| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-sdks - 2019-11-05 | |||
| 14:24:06 | mnasiadka | Any idea how to request a system scoped token in Ansible os_* modules that are using openstacksdk? | |
| 14:30:56 | efried | mnasiadka: There are many words in there that I don't know. The people most likely to be able to answer your question are probably all at the summit/PTG in Shanghai at the moment, so you may want to ask your question on the mailing list, or wait until next week. | |
| 14:31:46 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: identity: autogenerate docs https://review.opendev.org/692931 | |
| 14:32:35 | mnasiadka | efried: It was my plan to wait until next week, but I decided it won't hurt to ask now, and in a week ;-) | |
| 14:32:55 | efried | good plan :) | |
| 14:33:58 | gtema | the only opportunity to influence the token scope is not to specify project_name, but both domain_name and user_domain_name | |
| 14:34:07 | gtema | this will give you domain scoped token | |
| 14:34:30 | gtema | if you do not specify domain_name, but project_name - you get project scoped token | |
| 14:37:36 | mnasiadka | gtema: we have a bug opened in Kolla (https://bugs.launchpad.net/kolla-ansible/+bug/1850656), we're trying to find the proper approach. | |
| 14:37:36 | openstack | Launchpad bug 1850656 in kolla-ansible train "Deploy will fail if keystone.conf has '[oslo_policy]/enforce_scope=true'" [Medium,In progress] - Assigned to Radosław Piliszek (yoctozepto) | |
| 14:38:04 | mnasiadka | gtema: seems for identity:create_endpoint we need system scoped token... | |
| 14:39:12 | gtema | and this with Ansible (facepalm). efried, do you know how to get system scoped token from Keystone? | |
| 14:39:24 | gtema | I was previously always referring to https://docs.openstack.org/keystone/pike/api_curl_examples.html for samples | |
| 14:39:39 | efried | gtema: I don't even know what a system scoped token is. | |
| 14:40:02 | gtema | it's kinda neither of both, but is even more powerful | |
| 14:40:22 | gtema | https://docs.openstack.org/keystone/stein/admin/tokens-overview.html#system-scoped-tokens | |
| 14:41:23 | gtema | I hoped you know a bit more than I about Keystone ;-) | |
| 14:41:32 | efried | https://docs.openstack.org/keystone/stein/admin/tokens-overview.html#operation_create_system_token ? | |
| 14:41:51 | efried | gtema: I know things about ksa, but very little about keystone itself :( | |
| 14:42:33 | gtema | ok, with this link it might be possible to trace down which request is being sent | |
| 14:42:34 | efried | It looks like ``--os-system-scope all`` might be the secret sauce you're looking for? | |
| 14:42:42 | gtema | yeah | |
| 14:43:46 | mnasiadka | tried using system-scope: all in the auth dict that os_* Ansible modules consume, but didn't really help :) | |
| 14:44:16 | gtema | mnasiadka, no, forget it. For the moment I doubt it will work | |
| 14:44:48 | mnasiadka | Well, I found that bit in the python-openstackclient, but not really in openstacksdk - so I thought it will not work :) | |
| 14:45:29 | gtema | oh, can you try following: in your clouds.yaml or kind of do not specify project_name, domain_name, but 'system: all' | |
| 14:45:31 | efried | according to a release note... | |
| 14:45:39 | gtema | not system-scope, but really system: all | |
| 14:45:48 | efried | efried@efried-ThinkPad-W520:~/openstack/python-openstackclient$ cat releasenotes/notes/implement-system-scope-4c3c47996f98deac.yaml | |
| 14:45:49 | efried | --- | |
| 14:45:49 | efried | features: | |
| 14:45:49 | efried | - | | |
| 14:45:49 | efried | Add support for system-scope to ``role`` commands. This includes the ability to | |
| 14:45:49 | efried | generate system-scoped tokens using ``system_scope: all`` in ``cloud.yaml`` | |
