| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-sdks - 2024-02-20 | |||
| 10:36:26 | opendevreview | Pranali Deore proposed openstack/openstacksdk master: Adding support for new add/get location apis https://review.opendev.org/c/openstack/openstacksdk/+/883271 | |
| 13:12:52 | opendevreview | Mridula Joshi proposed openstack/python-openstackclient master: Adds CLI support for glance md-tags https://review.opendev.org/c/openstack/python-openstackclient/+/905866 | |
| 13:20:45 | opendevreview | Tatsuya Hayashino proposed openstack/keystoneauth master: Update requests of device flow for public client https://review.opendev.org/c/openstack/keystoneauth/+/909561 | |
| 16:07:21 | stephenfin | M0weng[m]: I'm guessing you still have to push the change? https://review.opendev.org/c/openstack/python-openstackclient/+/909030/8/openstackclient/tests/unit/identity/v3/test_user.py#29 | |
| 17:09:54 | opendevreview | Mridula Joshi proposed openstack/python-openstackclient master: Adding client support for ``glance image-upload`` https://review.opendev.org/c/openstack/python-openstackclient/+/882938 | |
| 17:17:50 | opendevreview | Merged openstack/openstacksdk master: Resource locks and access rules restrictions https://review.opendev.org/c/openstack/openstacksdk/+/889519 | |
| 18:21:02 | opendevreview | Oria Weng proposed openstack/python-openstackclient master: identity: Migrate 'user' commands to SDK https://review.opendev.org/c/openstack/python-openstackclient/+/909030 | |
| 18:47:55 | ozzzo_work | I'm reading this: https://docs.openstack.org/openstacksdk/latest/user/guides/object_store.html | |
| 18:48:54 | ozzzo_work | and trying to use an admin account to look at user projects. For other Openstack components I'd use something like: cloud.network.networks(project_id="' + projectid + '")' | |
| 18:49:59 | ozzzo_work | but when I try that with Swift: for cont in cloud.object_store.containers(project_id="' + projectid + '"): | |
| 18:50:12 | ozzzo_work | I get an error: Invalid query params: project_id | |
| 18:55:33 | ozzzo_work | Looking here: https://docs.openstack.org/openstacksdk/latest/user/proxies/object_store.html | |
| 18:56:08 | ozzzo_work | I don't see an obvious way to specify the project. Do I need to use the old python API for this? | |
| 19:34:07 | ozzzo_work | maybe I can use the "session" parameter? Can I use the admin account to create a session pointing to a user project? | |
| 20:04:35 | ozzzo_work | When I look at the Swift API, I see a way to specify the account so it seems like there must be something corresponding in the SDK, but it's not obvious how to do it: cmd = "git --version" returned_value = os.system(cmd) # returns the exit code in unix print('returned value:', returned_value) | |
| 20:04:54 | ozzzo_work | oops bad paste; URL is: https://docs.openstack.org/api-ref/object-store/#show-container-details-and-list-objects | |
| #openstack-sdks - 2024-02-21 | |||
| 07:56:32 | adam-metal3 | Hi all! I am new to using openstack sdk and in general I am new in most openstack components, after reading the nova and openstacksdk docs I still have a question. I hope someone could give some direction. If I understand correctly multiple volumes could be attached to a VM and the VM can be booted from volume. | |
| 07:56:32 | adam-metal3 | Could there be a scenario where multiple bootable volume is attached to a VM and if yes then how could I tell via the openstacksdk that which volume was used for booting in this scenario? (I have asked this in nove IRC also not sure which channel is the better to discuss this) | |
| 09:46:45 | gtema | stephenfin: pls no merges anymore - code freeze | |
| 10:53:14 | stephenfin | gtema: ack | |
| 11:00:13 | stephenfin | adam-metal3: Really a question for #openstack-nova. I don't think it's possible though: you want the boot_index field which doesn't appear to be returned via any API | |
| 11:01:49 | adam-metal3 | stephenfin: thanks for the info ! | |
| 13:01:03 | opendevreview | Lajos Katona proposed openstack/openstacksdk master: Add sort_key and sort_dir to Network and Subnet https://review.opendev.org/c/openstack/openstacksdk/+/909656 | |
| 13:31:59 | ozzzo | Can anyone help with my Swift SDK question? | |
| 14:42:03 | amarao | Hello. Can someone see my PR for ansible module for subnet? https://review.opendev.org/c/openstack/ansible-collections-openstack/+/907301 It's already two three weeks without any feedback... | |
| 16:27:18 | opendevreview | Lajos Katona proposed openstack/python-openstackclient master: Router flavor_id can be a name https://review.opendev.org/c/openstack/python-openstackclient/+/902654 | |
