| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-sdks - 2026-08-14 | |||
| 15:44:13 | opendevreview | Merged openstack/codegenerator master: fix(rust-cli,rust-tui): dispatch response schema by resolved (not floor-only) microversion https://review.opendev.org/c/openstack/codegenerator/+/1000881 | |
| 16:11:34 | stephenfin | cardoe: I think openstacksdk already supports caching of tokens? Or do you mean something else? | |
| 16:11:47 | cardoe | This is something else. | |
| 16:13:14 | cardoe | So we you are using federation, we need to mint an unscoped token for the keystone shadow user that represents your federated user. Then we use that unscoped token to scope into the project or domain or whatever you're trying to work with. | |
| 16:13:33 | cardoe | Retrieving that unscoped token involves round-tripping the web browser. | |
| 16:14:09 | cardoe | So we cache that unscoped token on disk with an expiration lifetime. Once that expiration is hit we delete it. | |
| 16:14:28 | stephenfin | Gotcha | |
| 16:14:45 | cardoe | Otherwise every invocation of the "openstack" CLI would involve opening the web browser | |
| 16:15:08 | stephenfin | yeah, which is the issue with e.g. the totp flow at the moment, iirc | |
| 16:15:46 | cardoe | Our internal implementation has made some modifications to allow a client (python-openstackclient for example) to provide a tokencache interface | |
| 16:15:51 | stephenfin | I've a feeling I've mentioned this on a review somewhere (maybe your old websso patch?) but this kind of caching is something I think should live in the application (OSC) here, with only hooks in the lib where needed | |
| 16:16:03 | cardoe | Yes you did. | |
| 16:16:16 | cardoe | And that's what I'm wanting to discuss with you. A design for this. | |
| 16:16:29 | stephenfin | aha, understood | |
| 16:16:51 | cardoe | Our tokencache has a .get(cache_id) and a .set(cache_id, token) and a .delete(cache_id) | |
| 16:17:25 | cardoe | And I'm using https://pypi.org/project/keyring/ | |
| 16:17:33 | stephenfin | That broadly matches what I know from keyring | |
| 16:17:38 | stephenfin | jinx 😅 | |
| 16:17:54 | cardoe | The proper way to do it I see involves touching ksa and python-openstackclient and maybe more. | |
| 16:19:43 | cardoe | We've also got "openstack cloud [current,list,set,show,unset,use]" commands | |
| 16:20:23 | cardoe | Not sure if you ever heard of https://github.com/major/supernova | |
| 16:21:08 | stephenfin | I have not | |
| 16:21:55 | stephenfin | Is that still relevant with cloud files/OS_CLOUD? | |
| 16:22:03 | cardoe | No | |
| 16:22:12 | cardoe | But it was something Rackspace did before that existed. | |
| 16:22:57 | cardoe | We started a replacement that was OSC based forever ago as well. | |
| 16:24:01 | cardoe | So the websso implementation is coming from that code base. | |
| 16:24:59 | stephenfin | And I guess this is relevant because the caching ties into the model for those "clouds"? | |
| 16:25:20 | cardoe | yeah | |
| 16:25:29 | cardoe | I'm happy to show you sometime if that'd be easier. | |
| 16:26:10 | cardoe | I've got ~30 entries in my clouds.yaml | |
| 16:29:58 | cardoe | I've also "fixed" one of the reasons that system scope and project scope token usage failed. Which was that it was annoying to have two OS_CLOUD representations and have to switch between the two for different operations. | |
| 16:30:33 | cardoe | Unfortunately it breaks compat with stock OSC. | |
| 16:30:50 | cardoe | But that'd be another place I'd love to get your feedback on how I could do this in an upstreamable way. | |
| 16:31:38 | cardoe | Whatever I change, I'm more than happy to contribute the same changes to gophercloud as well. | |
| 16:34:29 | cardoe | Of course I realize I'm getting a bit ahead of myself here. | |
| 16:34:36 | cardoe | So happy to just get the websso stuff done. :) | |
| 16:34:44 | stephenfin | All sounds good. That would be interesting to see | |
| 16:35:17 | stephenfin | But yeah, going back to the websso stuff: if we could get it in without the caching first, that would simplify the change greatly I suspect | |
| 16:36:02 | stephenfin | Then for the caching, I would normally suggest a spec, but we don't do those in SDK. So instead, how about we get a user doc that describes how to use the caching, which we can then use to inform the code? | |
| 16:38:18 | stephenfin | I suspect how it "feels" is more important than the code, particularly given the different types of application we've to content with (file-based caching is far more important for short-lived processes like OSC than for long-lived ones like nova, while I guess threading is a concern for the latter but not the former) | |
| 16:40:09 | stephenfin | ...and, you know, the fact code is now cheap 😅 | |