| 14:45:49 | efried | or ``OS_SYSTEM_SCOPE=all`` in an environment variable. Support is also | |
| 14:45:50 | efried | included for managing role assignments on the system using ``--system`` | |
| 14:45:50 | efried | when adding and removing roles. | |
| 14:45:51 | efried | [`bp system-scope <https://blueprints.launchpad.net/keystone/+spec/system-scope>`_] | |
| 14:46:07 | efried | so, try that clouds.yaml or env var thing? | |
| 14:46:28 | mnasiadka | ok, so system: all - let's try :) | |
| 14:46:30 | efried | the env var ought to map to that --os-system-scope CLI opt as well. | |
| 14:46:46 | efried | looks like ``system_scope: all`` | |
| 14:47:26 | gtema | https://github.com/openstack/python-openstackclient/blob/master/openstackclient/identity/v3/token.py#L200 | |
| 14:47:36 | gtema | according to that it is system: all | |
| 14:47:57 | gtema | but a nice hint - might be changed in future | |
| 14:48:43 | mnasiadka | without deprecation? :) | |
| 14:49:05 | gtema | This could change in the future when, or if, | |
| 14:49:06 | gtema | # keystone supports the ability to scope to a subset of the entire | |
| 14:49:06 | gtema | # deployment system. | |
| 14:49:38 | mnasiadka | ok, makes sense | |
| 14:50:56 | efried | gtema: it looks like the `system` key is for the API, not the CLI. | |
| 14:51:32 | gtema | yeah, I was searching what KSA will look for | |
| 14:52:14 | gtema | https://review.opendev.org/#/c/525687/21/keystone/tests/common/auth.py | |
| 14:52:23 | gtema | might be still API | |
| 14:52:40 | efried | https://docs.openstack.org/api-ref/identity/v3/index.html?expanded=token-authentication-with-scoped-authorization-detail#authentication-and-token-management | |
| 14:53:20 | gtema | also looking to same place - and yes: system is a key for API | |
| 14:53:34 | efried | mnasiadka: you said SDK, are you trying to write the SDK side of this, or are you working with a CLI? | |
| 14:53:37 | gtema | now need to reverse it to what should be in clouds.yaml | |
| 14:53:53 | gtema | sdk is used by ansible modules | |
| 14:54:05 | mnasiadka | efried: I'm just using ansible in Kolla-Ansible (OpenStack deployer), and ansible is using openstacksdk for all openstack modules | |
| 14:54:08 | gtema | so whatever ansible does go to SDK and it uses KSA | |
| 14:56:36 | efried | I'm having trouble finding where sdk supports /tokens APIs at all... | |
| 14:57:03 | gtema | it is done by KSA | |
| 14:57:08 | efried | I suppose you could always just grab a raw identity proxy and POST /tokens manually. | |
| 15:01:16 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: identity: autogenerate docs https://review.opendev.org/692931 | |
| 15:01:16 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: image: autogenerate docs https://review.opendev.org/693025 | |
| 15:03:39 | mnasiadka | efried: that's the last option on the table | |
| 15:15:42 | gtema | so, it seems to me now, that in clouds.yaml it should really be system_scope under auth section | |
| 15:16:19 | gtema | can be even a boolean, important that neither of project_xxx nor domain_xxx are present | |
| 15:18:54 | gtema | so when I have 'system_scope: true' in my clouds.yaml the KSA get's really system_scope. | |
| 15:19:32 | gtema | Problem is that in my case I get empty catalog from keystone back and KSA/SDK doesn't know what to do with it | |
| 15:24:31 | gtema | mnasiadka: you should try it first without ansible at all, whether you can really login with system scope. This requires also a heavy admin user privileges, from what I understand | |
| 16:04:31 | yoctozepto | gtema: this is admin user, with role admin on system all | |
| 16:04:54 | openstackgerrit | Artem Goncharov proposed openstack/python-openstackclient master: Switch image to use SDK https://review.opendev.org/650374 | |
| 16:05:11 | yoctozepto | we just could not get the ansible module to work in the new environ | |
