| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-sdks - 2026-08-14 | |||
| 16:11:34 | stephenfin | cardoe: I think openstacksdk already supports caching of tokens? Or do you mean something else? | |
| 16:11:47 | cardoe | This is something else. | |
| 16:13:14 | cardoe | So we you are using federation, we need to mint an unscoped token for the keystone shadow user that represents your federated user. Then we use that unscoped token to scope into the project or domain or whatever you're trying to work with. | |
| 16:13:33 | cardoe | Retrieving that unscoped token involves round-tripping the web browser. | |
| 16:14:09 | cardoe | So we cache that unscoped token on disk with an expiration lifetime. Once that expiration is hit we delete it. | |
| 16:14:28 | stephenfin | Gotcha | |
| 16:14:45 | cardoe | Otherwise every invocation of the "openstack" CLI would involve opening the web browser | |
| 16:15:08 | stephenfin | yeah, which is the issue with e.g. the totp flow at the moment, iirc | |
| 16:15:46 | cardoe | Our internal implementation has made some modifications to allow a client (python-openstackclient for example) to provide a tokencache interface | |
| 16:15:51 | stephenfin | I've a feeling I've mentioned this on a review somewhere (maybe your old websso patch?) but this kind of caching is something I think should live in the application (OSC) here, with only hooks in the lib where needed | |
| 16:16:03 | cardoe | Yes you did. | |
| 16:16:16 | cardoe | And that's what I'm wanting to discuss with you. A design for this. | |
| 16:16:29 | stephenfin | aha, understood | |
| 16:16:51 | cardoe | Our tokencache has a .get(cache_id) and a .set(cache_id, token) and a .delete(cache_id) | |
| 16:17:25 | cardoe | And I'm using https://pypi.org/project/keyring/ | |
| 16:17:33 | stephenfin | That broadly matches what I know from keyring | |
| 16:17:38 | stephenfin | jinx 😅 | |
| 16:17:54 | cardoe | The proper way to do it I see involves touching ksa and python-openstackclient and maybe more. | |
| 16:19:43 | cardoe | We've also got "openstack cloud [current,list,set,show,unset,use]" commands | |
| 16:20:23 | cardoe | Not sure if you ever heard of https://github.com/major/supernova | |
| 16:21:08 | stephenfin | I have not | |
| 16:21:55 | stephenfin | Is that still relevant with cloud files/OS_CLOUD? | |
| 16:22:03 | cardoe | No | |
| 16:22:12 | cardoe | But it was something Rackspace did before that existed. | |
| 16:22:57 | cardoe | We started a replacement that was OSC based forever ago as well. | |
| 16:24:01 | cardoe | So the websso implementation is coming from that code base. | |
| 16:24:59 | stephenfin | And I guess this is relevant because the caching ties into the model for those "clouds"? | |
| 16:25:20 | cardoe | yeah | |
| 16:25:29 | cardoe | I'm happy to show you sometime if that'd be easier. | |
| 16:26:10 | cardoe | I've got ~30 entries in my clouds.yaml | |
| 16:29:58 | cardoe | I've also "fixed" one of the reasons that system scope and project scope token usage failed. Which was that it was annoying to have two OS_CLOUD representations and have to switch between the two for different operations. | |
| 16:30:33 | cardoe | Unfortunately it breaks compat with stock OSC. | |
| 16:30:50 | cardoe | But that'd be another place I'd love to get your feedback on how I could do this in an upstreamable way. | |
| 16:31:38 | cardoe | Whatever I change, I'm more than happy to contribute the same changes to gophercloud as well. | |
| 16:34:29 | cardoe | Of course I realize I'm getting a bit ahead of myself here. | |
| 16:34:36 | cardoe | So happy to just get the websso stuff done. :) | |
| 16:34:44 | stephenfin | All sounds good. That would be interesting to see | |
| 16:35:17 | stephenfin | But yeah, going back to the websso stuff: if we could get it in without the caching first, that would simplify the change greatly I suspect | |
| 16:36:02 | stephenfin | Then for the caching, I would normally suggest a spec, but we don't do those in SDK. So instead, how about we get a user doc that describes how to use the caching, which we can then use to inform the code? | |
| 16:38:18 | stephenfin | I suspect how it "feels" is more important than the code, particularly given the different types of application we've to content with (file-based caching is far more important for short-lived processes like OSC than for long-lived ones like nova, while I guess threading is a concern for the latter but not the former) | |
| 16:40:09 | stephenfin | ...and, you know, the fact code is now cheap 😅 | |
| 16:49:42 | opendevreview | Artem Goncharov proposed openstack/codegenerator master: fix(openapi): safely handle schemas missing 'type' field https://review.opendev.org/c/openstack/codegenerator/+/1000983 | |
| 18:06:45 | opendevreview | Merged openstack/codegenerator master: fix(openapi): safely handle schemas missing 'type' field https://review.opendev.org/c/openstack/codegenerator/+/1000983 | |
| 18:51:49 | opendevreview | melanie witt proposed openstack/openstacksdk master: Add functional tests and Zuul job for accelerator (Cyborg) https://review.opendev.org/c/openstack/openstacksdk/+/995851 | |
| 18:51:49 | opendevreview | melanie witt proposed openstack/openstacksdk master: Add AGENTS.md and document functional test conventions https://review.opendev.org/c/openstack/openstacksdk/+/1000999 | |
| 20:49:34 | opendevreview | melanie witt proposed openstack/openstacksdk master: Add AGENTS.md and document functional test conventions https://review.opendev.org/c/openstack/openstacksdk/+/1000999 | |
| 23:02:36 | opendevreview | Merged openstack/openstacksdk master: Add functional tests and Zuul job for accelerator (Cyborg) https://review.opendev.org/c/openstack/openstacksdk/+/995851 | |