| 16:49:42 | opendevreview | Artem Goncharov proposed openstack/codegenerator master: fix(openapi): safely handle schemas missing 'type' field https://review.opendev.org/c/openstack/codegenerator/+/1000983 | |
| 18:06:45 | opendevreview | Merged openstack/codegenerator master: fix(openapi): safely handle schemas missing 'type' field https://review.opendev.org/c/openstack/codegenerator/+/1000983 | |
| 18:51:49 | opendevreview | melanie witt proposed openstack/openstacksdk master: Add functional tests and Zuul job for accelerator (Cyborg) https://review.opendev.org/c/openstack/openstacksdk/+/995851 | |
| 18:51:49 | opendevreview | melanie witt proposed openstack/openstacksdk master: Add AGENTS.md and document functional test conventions https://review.opendev.org/c/openstack/openstacksdk/+/1000999 | |
| 20:49:34 | opendevreview | melanie witt proposed openstack/openstacksdk master: Add AGENTS.md and document functional test conventions https://review.opendev.org/c/openstack/openstacksdk/+/1000999 | |
| 23:02:36 | opendevreview | Merged openstack/openstacksdk master: Add functional tests and Zuul job for accelerator (Cyborg) https://review.opendev.org/c/openstack/openstacksdk/+/995851 | |
| #openstack-sdks - 2026-08-16 | |||
| 21:13:28 | opendevreview | Silvia Wachira proposed openstack/python-openstackclient master: zuul: Enable Manila devstack plugin for functional tests https://review.opendev.org/c/openstack/python-openstackclient/+/1000266 | |
| 21:17:14 | opendevreview | Rajat Dhasmana proposed openstack/openstacksdk master: Volume: Add support for export/import replica https://review.opendev.org/c/openstack/openstacksdk/+/1001075 | |
| 21:18:34 | opendevreview | Rajat Dhasmana proposed openstack/python-openstackclient master: Cinder: Add support for export/import replica https://review.opendev.org/c/openstack/python-openstackclient/+/1001076 | |
| #openstack-sdks - 2026-08-17 | |||
| 11:13:59 | opendevreview | Silvia Wachira proposed openstack/python-openstackclient master: share: Add share server list, show, delete commands https://review.opendev.org/c/openstack/python-openstackclient/+/990746 | |
| 11:13:59 | opendevreview | Silvia Wachira proposed openstack/python-openstackclient master: share: Add share network commands https://review.opendev.org/c/openstack/python-openstackclient/+/990817 | |
| 11:14:00 | opendevreview | Silvia Wachira proposed openstack/python-openstackclient master: share: Add share access rule commands https://review.opendev.org/c/openstack/python-openstackclient/+/1001118 | |
| 11:22:48 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Rework formatting section of HACKING.rst https://review.opendev.org/c/openstack/openstacksdk/+/1001122 | |
| 12:20:08 | opendevreview | Silvia Wachira proposed openstack/python-openstackclient master: share: Add share access rule commands https://review.opendev.org/c/openstack/python-openstackclient/+/1001118 | |
| 12:44:20 | opendevreview | Merged openstack/openstacksdk master: Add AGENTS.md and document functional test conventions https://review.opendev.org/c/openstack/openstacksdk/+/1000999 | |
| 12:44:23 | opendevreview | Merged openstack/openstacksdk master: [DNS] Increase the zones quota before creating a new one - v2 https://review.opendev.org/c/openstack/openstacksdk/+/1000933 | |
| 12:44:25 | opendevreview | Merged openstack/openstacksdk master: Rework formatting section of HACKING.rst https://review.opendev.org/c/openstack/openstacksdk/+/1001122 | |
| 13:46:15 | cardoe | stephenfin: can you let the tests run on https://github.com/gophercloud/gophercloud/pull/3941 | |
| 13:57:05 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: config: Add profiles helper https://review.opendev.org/c/openstack/openstacksdk/+/1001153 | |
| 13:57:06 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: docs: Use literals, not italics https://review.opendev.org/c/openstack/openstacksdk/+/1001154 | |
| 13:57:06 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: docs: Rework config guide https://review.opendev.org/c/openstack/openstacksdk/+/1001155 | |
| 14:24:48 | stephenfin | cardoe: I missed my opportunity to do so and now GitHub is down 😅 | |
| 14:25:06 | cardoe | alas it is a day that ends in Y | |
| 14:26:00 | cardoe | Well if ya want to comment on the Python version at https://review.opendev.org/c/openstack/keystoneauth/+/1000759 I'm happy to make changes there. | |
| 16:34:56 | stephenfin | cardoe: I took a look through that ksa change and left some comments | |
| 16:39:25 | cardoe | Thank you | |
| 16:49:46 | cardoe | stephenfin: so I personally cache it through OSC and not via ksa | |
| 17:08:38 | stephenfin | wdym? There's caching code in the Plugin in that change? | |