| 16:05:36 | gtema | I know, I mean I can't verify whether this works at all, since I do not have access currently to admin user | |
| 16:07:17 | gtema | if you could prepare clouds.yaml config with your admin user and system_scope: true, and then try execute http://paste.openstack.org/show/785811/ | |
| 16:23:24 | yoctozepto | gtema: I see, I'll try to set it up later, thanks | |
| 19:37:11 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Refactor AggregateTests https://review.opendev.org/693073 | |
| 21:32:18 | openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Refactor AggregateTests https://review.opendev.org/693073 | |
| 23:07:17 | openstackgerrit | Merged openstack/python-openstackclient master: Update a stale doc reference to use :neutron-doc: https://review.opendev.org/692605 | |
| #openstack-sdks - 2019-11-06 | |||
| 00:02:12 | mordred | mnasiadka, yoctozepto: we should also likely do something in sdk so that calls to create_endpoint get a system-scoped token for you for their calls so that you don't have to have a separate clouds.yaml entry | |
| 00:02:44 | mordred | (the separate entry is a good way to ensure this all works for now - but that seems like a pretty terrible UI to ask you to do for this) | |
| 00:33:11 | openstackgerrit | Merged openstack/python-openstackclient master: common: autogenerate docs https://review.opendev.org/691989 | |
| 00:33:13 | openstackgerrit | Merged openstack/python-openstackclient master: openstack.cli: autogenerate docs https://review.opendev.org/692914 | |
| 00:34:49 | openstackgerrit | Merged openstack/python-openstackclient master: compute: autogenerate docs https://review.opendev.org/692916 | |
| 01:27:43 | openstackgerrit | Bence Romsics proposed openstack/openstacksdk master: Add router add/remove route operations https://review.opendev.org/674324 | |
| 01:27:57 | openstackgerrit | Bence Romsics proposed openstack/openstacksdk master: Handle HTTP errors in add/remove router interface calls https://review.opendev.org/687304 | |
| 03:30:34 | openstackgerrit | Bence Romsics proposed openstack/python-openstackclient master: Add command: router add/remove route --route https://review.opendev.org/674325 | |
| 03:55:03 | openstackgerrit | Merged openstack/python-openstackclient master: Add redirect testing https://review.opendev.org/692929 | |
| 03:55:04 | openstackgerrit | Merged openstack/python-openstackclient master: Deflate .htaccess https://review.opendev.org/692930 | |
| 05:59:25 | openstackgerrit | Merged openstack/python-openstackclient master: Refactor AggregateTests https://review.opendev.org/693073 | |
| 06:24:36 | mnasiadka | mordred: agreed, now it doesn't really work at all - when I do not supply domain in clouds.yaml - keystone complains it needs one, if I do - the token is not system scoped. So I guess in both cases it doesn't really do a system scoped token... I'll raise a bug. | |
| 11:37:15 | frickler | python-novaclient 16.0 seems to be breaking heat and therefore sdk testing https://zuul.opendev.org/t/openstack/build/2c83d0168fda4384837b676d336694ed/log/controller/logs/screen-h-eng.txt.gz#1379-1410 | |
| 11:38:20 | frickler | https://zuul.opendev.org/t/openstack/builds?job_name=openstacksdk-functional-devstack | |
| 13:28:06 | efried | frickler: anything I can do about that novaclient breakage? | |
| 13:29:06 | efried | (I haven't looked at it yet, but I was following the steps that led up to that requirements patch being mergeable) | |
| 14:43:35 | openstackgerrit | Pedro Henrique Pereira Martins proposed openstack/keystoneauth master: Fixes OIDC authentication with multiple IdPs https://review.opendev.org/692140 | |
| 15:01:42 | frickler | efried: there's a fix proposed in heat now https://review.opendev.org/693165 but I see you already reviewed it | |
| 15:01:57 | efried | yup | |