| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-sdks - 2023-05-19 | |||
| 16:43:42 | gtema | It is anyway already some exception handling case | |
| 16:45:30 | noonedeadpunk | Well, responding with catalog when policy disallows that is kinda weird from keystone side then.... | |
| 16:45:59 | noonedeadpunk | but yeah, I never tried that | |
| 16:46:51 | noonedeadpunk | but catalog is weird overall I'd say.... | |
| 17:06:27 | gtema | Catalog is one of the best things of Openstack in my eyes. It is not without issues, but still is a very good thing | |
| 17:08:45 | noonedeadpunk | The problem I have with it, is that it exposes internal/admin endpoints | |
| 17:09:11 | noonedeadpunk | Which is weird, as I'd say it should return only endpoint that was in request (or was accessed through) | |
| 17:09:53 | noonedeadpunk | like if you pass interface: public, in return you get internal&admin as well | |
| 17:11:13 | noonedeadpunk | and that disables ability to do some kind of reselling, ie create random interfaces and URI's for it (with different FQDNs). But then you ask for catalog and in return you have like everything... | |
| 17:11:55 | gtema | I guess this will not be a hard stuff to fix, and I agree, this is one of the issues | |
| 17:12:48 | gtema | At a very least it is very easy to build a filtering proxy to be deployed for public | |
| 17:18:58 | noonedeadpunk | ugh, wrappers | |
| 17:19:48 | noonedeadpunk | very-very slippery path | |
| 17:19:59 | noonedeadpunk | anyway :) | |
| 17:20:10 | noonedeadpunk | have a good weekend! | |
| 17:22:39 | gtema | thks, you too | |
| #openstack-sdks - 2023-05-20 | |||
| 06:57:54 | frickler | noonedeadpunk: gtema: you can define endpoint filters in keystone in order to drop internal/admin endpoints per project. the problem is that things like nova break then, if they are configured to use the internal endpoints to talk to other services, since they will query the catalog with the user creds, too | |
| 07:23:45 | gtema | frickler, but they are using service accounts. It should be possible to hide non public data with a regular access and expose them on other access types. But I agree this is all bit tricky, at least how should osc differentiate an admin willing to do some service configuration from regular user. | |
| 09:25:25 | noonedeadpunk | I would say it smth that could be covered by policy | |
| 09:25:53 | noonedeadpunk | or based on passed `endpoint` in credentials or whenever | |
| 09:26:40 | gtema | I would suggest we can implement default filter = public in the OSC so that by default user will not get other EPs, only when explicitly requested | |
| 09:27:16 | gtema | this will surely not properly hide all other EPs, but at least can be treated as first step on filtering stuff not usefull for end user by default | |
| 09:27:37 | noonedeadpunk | Well, I don't think it's smth that should be done on client side to be frank | |
| 09:27:49 | noonedeadpunk | Maybe endpoint filtering is a thing indeed, need to play with that | |
| 09:28:27 | gtema | I mean before something is done on the server it can be filtered on client side (same as we go in publiccloud with flavors and images while waiting for serverside to be extended) | |
| 09:30:07 | noonedeadpunk | it somehow reminds me of "security by obscurity", except it's not really a security thing in this case | |
| 09:30:47 | gtema | sure, it is not currently about security, but rather about usability and sense-bility | |
| 09:31:34 | noonedeadpunk | (it depends how stupid your setup is ofc) | |
| 09:31:37 | gtema | but I suggest we discuss this deeper during summit/ptg in person | |
| 09:31:41 | noonedeadpunk | ++ | |
| 09:37:25 | noonedeadpunk | frickler: yeah, endpoint filtering is quite close, in case put some extra work to it to be able to assiciate with domains, so that all users with the domain scope would be filtered. And remove limitation using interface as a filter, ie if I wanna create `public2` interface and return only it to some domain | |
| 09:40:27 | noonedeadpunk | (and don't return it to others) | |
| #openstack-sdks - 2023-05-21 | |||
