| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-sdks - 2026-08-18 | |||
| 20:04:21 | opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Let a caller hold the unscoped token of a federated plugin https://review.opendev.org/c/openstack/keystoneauth/+/1001419 | |
| 20:11:09 | opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Let a caller hold the unscoped token of a federated plugin https://review.opendev.org/c/openstack/keystoneauth/+/1001419 | |
| 20:15:46 | cardoe | Silly robots don't listen., | |
| 20:23:15 | opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Expose the unscoped token of a federated plugin https://review.opendev.org/c/openstack/keystoneauth/+/1001419 | |
| 20:35:25 | opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Add a v3websso authentication plugin https://review.opendev.org/c/openstack/keystoneauth/+/1000759 | |
| 20:43:36 | cardoe | stephenfin: so I've validated the keystoneauth changes without caching | |
| 20:47:19 | opendevreview | Doug Goldstein proposed openstack/openstacksdk master: Keep the unscoped credential of a federated plugin https://review.opendev.org/c/openstack/openstacksdk/+/1001423 | |
| 20:48:25 | cardoe | The cache works but minimally tested... like I dunno what's gonna happen once my token expires... will it clean it up properly or not. | |
| 20:50:21 | cardoe | I suspect it'll work poorly since there's no mechanism to evict entries from the keyring | |
| 21:10:52 | cardoe | While you're at it, mind looking at https://review.opendev.org/c/openstack/python-openstackclient/+/1000146 as well? | |
| 21:11:48 | opendevreview | Doug Goldstein proposed openstack/openstacksdk master: Add a way to discard the authentication cached for a cloud https://review.opendev.org/c/openstack/openstacksdk/+/1001431 | |
| 21:16:01 | cardoe | I picked "cloud" as my top-level command because I've locally got a number of other commands under "cloud" which interact with your clouds.yaml | |
| 21:17:37 | opendevreview | Oria Weng proposed openstack/openstacksdk master: Identity: Add support for endpoint groups https://review.opendev.org/c/openstack/openstacksdk/+/995762 | |
| 21:17:37 | opendevreview | Oria Weng proposed openstack/openstacksdk master: Identity: Add support for endpoint group/endpoint and endpoint group/project associations https://review.opendev.org/c/openstack/openstacksdk/+/999040 | |
| 21:23:11 | opendevreview | Doug Goldstein proposed openstack/python-openstackclient master: Add a "cloud cache delete" command https://review.opendev.org/c/openstack/python-openstackclient/+/1001433 | |
| 22:07:49 | TheJulia | Its a very warm jacket :) | |
| 22:14:53 | rm_work | darn no chat history | |
| 22:15:05 | rm_work | there's still a logs site somewhere right | |
| 22:20:31 | TheJulia | rm_work: yes, eavesdrop.openstack.org | |
| #openstack-sdks - 2026-08-19 | |||
| 00:33:34 | opendevreview | Oria Weng proposed openstack/python-openstackclient master: [WIP] Migrate 'endpoint group' commands to SDK https://review.opendev.org/c/openstack/python-openstackclient/+/1001447 | |
| 00:34:26 | opendevreview | Oria Weng proposed openstack/python-openstackclient master: [WIP] Migrate 'endpoint group' commands to SDK https://review.opendev.org/c/openstack/python-openstackclient/+/1001447 | |
| 08:48:37 | rm_work | cardoe: had my agent get back to your agent 😛 | |
| 09:42:22 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Simplify ruff configuration https://review.opendev.org/c/openstack/openstacksdk/+/1000827 | |
| 09:42:22 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Enable G, LOG ruff rules https://review.opendev.org/c/openstack/openstacksdk/+/1000828 | |
| 09:42:23 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Migrate requirements to pyproject.toml https://review.opendev.org/c/openstack/openstacksdk/+/953484 | |
| 09:42:23 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Drop setup.py, setup.cfg https://review.opendev.org/c/openstack/openstacksdk/+/1000825 | |
| 10:00:27 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove unnecessary/unused utils https://review.opendev.org/c/openstack/openstacksdk/+/1001475 | |
| 10:00:28 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove unnecessary use of _get_entity https://review.opendev.org/c/openstack/openstacksdk/+/1001476 | |
| 10:00:28 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove another unnecessary use of _get_entity https://review.opendev.org/c/openstack/openstacksdk/+/1001477 | |
| 10:07:50 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove unnecessary use of _get_entity https://review.opendev.org/c/openstack/openstacksdk/+/1001476 | |
| 10:07:58 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: cloud: Remove another unnecessary use of _get_entity https://review.opendev.org/c/openstack/openstacksdk/+/1001477 | |
