| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-sdks - 2019-11-04 | |||
| 13:33:08 | mriedem | please and thanks | |
| 15:14:56 | gtema | mriedem: you are not alone with that, I would also like to get any review on https://review.opendev.org/#/c/650374/ for switching from glanceclient to SDK. | |
| 15:20:35 | mriedem | heh, that glance one is much much bigger change | |
| 15:20:55 | mriedem | mine is "change this one nova call to use the sdk", not "change all compute api calls to use the sdk" | |
| 20:46:57 | openstackgerrit | Merged openstack/osc-lib master: Update master for stable/train https://review.opendev.org/683493 | |
| 21:39:46 | umbSublime | Is it accurate to say openstack-sdk is just added functionnality around osc-lib ? | |
| 21:41:28 | umbSublime | err other way around | |
| 21:42:42 | dtroyer | umbSublime: neither really, osc-lib is the basis for the CLI commands in OpenStackClient, but it does not depend on the SDK specifically, it provides the common bits for OSC plugins | |
| 21:43:57 | umbSublime | so then osc-lib is another layer ontop of cliff to facilitate plugin creation ? | |
| 21:46:24 | dtroyer | basically, yes. It also includes the core functionality to enable making a stand-alone CLI that isn't OpenStackClient, such as a speciaized CLI for a stand-alone service installation | |
| 21:46:47 | dtroyer | I am not certain that anyone has actually done that, but that was what the original request was for | |
| 21:47:10 | umbSublime | Thanks for clearing that out for me. I'll look more into osc-lib and cliff :) | |
| 21:49:31 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: openstack.cli: autogenerate docs https://review.opendev.org/692914 | |
| 22:03:46 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: compute: autogenerate docs https://review.opendev.org/692916 | |
| 22:09:24 | openstackgerrit | Merged openstack/python-openstackclient master: Use SDK to get compute API extensions https://review.opendev.org/691039 | |
| 22:09:28 | openstackgerrit | Merged openstack/python-openstackclient master: Use autoprogram-cliff for remaining plugin docs https://review.opendev.org/690387 | |
| 22:10:08 | efried | mriedem: ---^ | |
| 22:10:22 | efried | (16.0.0 should be unblocked now) | |
| 22:10:58 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: compute: autogenerate docs https://review.opendev.org/692916 | |
| 22:17:44 | mriedem | woot | |
| 22:31:06 | openstackgerrit | Merged openstack/osc-lib master: Add KeyValueAppendAction to osc-lib https://review.opendev.org/685359 | |
| 22:31:07 | openstackgerrit | Merged openstack/osc-lib master: Switch to Ussuri jobs https://review.opendev.org/690839 | |
| #openstack-sdks - 2019-11-05 | |||
| 00:01:08 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Add redirect testing https://review.opendev.org/692929 | |
| 00:01:08 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Deflate .htaccess https://review.opendev.org/692930 | |
| 00:01:09 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: WIP: identity: autogenerate docs https://review.opendev.org/692931 | |
| 00:41:31 | openstackgerrit | Merged openstack/python-openstackclient master: neutron: autogenerate docs https://review.opendev.org/691767 | |
| 07:53:19 | openstackgerrit | Bence Romsics proposed openstack/openstacksdk master: Add router add/remove route operations https://review.opendev.org/674324 | |
| 07:53:43 | openstackgerrit | Bence Romsics proposed openstack/openstacksdk master: Handle HTTP errors in add/remove router interface calls https://review.opendev.org/687304 | |
| 08:53:16 | openstackgerrit | Thomas Bechtold proposed openstack/openstacksdk master: update OVH vendor entry https://review.opendev.org/692961 | |
| 13:09:20 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Update a stale doc reference to use :neutron-doc: https://review.opendev.org/692605 | |
| 13:09:21 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: common: autogenerate docs https://review.opendev.org/691989 | |
| 13:09:21 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: openstack.cli: autogenerate docs https://review.opendev.org/692914 | |
| 13:09:22 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: compute: autogenerate docs https://review.opendev.org/692916 | |
| 13:09:22 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Add redirect testing https://review.opendev.org/692929 | |
| 13:09:23 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Deflate .htaccess https://review.opendev.org/692930 | |
| 13:09:23 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: WIP: identity: autogenerate docs https://review.opendev.org/692931 | |
| 13:09:50 | efried | dtroyer: trivial rebase to resolve merge conflict ^ | |
| 13:09:57 | efried | couple of those already had your +A | |
| 13:48:34 | dtroyer | efried: thanks, will have a look after the next call (or during depending on how it goes :) | |
| 13:49:29 | efried | no hurry | |
| 14:23:40 | mnasiadka | Hi there | |
| 14:24:06 | mnasiadka | Any idea how to request a system scoped token in Ansible os_* modules that are using openstacksdk? | |
| 14:30:56 | efried | mnasiadka: There are many words in there that I don't know. The people most likely to be able to answer your question are probably all at the summit/PTG in Shanghai at the moment, so you may want to ask your question on the mailing list, or wait until next week. | |