| 18:53:43 | opendevreview | Samuel Loegering proposed openstack/openstacksdk master: Add share replica resource to shared file system https://review.opendev.org/c/openstack/openstacksdk/+/873324 | |
| 19:03:54 | opendevreview | Samuel Loegering proposed openstack/openstacksdk master: Add share instance export location resource to shared file system https://review.opendev.org/c/openstack/openstacksdk/+/873327 | |
| #openstack-sdks - 2023-05-22 | |||
| 15:07:42 | opendevreview | Arvid Requate proposed openstack/keystoneauth master: Support PKCE with v3oidcdeviceauthz https://review.opendev.org/c/openstack/keystoneauth/+/883852 | |
| 15:57:07 | opendevreview | Lajos Katona proposed openstack/openstacksdk master: FWAAS: add Computed summary field to FirewallRule https://review.opendev.org/c/openstack/openstacksdk/+/883859 | |
| #openstack-sdks - 2023-05-23 | |||
| 07:53:19 | opendevreview | Arvid Requate proposed openstack/keystoneauth master: Support PKCE with v3oidcdeviceauthz https://review.opendev.org/c/openstack/keystoneauth/+/883852 | |
| 09:34:49 | opendevreview | Bence Romsics proposed openstack/python-openstackclient master: Neutron port hints https://review.opendev.org/c/openstack/python-openstackclient/+/882274 | |
| 14:46:29 | opendevreview | Bence Romsics proposed openstack/python-openstackclient master: Neutron port hints https://review.opendev.org/c/openstack/python-openstackclient/+/882274 | |
| 14:48:54 | opendevreview | Bence Romsics proposed openstack/python-openstackclient master: Neutron port hints https://review.opendev.org/c/openstack/python-openstackclient/+/882274 | |
| 15:46:30 | opendevreview | Elod Illes proposed openstack/openstacksdk stable/ussuri: Use ussuri-eol tag for heat checkout https://review.opendev.org/c/openstack/openstacksdk/+/883949 | |
| 16:50:06 | opendevreview | Antonia Gaete proposed openstack/python-openstackclient master: Add image metadef resource type commands {list, create, delete, set} https://review.opendev.org/c/openstack/python-openstackclient/+/883279 | |
| #openstack-sdks - 2023-05-24 | |||
| 09:02:01 | opendevreview | Graeme Moss proposed openstack/keystoneauth stable/2023.1: Make v3oidcpassword send client_id https://review.opendev.org/c/openstack/keystoneauth/+/883925 | |
| 09:02:24 | opendevreview | Graeme Moss proposed openstack/keystoneauth stable/zed: Make v3oidcpassword send client_id https://review.opendev.org/c/openstack/keystoneauth/+/883926 | |
| 10:32:31 | opendevreview | Rajat Dhasmana proposed openstack/openstacksdk master: WIP: Add attachment create, update, show support https://review.opendev.org/c/openstack/openstacksdk/+/884167 | |
| 11:09:17 | opendevreview | Bence Romsics proposed openstack/python-openstackclient master: Neutron port hints https://review.opendev.org/c/openstack/python-openstackclient/+/882274 | |
| 17:13:14 | opendevreview | Antonia Gaete proposed openstack/python-openstackclient master: Add image metadef resource type command 'list' https://review.opendev.org/c/openstack/python-openstackclient/+/883279 | |
| #openstack-sdks - 2023-05-25 | |||
| 03:52:43 | opendevreview | Lars Kellogg-Stedman proposed openstack/openstacksdk master: Allow tags to be passed through to compute.create_server https://review.opendev.org/c/openstack/openstacksdk/+/884311 | |
| 06:05:28 | opendevreview | Ke Niu proposed openstack/api-sig master: Use py3 as the default runtime for tox https://review.opendev.org/c/openstack/api-sig/+/883829 | |
| 11:54:21 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: tests: Isolate tests from OS_CLOUD https://review.opendev.org/c/openstack/openstacksdk/+/884367 | |
| 12:01:21 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: exceptions: Remove unused exception https://review.opendev.org/c/openstack/openstacksdk/+/884369 | |
| 12:04:05 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Filter FIPs by valid filters https://review.opendev.org/c/openstack/openstacksdk/+/875645 | |
| 12:04:09 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Ignore invalid filters https://review.opendev.org/c/openstack/openstacksdk/+/884390 | |