| 10:35:40 | stephenfin | cardoe: I've sent https://review.opendev.org/c/openstack/python-openstackclient/+/1000146 on its way, and I'll come back to the websso thing either later today or early tomorrow | |
| 10:38:11 | stephenfin | I'll grab the precursor patches for ksa now though: they look much less involved | |
| 10:40:12 | stephenfin | Ah, looks like you've given the caching situation some thought and come up with https://review.opendev.org/c/openstack/keystoneauth/+/1001419 🙏 That (reworking or extending the existing caching logic) was going to be my proposal, but I wanted to spend some time making sure it made sense before throwing a potentially nonsensical idea out there | |
| 11:10:15 | opendevreview | Merged openstack/openstacksdk master: config: Add profiles helper https://review.opendev.org/c/openstack/openstacksdk/+/1001153 | |
| 11:10:17 | opendevreview | Merged openstack/openstacksdk master: docs: Use literals, not italics https://review.opendev.org/c/openstack/openstacksdk/+/1001154 | |
| 11:10:19 | opendevreview | Merged openstack/openstacksdk master: docs: Rework config guide https://review.opendev.org/c/openstack/openstacksdk/+/1001155 | |
| 11:45:46 | opendevreview | Merged openstack/openstacksdk master: Omit keystone admin endpoint in heat job https://review.opendev.org/c/openstack/openstacksdk/+/1000695 | |
| 11:45:49 | opendevreview | Merged openstack/openstacksdk master: Defer missing-catalog errors until proxy use. https://review.opendev.org/c/openstack/openstacksdk/+/997117 | |
| 11:45:51 | opendevreview | Merged openstack/openstacksdk master: Add extra param fields to get_xy networking methods https://review.opendev.org/c/openstack/openstacksdk/+/995724 | |
| 11:45:54 | opendevreview | Merged openstack/python-openstackclient master: Add network trunk subport commands https://review.opendev.org/c/openstack/python-openstackclient/+/1000146 | |
| 12:21:47 | opendevreview | Merged openstack/openstacksdk master: Simplify ruff configuration https://review.opendev.org/c/openstack/openstacksdk/+/1000827 | |
| 12:28:16 | opendevreview | Merged openstack/openstacksdk master: Enable G, LOG ruff rules https://review.opendev.org/c/openstack/openstacksdk/+/1000828 | |
| 12:33:32 | opendevreview | Merged openstack/openstacksdk master: cloud: Remove unnecessary/unused utils https://review.opendev.org/c/openstack/openstacksdk/+/1001475 | |
| 13:09:07 | opendevreview | Merged openstack/python-openstackclient master: Support compute microversion 2.94 https://review.opendev.org/c/openstack/python-openstackclient/+/872420 | |
| 13:21:05 | opendevreview | Merged openstack/openstacksdk master: block_storage: Add add/remove volumes fields to Group https://review.opendev.org/c/openstack/openstacksdk/+/995940 | |
| 13:31:23 | opendevreview | Merged openstack/openstacksdk master: block_storage: Forward list_volume query param in get_group https://review.opendev.org/c/openstack/openstacksdk/+/995937 | |
| 16:10:11 | opendevreview | Stephen Finucane proposed openstack/keystoneauth master: typing: Use objects from typing https://review.opendev.org/c/openstack/keystoneauth/+/994713 | |
| 16:10:12 | opendevreview | Stephen Finucane proposed openstack/keystoneauth master: pre-commit: Bump versions https://review.opendev.org/c/openstack/keystoneauth/+/1001538 | |
| 16:36:14 | opendevreview | Merged openstack/openstacksdk master: cloud: Remove unnecessary use of _get_entity https://review.opendev.org/c/openstack/openstacksdk/+/1001476 | |
| 16:36:17 | opendevreview | Merged openstack/openstacksdk master: cloud: Remove another unnecessary use of _get_entity https://review.opendev.org/c/openstack/openstacksdk/+/1001477 | |
| 16:48:06 | opendevreview | Merged openstack/python-openstackclient master: Add leak-routes related options for subnets https://review.opendev.org/c/openstack/python-openstackclient/+/998212 | |
| 18:19:15 | opendevreview | Merged openstack/openstacksdk master: baremetal: Add support for runbook traits and description https://review.opendev.org/c/openstack/openstacksdk/+/1000375 | |
| 18:33:09 | cardoe | stephenfin: well if you're good with that approach I'll address rm_work's feedback | |
| 19:39:52 | opendevreview | Oria Weng proposed openstack/openstacksdk master: Identity: Add support for endpoint groups https://review.opendev.org/c/openstack/openstacksdk/+/995762 | |
| 21:06:59 | opendevreview | Rajat Dhasmana proposed openstack/python-openstackclient master: Cinder: Add support for export/import replica https://review.opendev.org/c/openstack/python-openstackclient/+/1001076 | |
| 21:07:34 | opendevreview | Rajat Dhasmana proposed openstack/openstacksdk master: Volume: Add support for export/import replica https://review.opendev.org/c/openstack/openstacksdk/+/1001075 | |
| 22:10:36 | rm_work | cardoe: you are aware I think that most of my reviews on this topic are AI driven, but I do review all the reviews by hand and try to understand before posting, so I THINK everything I posted is legitimate, I've found it to be a good way to learn a new codebase to force the AI to explain it to me in different ways until I get it 😆 | |