| 17:09:21 | stephenfin | gtema: https://review.opendev.org/c/openstack/nova-specs/+/909448 | |
| 17:10:01 | gtema | oh, that's sweet | |
| 17:10:29 | gtema | https://github.com/gtema/openstack-codegenerator/blob/main/codegenerator/openapi/nova_schemas.py is what I ended up with | |
| 17:11:05 | stephenfin | Yeah, I saw that. I have a test that's partly inspired by that script. Just need to push it up next time I've a day to work on this | |
| 17:11:05 | gtema | what I also do not have so far are the schemas for the long deprecated operations | |
| 17:11:24 | stephenfin | Yeah, my schemas for those are '{}' | |
| 17:11:53 | stephenfin | If the resources is returning HTTP 410 (Gone), it's really crufty and not worth worrying about ImO | |
| 17:12:23 | gtema | that was also my decision | |
| 17:13:03 | stephenfin | Did you notice that the routes.Mapper.resource creates a whole load of routes that don't actually exist when you try to iterate on them? | |
| 17:13:24 | gtema | I still haven't asked TC for getting the generator back from GH to opendev (requires a new project under SDK umbrella) | |
| 17:14:24 | stephenfin | Could we fold it into os_api_ref? | |
| 17:14:46 | stephenfin | That's currently just a sphinx extension, but we could have it spit out (and consume) OpenAPI specs also | |
| 17:15:15 | stephenfin | I mean, I'd like to fix the issues with sphinx-contrib/openapi but perhaps that's more hassle than it's worth, idk | |
| 17:16:03 | gtema | neah, its tooooo much | |
| 17:16:14 | gtema | https://github.com/gtema/openstack-openapi | |
| 17:16:32 | gtema | that can be folded under the os-api-ref, but even here I doubt that it is reasonable | |
| 17:17:15 | gtema | I think I'll send tomorrow a request in mailing list asking TC for approval for 3 new projects | |
| #openstack-sdks - 2024-02-22 | |||
| 04:17:36 | opendevreview | jamesjordanblack604@gmail.com proposed openstack/python-openstackclient master: Bug Fix, Default SG Rule Custom SG https://review.opendev.org/c/openstack/python-openstackclient/+/909815 | |
| 08:37:23 | opendevreview | Lajos Katona proposed openstack/python-openstackclient master: Router flavor_id can be a name https://review.opendev.org/c/openstack/python-openstackclient/+/902654 | |
| 11:43:58 | opendevreview | Lajos Katona proposed openstack/openstacksdk master: Add sort_key and sort_dir to core Neutron resources https://review.opendev.org/c/openstack/openstacksdk/+/909656 | |
| 12:17:25 | stephenfin | gtema: You might know this. When would I want to use OS_USER_DOMAIN_ID or OS_PROJECT_DOMAIN_ID rather than OS_DOMAIN_ID? | |
| 12:18:05 | gtema | USER_DOMAIN_ID is to tell which domain to search user in (auth part) | |
| 12:18:15 | gtema | PROJECT_DOMAIN_ID is for project scope | |
| 12:18:21 | gtema | DOMAIN_ID is for domain scope | |
| 12:18:58 | stephenfin | If we have a clouds.yaml file without DOMAIN_ID provided, can we assume USER_DOMAIN_ID == DOMAIN_ID? | |
| 12:19:07 | gtema | nope | |
| 12:19:20 | gtema | then unscope auth would be used | |
| 12:23:55 | stephenfin | Are there any domain-scoped APIs? I thought most APIs were project-scoped or system-scoped (where domain presumably doesn't matter)? | |
| 12:25:04 | stephenfin | (btw, context is that gophercloud integration tests inside on a domain ID or name, but I've never seen a clouds.yaml with domain_id/domain_name defined so I'm trying to figure out why it needs it/if I can remove that requirement) | |
| 12:26:12 | gtema | OpenTelekomCloud uses domain scope actively and currently in Keystone there is work on improving it | |
| 12:26:21 | gtema | so you definitely should keep the stuff | |
| 12:27:40 | stephenfin | sorry for being slow on the uptake, but could you give me an example of an API that would use domain scope? | |
| 12:28:03 | stephenfin | you'd use it to...create a new project within a domain? | |
| 12:29:41 | gtema | in OTC all of the Identity ops require domain scope, but lemme check in Keystone what is currently in works | |
| 12:33:57 | gtema | https://review.opendev.org/c/openstack/keystone/+/908524 is one of the recent changes there | |
| 12:34:14 | gtema | it is currently under the RBAC hat | |
| 12:35:37 | gtema | but in principle you are right: creating a new user is a typical domain scope operation (it has no relation to the project) | |
| 14:27:12 | opendevreview | Mridula Joshi proposed openstack/python-openstackclient master: Add CLI support for adding multiple tags https://review.opendev.org/c/openstack/python-openstackclient/+/909870 | |