| 12:04:13 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Reduce duplication https://review.opendev.org/c/openstack/openstacksdk/+/884391 | |
| 13:27:36 | opendevreview | Rajat Dhasmana proposed openstack/openstacksdk master: WIP: Add volume summary support https://review.opendev.org/c/openstack/openstacksdk/+/884397 | |
| 13:27:51 | opendevreview | Merged openstack/openstacksdk master: tests: Silence warning https://review.opendev.org/c/openstack/openstacksdk/+/883492 | |
| 13:34:29 | opendevreview | Rajat Dhasmana proposed openstack/python-openstackclient master: Migrate 'volume summary' command to SDK https://review.opendev.org/c/openstack/python-openstackclient/+/884398 | |
| 14:35:48 | opendevreview | Elod Illes proposed openstack/openstacksdk stable/ussuri: Use ussuri-eol tag for heat checkout https://review.opendev.org/c/openstack/openstacksdk/+/883949 | |
| 16:32:51 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Migrate warnings to openstack.warnings https://review.opendev.org/c/openstack/openstacksdk/+/884416 | |
| 16:32:52 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Use custom warnings everywhere https://review.opendev.org/c/openstack/openstacksdk/+/884417 | |
| 16:32:52 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: tests: Ignore our own deprecation warnings https://review.opendev.org/c/openstack/openstacksdk/+/884418 | |
| 16:32:53 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: tests: Enable UserWarning by default https://review.opendev.org/c/openstack/openstacksdk/+/884419 | |
| 16:35:51 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Ignore invalid filters https://review.opendev.org/c/openstack/openstacksdk/+/884390 | |
| 16:35:55 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Reduce duplication https://review.opendev.org/c/openstack/openstacksdk/+/884391 | |
| 16:40:40 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: docs: Replace/remove shade-specific docs https://review.opendev.org/c/openstack/openstacksdk/+/878644 | |
| 16:41:19 | opendevreview | Elod Illes proposed openstack/openstacksdk stable/ussuri: [stable-only] Use ussuri-eol tag for heat checkout https://review.opendev.org/c/openstack/openstacksdk/+/883949 | |
| 16:47:03 | opendevreview | Merged openstack/keystoneauth stable/2023.1: Make v3oidcpassword send client_id https://review.opendev.org/c/openstack/keystoneauth/+/883925 | |
| 17:07:19 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Remove '_ShadeAdapter' https://review.opendev.org/c/openstack/openstacksdk/+/846216 | |
| 17:07:20 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Rename shade-specific method https://review.opendev.org/c/openstack/openstacksdk/+/884423 | |
| 19:20:00 | opendevreview | Elod Illes proposed openstack/openstacksdk stable/train: [stable-only] Use train-eol for heat and drop l-c job https://review.opendev.org/c/openstack/openstacksdk/+/884437 | |
| #openstack-sdks - 2023-05-26 | |||
| 01:40:18 | opendevreview | Merged openstack/openstacksdk master: Migrate warnings to openstack.warnings https://review.opendev.org/c/openstack/openstacksdk/+/884416 | |
| 01:40:19 | opendevreview | Merged openstack/openstacksdk master: tests: Isolate tests from OS_CLOUD https://review.opendev.org/c/openstack/openstacksdk/+/884367 | |
| 07:54:14 | opendevreview | Elod Illes proposed openstack/openstacksdk stable/ussuri: [stable-only] Use ussuri-eol tag for heat checkout https://review.opendev.org/c/openstack/openstacksdk/+/883949 | |
| 09:25:28 | opendevreview | Polina Gubina proposed openstack/ansible-collections-openstack master: Shared file system module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/883201 | |
| 11:13:59 | opendevreview | Elod Illes proposed openstack/openstacksdk stable/train: [stable-only] Use train-eol for heat and drop l-c job https://review.opendev.org/c/openstack/openstacksdk/+/884437 | |
| 13:12:19 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove '_ShadeAdapter' https://review.opendev.org/c/openstack/openstacksdk/+/846216 | |
| 13:12:19 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Rename shade-specific method https://review.opendev.org/c/openstack/openstacksdk/+/884423 | |