| 22:10:50 | rm_work | but I think you're having your agent review my agent reviews so I don't feel too bad | |
| 22:10:54 | cardoe | rm_work: so I agree with most of them | |
| 22:11:07 | cardoe | The one about the SSO token needing to change I don't. | |
| 22:11:36 | rm_work | hmmm | |
| 22:11:39 | cardoe | But that's where you have the escape hatch of "openstack cloud auth delete" | |
| 22:11:45 | rm_work | was that the thing with multiple cloud profiles? | |
| 22:12:07 | cardoe | Yeah I don't think it makes sense to tie one OS_CLOUD entry to one SSO and another to another SSO | |
| 22:12:16 | rm_work | ok well in my case | |
| 22:12:17 | cardoe | You don't have any visibility in doing that. | |
| 22:12:28 | rm_work | I had to scrub the internal example I have but | |
| 22:12:39 | rm_work | I have two profiles that I actually DO use separate SSO for within one cloud | |
| 22:12:52 | rm_work | so if it doesn't support that I may have to patch it internally or ... figure something out | |
| 22:13:19 | rm_work | if it tries to use my normal SSO profile for admin basically, it will cause issues | |
| 22:13:37 | rm_work | or if i login as admin first and then it uses that profile for my normal user cloud entry, that would be bad and somewhat silent | |
| 22:14:17 | cardoe | But there's no way to reasonably select that. | |
| 22:14:43 | cardoe | The selection of the SSO is going to be whatever browser based page you have | |
| 22:14:56 | cardoe | And we cannot pass along any values to the browser via the WebSSO protocol. | |
| 22:14:58 | rm_work | including the clouds.yaml profile name in the key splits them? and for most cases people will only have one or two, and a second login is usually quick | |
| 22:15:07 | cardoe | Hence the CSRF topic. | |
| 22:15:29 | rm_work | do we not build the cache key? | |
| 22:17:41 | cardoe | So I've got ~30 OS_CLOUD's in my clouds.yaml which will share the same SSO | |
| 22:19:22 | cardoe | So I guess I'd want it to be flexible. | |
| 22:19:40 | rm_work | hmmm | |
| 22:19:58 | rm_work | let me see what the cache key is again | |
| 22:20:14 | rm_work | maybe if it includes like ... query params i could just add like ?admin or something | |
| 22:20:20 | rm_work | to the URL lol | |
| 22:20:34 | rm_work | trying to find which CR that was in | |
| 22:24:22 | rm_work | ah got it | |
| 22:26:03 | rm_work | hmmm no that wouldn't work T_T | |
| 22:30:46 | rm_work | could you add like auth_cache_namespace to the clouds.yaml profile and then use hash(auth_cache_namespace + keystoneauth configuration ID) | |
| 22:31:13 | rm_work | which I guess then leads to "which is default" | |
| 22:32:48 | rm_work | I would prefer "explicitly share cache namespace" as required or else don't... so like, defaulting cache namespace to the cloud profile name 😄 because that seems like the least likely to be a security-oops, but I do understand that is the more tedious option for the average user who likely doesn't care (I assume I'm the outlier) | |
| 22:54:42 | opendevreview | Merged openstack/openstacksdk master: [typing] Add proper type hints for role assignment functions https://review.opendev.org/c/openstack/openstacksdk/+/1000095 | |
| #openstack-sdks - 2026-08-20 | |||
| 00:49:31 | cardoe | rm_work: but it’s not a security oops when you are using SSO in a browser you are not prompted to change auth or select auth. It’s using that. The clouds.yaml implies no credentials or permissions. Your SSO token is unscoped and all that happens with clouds.yaml is that it tries to do is rescope the unscoped token to what clouds.yaml has. | |
| 00:51:05 | rm_work | hmmm mine usually asks if i want to use the current identity and i click no and type my other one | |
| 00:51:09 | rm_work | (in the browser) | |
| 00:51:29 | rm_work | but if it doesn't re-pop the browser for the other profile i wouldn't get that chance | |
| 00:52:44 | rm_work | or for some i have to clear my cookies before re-auth with is already annoying | |
| 09:37:19 | opendevreview | Oria Weng proposed openstack/openstacksdk master: Identity: Add support for endpoint group/endpoint and endpoint group/project associations https://review.opendev.org/c/openstack/openstacksdk/+/999040 | |
| 10:27:30 | opendevreview | Vladislav Terekhov proposed openstack/openstacksdk master: identity: Add federated attribute support to User https://review.opendev.org/c/openstack/openstacksdk/+/1001638 | |
| 10:57:22 | opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Pass segment_size in create_object https://review.opendev.org/c/openstack/openstacksdk/+/931575 | |
| 12:27:23 | opendevreview | Merged openstack/openstacksdk master: Migrate requirements to pyproject.toml https://review.opendev.org/c/openstack/openstacksdk/+/953484 | |