| 15:31:14 | opendevreview | jamesjordanblack604@gmail.com proposed openstack/python-openstackclient master: Bug Fix, Default SG Rule Custom SG https://review.opendev.org/c/openstack/python-openstackclient/+/909815 | |
| 15:32:51 | opendevreview | jamesjordanblack604@gmail.com proposed openstack/python-openstackclient master: Bug Fix, Default SG Rule Custom SG https://review.opendev.org/c/openstack/python-openstackclient/+/909899 | |
| 16:43:52 | johnsom | gtema On this DNS patch, what other methods are you talking about, can you provide an example? When this was added to the Designate API, designate was the only project that had this capability. | |
| 17:00:24 | gtema | jonsom: I disagree with this statement. Nova (i.e. list servers), Neutron (i.e. list networks), Cinder (i.e. list volumes) support either same or some form of filtering by project_id (independent on whether endpoint already contains project_id) and some also support "all_projects" query parameter. And this is like that since (maybe) beginning? | |
| 17:00:43 | gtema | johnsom ^^ (sorry for typo) | |
| 17:01:33 | johnsom | Nova for example, has no way to create a server on behalf of another project. | |
| 17:01:33 | johnsom | Likewise, nova has "all_tenants" as a query parameter on list, but neutron does not. | |
| 17:01:33 | johnsom | I think this is a meta-issue across all of the services and something that should be standardized via the api-wg (if there is a member left) | |
| 17:01:43 | johnsom | I was just adding that comment to the patch | |
| 17:02:11 | johnsom | This isn't for filtering, those query params are the same. | |
| 17:02:31 | johnsom | It's for impersonating a project or acting across projects | |
| 17:02:39 | gtema | I am left in api-wg, but something like that will not be easy: there is no power to force projects to follow it | |
| 17:03:06 | johnsom | Agreed, but if we at least document a "standard" it's a step in the right direction | |
| 17:03:21 | johnsom | Then it could become a "goal" (not that I am a fan of those) | |
| 17:03:33 | gtema | I agree with the problem and I see it in different places | |
| 17:03:47 | gtema | token scoping is something many people have problem with | |
| 17:03:53 | johnsom | I do | |
| 17:04:20 | johnsom | Don't get me started on system scoped tokens. lol | |
| 17:05:09 | gtema | I think idea of introducing headers is very bad, since once you go into the OpenAPI area this is just going to blow | |
| 17:05:28 | gtema | better approach would be (my personal opinion) is to address token scoping itself | |
| 17:06:20 | johnsom | At one time headers were all the rage in OpenStack. This is very old code in designate, at least 10 years old | |
| 17:06:43 | gtema | it is also unclear in the current implementation: what is the effect for the regular user, can he also use "x-auth-sudo-project" if he do not have roles on that project | |
| 17:07:10 | johnsom | We can't remove that, but if we standardize on another approach I think we would be open to adding it. token scoping is not the solution though, that just adds complexity | |
| 17:07:20 | gtema | really 10 years? I somehow never noticed those | |
| 17:07:48 | johnsom | sudo-project has RBAC rules in the middleware | |
| 17:09:14 | johnsom | Yeah, it was in havana | |
| 17:12:19 | gtema | hmm, I will need to think how to generally address that. I guess for listing "all_projects" and "project_id" as simple query parameter is a de-facto standard, and not headers. Impersonation is something we really need to discuss in wider round (maybe during vPTG) | |
| 17:12:42 | johnsom | neutron does not use those query params | |
| 17:13:04 | gtema | it has tenant_id/project_id | |
| 17:13:34 | johnsom | as a filter on list maybe, but not for create, etc. | |
| 17:14:02 | gtema | right, creation everywhere (well except Designate) is based on the token scope for the current project | |
| 17:14:03 | johnsom | I think designate has that filter too, but they have different purposes. | |
| 17:14:56 | gtema | well, I see Neutron does support setting project_id also for create resources | |
| 17:14:58 | johnsom | Think of this use case, as an admin I want to create a zone for project 123 because they called the help line. | |
| 17:15:11 | gtema | it just states: "Only administrative and users with advsvc role can specify a project ID other than their own. You cannot change this value through authorization policies." | |
| 17:15:26 | johnsom | Right, and nova doesn't. It's just inconsistent across the projects. | |