| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-sdks - 2019-11-04 | |||
| 22:10:58 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: compute: autogenerate docs https://review.opendev.org/692916 | |
| 22:17:44 | mriedem | woot | |
| 22:31:06 | openstackgerrit | Merged openstack/osc-lib master: Add KeyValueAppendAction to osc-lib https://review.opendev.org/685359 | |
| 22:31:07 | openstackgerrit | Merged openstack/osc-lib master: Switch to Ussuri jobs https://review.opendev.org/690839 | |
| #openstack-sdks - 2019-11-05 | |||
| 00:01:08 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Add redirect testing https://review.opendev.org/692929 | |
| 00:01:08 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Deflate .htaccess https://review.opendev.org/692930 | |
| 00:01:09 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: WIP: identity: autogenerate docs https://review.opendev.org/692931 | |
| 00:41:31 | openstackgerrit | Merged openstack/python-openstackclient master: neutron: autogenerate docs https://review.opendev.org/691767 | |
| 07:53:19 | openstackgerrit | Bence Romsics proposed openstack/openstacksdk master: Add router add/remove route operations https://review.opendev.org/674324 | |
| 07:53:43 | openstackgerrit | Bence Romsics proposed openstack/openstacksdk master: Handle HTTP errors in add/remove router interface calls https://review.opendev.org/687304 | |
| 08:53:16 | openstackgerrit | Thomas Bechtold proposed openstack/openstacksdk master: update OVH vendor entry https://review.opendev.org/692961 | |
| 13:09:20 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Update a stale doc reference to use :neutron-doc: https://review.opendev.org/692605 | |
| 13:09:21 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: common: autogenerate docs https://review.opendev.org/691989 | |
| 13:09:21 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: openstack.cli: autogenerate docs https://review.opendev.org/692914 | |
| 13:09:22 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: compute: autogenerate docs https://review.opendev.org/692916 | |
| 13:09:22 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Add redirect testing https://review.opendev.org/692929 | |
| 13:09:23 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Deflate .htaccess https://review.opendev.org/692930 | |
| 13:09:23 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: WIP: identity: autogenerate docs https://review.opendev.org/692931 | |
| 13:09:50 | efried | dtroyer: trivial rebase to resolve merge conflict ^ | |
| 13:09:57 | efried | couple of those already had your +A | |
| 13:48:34 | dtroyer | efried: thanks, will have a look after the next call (or during depending on how it goes :) | |
| 13:49:29 | efried | no hurry | |
| 14:23:40 | mnasiadka | Hi there | |
| 14:24:06 | mnasiadka | Any idea how to request a system scoped token in Ansible os_* modules that are using openstacksdk? | |
| 14:30:56 | efried | mnasiadka: There are many words in there that I don't know. The people most likely to be able to answer your question are probably all at the summit/PTG in Shanghai at the moment, so you may want to ask your question on the mailing list, or wait until next week. | |
| 14:31:46 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: identity: autogenerate docs https://review.opendev.org/692931 | |
| 14:32:35 | mnasiadka | efried: It was my plan to wait until next week, but I decided it won't hurt to ask now, and in a week ;-) | |
| 14:32:55 | efried | good plan :) | |
| 14:33:58 | gtema | the only opportunity to influence the token scope is not to specify project_name, but both domain_name and user_domain_name | |
| 14:34:07 | gtema | this will give you domain scoped token | |
| 14:34:30 | gtema | if you do not specify domain_name, but project_name - you get project scoped token | |
| 14:37:36 | mnasiadka | gtema: we have a bug opened in Kolla (https://bugs.launchpad.net/kolla-ansible/+bug/1850656), we're trying to find the proper approach. | |
| 14:37:36 | openstack | Launchpad bug 1850656 in kolla-ansible train "Deploy will fail if keystone.conf has '[oslo_policy]/enforce_scope=true'" [Medium,In progress] - Assigned to Radosław Piliszek (yoctozepto) | |
| 14:38:04 | mnasiadka | gtema: seems for identity:create_endpoint we need system scoped token... | |
| 14:39:12 | gtema | and this with Ansible (facepalm). efried, do you know how to get system scoped token from Keystone? | |
| 14:39:24 | gtema | I was previously always referring to https://docs.openstack.org/keystone/pike/api_curl_examples.html for samples | |
| 14:39:39 | efried | gtema: I don't even know what a system scoped token is. | |
| 14:40:02 | gtema | it's kinda neither of both, but is even more powerful | |
| 14:40:22 | gtema | https://docs.openstack.org/keystone/stein/admin/tokens-overview.html#system-scoped-tokens | |
| 14:41:23 | gtema | I hoped you know a bit more than I about Keystone ;-) | |
| 14:41:32 | efried | https://docs.openstack.org/keystone/stein/admin/tokens-overview.html#operation_create_system_token ? | |
| 14:41:51 | efried | gtema: I know things about ksa, but very little about keystone itself :( | |
| 14:42:33 | gtema | ok, with this link it might be possible to trace down which request is being sent | |
| 14:42:34 | efried | It looks like ``--os-system-scope all`` might be the secret sauce you're looking for? | |