| 17:39:14 | cardoe | yeah I can figure out why. | |
| 17:40:54 | cardoe | stephenfin: btw github is back if you wanna let that gophercloud one run | |
| 22:06:40 | cardoe | stephenfin: oh I had to do some digging get_cache_id() doesn't work cause it encodes scope in there. The token we cache is unscoped. Honestly scope sucks the way clouds.yaml does it. I really want 1 OS_CLOUD entry which would allow my user to get a system-scope or project-scope token in the future anyway. That was one of the reasons why adopting system-scope failed. | |
| #openstack-sdks - 2026-08-18 | |||
| 15:48:03 | opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Add a v3websso authentication plugin https://review.opendev.org/c/openstack/keystoneauth/+/1000759 | |
| 16:11:20 | cardoe | stephenfin: any chance you've had a moment to think about the scope question above? | |
| 16:23:17 | cardoe | So I dug a bit further. get_auth_state() and set_auth_state() always return the scoped token. get_cache_id() is also required by design to return NotImplemented for federated plugins because we're not suppose to cache scoped tokens. | |
| 16:44:50 | opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Rescope federated tokens to a system scope https://review.opendev.org/c/openstack/keystoneauth/+/1001382 | |
| 20:04:21 | opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Let a caller hold the unscoped token of a federated plugin https://review.opendev.org/c/openstack/keystoneauth/+/1001419 | |
| 20:11:09 | opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Let a caller hold the unscoped token of a federated plugin https://review.opendev.org/c/openstack/keystoneauth/+/1001419 | |
| 20:15:46 | cardoe | Silly robots don't listen., | |
| 20:23:15 | opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Expose the unscoped token of a federated plugin https://review.opendev.org/c/openstack/keystoneauth/+/1001419 | |
| 20:35:25 | opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Add a v3websso authentication plugin https://review.opendev.org/c/openstack/keystoneauth/+/1000759 | |
| 20:43:36 | cardoe | stephenfin: so I've validated the keystoneauth changes without caching | |
| 20:47:19 | opendevreview | Doug Goldstein proposed openstack/openstacksdk master: Keep the unscoped credential of a federated plugin https://review.opendev.org/c/openstack/openstacksdk/+/1001423 | |
| 20:48:25 | cardoe | The cache works but minimally tested... like I dunno what's gonna happen once my token expires... will it clean it up properly or not. | |
| 20:50:21 | cardoe | I suspect it'll work poorly since there's no mechanism to evict entries from the keyring | |
| 21:10:52 | cardoe | While you're at it, mind looking at https://review.opendev.org/c/openstack/python-openstackclient/+/1000146 as well? | |
| 21:11:48 | opendevreview | Doug Goldstein proposed openstack/openstacksdk master: Add a way to discard the authentication cached for a cloud https://review.opendev.org/c/openstack/openstacksdk/+/1001431 | |
| 21:16:01 | cardoe | I picked "cloud" as my top-level command because I've locally got a number of other commands under "cloud" which interact with your clouds.yaml | |
| 21:17:37 | opendevreview | Oria Weng proposed openstack/openstacksdk master: Identity: Add support for endpoint groups https://review.opendev.org/c/openstack/openstacksdk/+/995762 | |
| 21:17:37 | opendevreview | Oria Weng proposed openstack/openstacksdk master: Identity: Add support for endpoint group/endpoint and endpoint group/project associations https://review.opendev.org/c/openstack/openstacksdk/+/999040 | |
| 21:23:11 | opendevreview | Doug Goldstein proposed openstack/python-openstackclient master: Add a "cloud cache delete" command https://review.opendev.org/c/openstack/python-openstackclient/+/1001433 | |
| 22:07:49 | TheJulia | Its a very warm jacket :) | |
| 22:14:53 | rm_work | darn no chat history | |
| 22:15:05 | rm_work | there's still a logs site somewhere right | |
| 22:20:31 | TheJulia | rm_work: yes, eavesdrop.openstack.org | |
| #openstack-sdks - 2026-08-19 | |||
| 00:33:34 | opendevreview | Oria Weng proposed openstack/python-openstackclient master: [WIP] Migrate 'endpoint group' commands to SDK https://review.opendev.org/c/openstack/python-openstackclient/+/1001447 | |
| 00:34:26 | opendevreview | Oria Weng proposed openstack/python-openstackclient master: [WIP] Migrate 'endpoint group' commands to SDK https://review.opendev.org/c/openstack/python-openstackclient/+/1001447 | |
| 08:48:37 | rm_work | cardoe: had my agent get back to your agent 😛 | |
| 09:42:22 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Simplify ruff configuration https://review.opendev.org/c/openstack/openstacksdk/+/1000827 | |