| 13:12:20 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove ClusteringCloudMixin https://review.opendev.org/c/openstack/openstacksdk/+/884493 | |
| 13:12:20 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: utils: Add 'supports_version' https://review.opendev.org/c/openstack/openstacksdk/+/884494 | |
| 13:12:21 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Move identity-related helpers https://review.opendev.org/c/openstack/openstacksdk/+/884495 | |
| 13:12:21 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove '_is_client_version' https://review.opendev.org/c/openstack/openstacksdk/+/884496 | |
| 13:12:22 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove '_{service}_client' properties https://review.opendev.org/c/openstack/openstacksdk/+/884497 | |
| 13:12:23 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove '_orchestration_client' https://review.opendev.org/c/openstack/openstacksdk/+/884498 | |
| 13:12:23 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove '_object_store_client' https://review.opendev.org/c/openstack/openstacksdk/+/884499 | |
| 13:12:25 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove dead method https://review.opendev.org/c/openstack/openstacksdk/+/884500 | |
| 13:32:02 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Use custom warnings everywhere https://review.opendev.org/c/openstack/openstacksdk/+/884417 | |
| 13:32:03 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: tests: Ignore our own deprecation warnings https://review.opendev.org/c/openstack/openstacksdk/+/884418 | |
| 13:32:03 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: tests: Enable UserWarning by default https://review.opendev.org/c/openstack/openstacksdk/+/884419 | |
| 14:18:15 | opendevreview | Merged openstack/openstacksdk stable/ussuri: [stable-only] Use ussuri-eol tag for heat checkout https://review.opendev.org/c/openstack/openstacksdk/+/883949 | |
| 15:11:18 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: tests: Use uuid, not randint https://review.opendev.org/c/openstack/openstacksdk/+/884514 | |
| 15:17:37 | opendevreview | Artem Goncharov proposed openstack/openstacksdk master: WIP: Implement auto-code generation https://review.opendev.org/c/openstack/openstacksdk/+/882326 | |
| 15:18:27 | opendevreview | Artem Goncharov proposed openstack/python-openstackclient master: [DNM]: poc generated code https://review.opendev.org/c/openstack/python-openstackclient/+/882568 | |
| 15:20:57 | opendevreview | Merged openstack/keystoneauth master: Remove last reference to the python six package https://review.opendev.org/c/openstack/keystoneauth/+/883383 | |
| 15:27:02 | opendevreview | Merged openstack/keystoneauth stable/zed: Make v3oidcpassword send client_id https://review.opendev.org/c/openstack/keystoneauth/+/883926 | |
| 15:33:30 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: DNM: Debug issues with removal of _orchestration_client https://review.opendev.org/c/openstack/openstacksdk/+/884517 | |
| 15:42:20 | opendevreview | Artem Goncharov proposed openstack/openstacksdk master: Add image metadef_resource_type into the registry https://review.opendev.org/c/openstack/openstacksdk/+/884518 | |
| 15:47:26 | opendevreview | Artem Goncharov proposed openstack/python-openstackclient master: [DNM] generated code for metadef_resource_type https://review.opendev.org/c/openstack/python-openstackclient/+/884521 | |
| #openstack-sdks - 2023-05-27 | |||
| 13:04:05 | opendevreview | Vadym Markov proposed openstack/keystoneauth master: Keep request-id at redirect https://review.opendev.org/c/openstack/keystoneauth/+/864309 | |
| #openstack-sdks - 2023-05-29 | |||
| 09:14:05 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: docs: Replace/remove shade-specific docs https://review.opendev.org/c/openstack/openstacksdk/+/878644 | |
| 09:24:25 | opendevreview | suzhengwei proposed openstack/openstacksdk master: support notification vmoves for masakari https://review.opendev.org/c/openstack/openstacksdk/+/872080 | |