| 14:42:42 | gtema | yeah | |
| 14:43:46 | mnasiadka | tried using system-scope: all in the auth dict that os_* Ansible modules consume, but didn't really help :) | |
| 14:44:16 | gtema | mnasiadka, no, forget it. For the moment I doubt it will work | |
| 14:44:48 | mnasiadka | Well, I found that bit in the python-openstackclient, but not really in openstacksdk - so I thought it will not work :) | |
| 14:45:29 | gtema | oh, can you try following: in your clouds.yaml or kind of do not specify project_name, domain_name, but 'system: all' | |
| 14:45:31 | efried | according to a release note... | |
| 14:45:39 | gtema | not system-scope, but really system: all | |
| 14:45:48 | efried | efried@efried-ThinkPad-W520:~/openstack/python-openstackclient$ cat releasenotes/notes/implement-system-scope-4c3c47996f98deac.yaml | |
| 14:45:49 | efried | --- | |
| 14:45:49 | efried | features: | |
| 14:45:49 | efried | - | | |
| 14:45:49 | efried | Add support for system-scope to ``role`` commands. This includes the ability to | |
| 14:45:49 | efried | generate system-scoped tokens using ``system_scope: all`` in ``cloud.yaml`` | |
| 14:45:49 | efried | or ``OS_SYSTEM_SCOPE=all`` in an environment variable. Support is also | |
| 14:45:50 | efried | included for managing role assignments on the system using ``--system`` | |
| 14:45:50 | efried | when adding and removing roles. | |
| 14:45:51 | efried | [`bp system-scope <https://blueprints.launchpad.net/keystone/+spec/system-scope>`_] | |
| 14:46:07 | efried | so, try that clouds.yaml or env var thing? | |
| 14:46:28 | mnasiadka | ok, so system: all - let's try :) | |
| 14:46:30 | efried | the env var ought to map to that --os-system-scope CLI opt as well. | |
| 14:46:46 | efried | looks like ``system_scope: all`` | |
| 14:47:26 | gtema | https://github.com/openstack/python-openstackclient/blob/master/openstackclient/identity/v3/token.py#L200 | |
| 14:47:36 | gtema | according to that it is system: all | |
| 14:47:57 | gtema | but a nice hint - might be changed in future | |
| 14:48:43 | mnasiadka | without deprecation? :) | |
| 14:49:05 | gtema | This could change in the future when, or if, | |
| 14:49:06 | gtema | # keystone supports the ability to scope to a subset of the entire | |
| 14:49:06 | gtema | # deployment system. | |
| 14:49:38 | mnasiadka | ok, makes sense | |
| 14:50:56 | efried | gtema: it looks like the `system` key is for the API, not the CLI. | |
| 14:51:32 | gtema | yeah, I was searching what KSA will look for | |
| 14:52:14 | gtema | https://review.opendev.org/#/c/525687/21/keystone/tests/common/auth.py | |
| 14:52:23 | gtema | might be still API | |
| 14:52:40 | efried | https://docs.openstack.org/api-ref/identity/v3/index.html?expanded=token-authentication-with-scoped-authorization-detail#authentication-and-token-management | |
| 14:53:20 | gtema | also looking to same place - and yes: system is a key for API | |
| 14:53:34 | efried | mnasiadka: you said SDK, are you trying to write the SDK side of this, or are you working with a CLI? | |
| 14:53:37 | gtema | now need to reverse it to what should be in clouds.yaml | |
| 14:53:53 | gtema | sdk is used by ansible modules | |
| 14:54:05 | mnasiadka | efried: I'm just using ansible in Kolla-Ansible (OpenStack deployer), and ansible is using openstacksdk for all openstack modules | |
| 14:54:08 | gtema | so whatever ansible does go to SDK and it uses KSA | |
| 14:56:36 | efried | I'm having trouble finding where sdk supports /tokens APIs at all... | |
| 14:57:03 | gtema | it is done by KSA | |
| 14:57:08 | efried | I suppose you could always just grab a raw identity proxy and POST /tokens manually. | |
| 15:01:16 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: identity: autogenerate docs https://review.opendev.org/692931 | |
| 15:01:16 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: image: autogenerate docs https://review.opendev.org/693025 | |
| 15:03:39 | mnasiadka | efried: that's the last option on the table | |
| 15:15:42 | gtema | so, it seems to me now, that in clouds.yaml it should really be system_scope under auth section | |
| 15:16:19 | gtema | can be even a boolean, important that neither of project_xxx nor domain_xxx are present | |
| 15:18:54 | gtema | so when I have 'system_scope: true' in my clouds.yaml the KSA get's really system_scope. | |
| 15:19:32 | gtema | Problem is that in my case I get empty catalog from keystone back and KSA/SDK doesn't know what to do with it | |
| 15:24:31 | gtema | mnasiadka: you should try it first without ansible at all, whether you can really login with system scope. This requires also a heavy admin user privileges, from what I understand | |
| 16:04:31 | yoctozepto | gtema: this is admin user, with role admin on system all | |
| 16:04:54 | openstackgerrit | Artem Goncharov proposed openstack/python-openstackclient master: Switch image to use SDK https://review.opendev.org/650374 | |
| 16:05:11 | yoctozepto | we just could not get the ansible module to work in the new environ | |
| 16:05:36 | gtema | I know, I mean I can't verify whether this works at all, since I do not have access currently to admin user | |
| 16:07:17 | gtema | if you could prepare clouds.yaml config with your admin user and system_scope: true, and then try execute http://paste.openstack.org/show/785811/ | |