need to fix - and is an actual valid usecase for wanting the other behavior
20:58:10 mordred sdk is assuming that an end-user is wanting to talk to a cloud, and that the cloud exists, so it does what it can to get them _something_
20:58:28 mordred but for nova - you want the inverse - you *want* an error when there is an issue with the remote servie
20:58:44 mordred beause you're more assured that you know what you're doing so if you get an error it's because there is an error
20:58:49 efried I don't think this is one of the sdk paths where we explicitly set allow_version_hack=True. I think we're not setting that, but getting True because that's the default.
20:59:11 efried that being the case, a possible solution is to default allow_version_hack=False *except* in those cases where we set it explicitly.
20:59:14 efried Three of them, I believe.
20:59:34 efried efried@efried-ThinkPad-W520:~/openstack/openstacksdk$ git grep -n allow_version_hack
20:59:34 efried openstack/service_description.py:109: allow_version_hack=True,
20:59:34 efried openstack/service_description.py:205: allow_version_hack=True,
20:59:34 efried openstack/service_description.py:229: allow_version_hack=True,
20:59:51 mordred yeah - but regardless of that setting, sdk is going to, as it currently stands, try REALLY hard to not throw an exception for you
21:00:13 efried mm. Then yeah, I need a way to pass an option that says "throw an exception unless what you give me is really working"
21:00:17 mordred I kind of think we need a connection flag "raise_on_missing_service" or something named better than that
21:00:19 mordred yeah
21:01:19 mordred because contrary to an end-user who may be trying to use a weird cloud, or one that's configured weirdly and may not know all the ins and outs - it is *expected* that an admin will have told nova about anyhting weird in their cloud
21:01:35 mordred and it is much better to get a hard logged error so the admin can investigate the misconfig
21:01:45 efried for sure.
21:01:56 mordred efried: I have a thought ... let me see if I can make a patch
21:02:15 efried fwiw, the same sequence with ironicclient looks like this: https://zuul.opendev.org/t/openstack/build/402a73a9238643c2b893d53b37a6ce27/log/controller/logs/screen-n-cpu.txt.gz?severity=3
21:02:50 efried wait, sorry, that's not right.
21:02:58 mordred efried: you get "virtdriver not ready" when the service pointed to by the catalog is not there, yes?
21:04:24 efried VirtDriverNotReady is raised by the Ironic driver itself when it encounters an error trying to get the client (in whatever form)
21:04:58 efried This is from the previous patch, which still uses sdk, but doesn't *rely* on it really early on, for node_list:
21:04:58 efried https://zuul.opendev.org/t/openstack/build/402a73a9238643c2b893d53b37a6ce27/log/controller/logs/screen-n-cpu.txt.gz?severity=3
21:04:58 efried You can see it's getting the same error, but eventually it succeeds.
21:06:09 efried actually, I think we're seeing that error for baremetal while we're building conn for a different service
21:06:32 efried Here's a "normal" one, from before attempting to use sdk for ironic: https://zuul.opendev.org/t/openstack/build/cbe668cd674747168ac05759e9e147f3/log/controller/logs/screen-n-cpu.txt.gz?severity=3
21:07:01 efried That StrictVersion exception, which I think comes from ironicclient when the service isn't ready, is the one we're translating to VirtDriverNotReady.
21:08:26 mordred yeah - makes sense - you're asking what version the service is and you're getting nothing because there is no service
21:09:42 efried Okay, so that gels - that's raising an exception and nova is set up to deal with that and retry; but the sdk path isn't raising, so we thing things are fine and actually (probably) bounce trying to access the real thing.
21:10:36 mordred yeah- and what's worse, we're never going to re-try version discovery beacuse teh proxy will already be constructed

Earlier   Later