| 14:31:46 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: identity: autogenerate docs https://review.opendev.org/692931 | |
| 14:32:35 | mnasiadka | efried: It was my plan to wait until next week, but I decided it won't hurt to ask now, and in a week ;-) | |
| 14:32:55 | efried | good plan :) | |
| 14:33:58 | gtema | the only opportunity to influence the token scope is not to specify project_name, but both domain_name and user_domain_name | |
| 14:34:07 | gtema | this will give you domain scoped token | |
| 14:34:30 | gtema | if you do not specify domain_name, but project_name - you get project scoped token | |
| 14:37:36 | mnasiadka | gtema: we have a bug opened in Kolla (https://bugs.launchpad.net/kolla-ansible/+bug/1850656), we're trying to find the proper approach. | |
| 14:37:36 | openstack | Launchpad bug 1850656 in kolla-ansible train "Deploy will fail if keystone.conf has '[oslo_policy]/enforce_scope=true'" [Medium,In progress] - Assigned to Radosław Piliszek (yoctozepto) | |
| 14:38:04 | mnasiadka | gtema: seems for identity:create_endpoint we need system scoped token... | |
| 14:39:12 | gtema | and this with Ansible (facepalm). efried, do you know how to get system scoped token from Keystone? | |
| 14:39:24 | gtema | I was previously always referring to https://docs.openstack.org/keystone/pike/api_curl_examples.html for samples | |
| 14:39:39 | efried | gtema: I don't even know what a system scoped token is. | |
| 14:40:02 | gtema | it's kinda neither of both, but is even more powerful | |
| 14:40:22 | gtema | https://docs.openstack.org/keystone/stein/admin/tokens-overview.html#system-scoped-tokens | |
| 14:41:23 | gtema | I hoped you know a bit more than I about Keystone ;-) | |
| 14:41:32 | efried | https://docs.openstack.org/keystone/stein/admin/tokens-overview.html#operation_create_system_token ? | |
| 14:41:51 | efried | gtema: I know things about ksa, but very little about keystone itself :( | |
| 14:42:33 | gtema | ok, with this link it might be possible to trace down which request is being sent | |
| 14:42:34 | efried | It looks like ``--os-system-scope all`` might be the secret sauce you're looking for? | |
| 14:42:42 | gtema | yeah | |
| 14:43:46 | mnasiadka | tried using system-scope: all in the auth dict that os_* Ansible modules consume, but didn't really help :) | |
| 14:44:16 | gtema | mnasiadka, no, forget it. For the moment I doubt it will work | |
| 14:44:48 | mnasiadka | Well, I found that bit in the python-openstackclient, but not really in openstacksdk - so I thought it will not work :) | |
| 14:45:29 | gtema | oh, can you try following: in your clouds.yaml or kind of do not specify project_name, domain_name, but 'system: all' | |
| 14:45:31 | efried | according to a release note... | |
| 14:45:39 | gtema | not system-scope, but really system: all | |
| 14:45:48 | efried | efried@efried-ThinkPad-W520:~/openstack/python-openstackclient$ cat releasenotes/notes/implement-system-scope-4c3c47996f98deac.yaml | |
| 14:45:49 | efried | --- | |
| 14:45:49 | efried | features: | |
| 14:45:49 | efried | - | | |
| 14:45:49 | efried | Add support for system-scope to ``role`` commands. This includes the ability to | |
| 14:45:49 | efried | generate system-scoped tokens using ``system_scope: all`` in ``cloud.yaml`` | |
| 14:45:49 | efried | or ``OS_SYSTEM_SCOPE=all`` in an environment variable. Support is also | |
| 14:45:50 | efried | included for managing role assignments on the system using ``--system`` | |
| 14:45:50 | efried | when adding and removing roles. | |
| 14:45:51 | efried | [`bp system-scope <https://blueprints.launchpad.net/keystone/+spec/system-scope>`_] | |
| 14:46:07 | efried | so, try that clouds.yaml or env var thing? | |
| 14:46:28 | mnasiadka | ok, so system: all - let's try :) | |
| 14:46:30 | efried | the env var ought to map to that --os-system-scope CLI opt as well. | |
| 14:46:46 | efried | looks like ``system_scope: all`` | |
| 14:47:26 | gtema | https://github.com/openstack/python-openstackclient/blob/master/openstackclient/identity/v3/token.py#L200 | |
| 14:47:36 | gtema | according to that it is system: all | |
| 14:47:57 | gtema | but a nice hint - might be changed in future | |
| 14:48:43 | mnasiadka | without deprecation? :) | |
| 14:49:05 | gtema | This could change in the future when, or if, | |
| 14:49:06 | gtema | # keystone supports the ability to scope to a subset of the entire | |
| 14:49:06 | gtema | # deployment system. | |
| 14:49:38 | mnasiadka | ok, makes sense | |
| 14:50:56 | efried | gtema: it looks like the `system` key is for the API, not the CLI. | |
| 14:51:32 | gtema | yeah, I was searching what KSA will look for | |
| 14:52:14 | gtema | https://review.opendev.org/#/c/525687/21/keystone/tests/common/auth.py | |
| 14:52:23 | gtema | might be still API | |
| 14:52:40 | efried | https://docs.openstack.org/api-ref/identity/v3/index.html?expanded=token-authentication-with-scoped-authorization-detail#authentication-and-token-management | |
| 14:53:20 | gtema | also looking to same place - and yes: system is a key for API | |
| 14:53:34 | efried | mnasiadka: you said SDK, are you trying to write the SDK side of this, or are you working with a CLI? | |
| 14:53:37 | gtema | now need to reverse it to what should be in clouds.yaml | |
| 14:53:53 | gtema | sdk is used by ansible modules | |