Friday, 2021-01-08

« Thursday, 2021-01-07 Index Saturday, 2021-01-09 »
openstackgerritKendall Nelson proposed openstack/governance master: Add Resolution of TC stance on the OpenStackClient  https://review.opendev.org/c/openstack/governance/+/75990400:18
*** rcernin has quit IRC00:44
*** rloo has quit IRC01:03
*** ircuser-1 has quit IRC01:12
*** jamesmcarthur has quit IRC01:21
*** jamesmcarthur has joined #openstack-dev01:21
*** rcernin has joined #openstack-dev01:45
*** mlavalle has quit IRC02:06
*** _mlavalle_1 has joined #openstack-dev02:07
*** zzzeek has quit IRC02:09
*** zzzeek has joined #openstack-dev02:10
*** zzzeek has quit IRC02:15
*** zzzeek has joined #openstack-dev02:16
*** eagereagle1 has quit IRC02:19
*** njohnston has quit IRC02:37
*** tamas_erdei has joined #openstack-dev02:37
*** jamesmcarthur has quit IRC02:39
*** terdei has quit IRC02:40
*** jamesmcarthur has joined #openstack-dev02:41
*** zzzeek has quit IRC02:43
*** zzzeek has joined #openstack-dev02:45
*** jamesmcarthur has quit IRC02:45
*** jamesmcarthur has joined #openstack-dev03:03
*** jamesmcarthur has quit IRC03:04
*** jamesmcarthur has joined #openstack-dev03:04
*** ysandeep|away is now known as ysandeep03:19
*** pmannidi has quit IRC03:20
*** pmannidi has joined #openstack-dev03:21
*** jamesmcarthur has quit IRC03:31
*** jamesmcarthur has joined #openstack-dev03:36
*** jamesmcarthur has quit IRC03:36
*** jamesmcarthur has joined #openstack-dev03:36
*** rcernin has quit IRC03:39
*** rcernin has joined #openstack-dev03:52
*** rcernin has quit IRC03:52
*** rcernin has joined #openstack-dev03:52
*** bbowen_ has joined #openstack-dev04:06
*** ircuser-1 has joined #openstack-dev04:07
*** bbowen has quit IRC04:08
*** jamesmcarthur has quit IRC04:19
*** jamesmcarthur has joined #openstack-dev04:20
*** njohnston has joined #openstack-dev04:22
*** jamesmcarthur has quit IRC04:25
*** jamesmcarthur has joined #openstack-dev04:26
*** jamesmcarthur has quit IRC04:31
*** jamesmcarthur has joined #openstack-dev04:32
*** zzzeek has quit IRC04:36
*** zzzeek has joined #openstack-dev04:38
*** zzzeek has quit IRC04:49
*** zzzeek has joined #openstack-dev04:51
*** zzzeek has quit IRC05:05
*** zzzeek has joined #openstack-dev05:07
*** ysandeep is now known as ysandeep|afk05:08
*** zzzeek has quit IRC05:28
*** zzzeek has joined #openstack-dev05:31
*** evrardjp has quit IRC05:33
*** evrardjp has joined #openstack-dev05:33
*** rcernin has quit IRC05:36
*** zzzeek has quit IRC05:38
*** zzzeek has joined #openstack-dev05:40
*** rcernin has joined #openstack-dev05:44
*** zzzeek has quit IRC05:54
*** jamesmcarthur has quit IRC05:55
*** rcernin has quit IRC05:56
*** jamesmcarthur has joined #openstack-dev05:56
*** zzzeek has joined #openstack-dev05:56
*** jamesmcarthur has quit IRC06:01
*** gyee has quit IRC06:11
*** jamesmcarthur has joined #openstack-dev06:15
*** rcernin has joined #openstack-dev06:22
*** rcernin has quit IRC06:23
*** rcernin has joined #openstack-dev06:24
*** rcernin has quit IRC06:39
*** rcernin has joined #openstack-dev06:44
*** zzzeek has quit IRC06:51
*** zzzeek has joined #openstack-dev06:53
*** ralonsoh has joined #openstack-dev07:03
*** rcernin has quit IRC07:14
*** rcernin has joined #openstack-dev07:28
*** zzzeek has quit IRC07:31
*** zzzeek has joined #openstack-dev07:32
*** jcapitao has joined #openstack-dev07:41
*** ysandeep|afk is now known as ysandeep07:42
*** rcernin has quit IRC07:43
*** jgriffit1 has quit IRC07:46
*** dklyle has quit IRC07:51
*** bbowen has joined #openstack-dev08:01
*** bbowen_ has quit IRC08:02
*** whoami-rajat has joined #openstack-dev08:03
*** jgriffith has joined #openstack-dev08:07
*** ccamposr has joined #openstack-dev08:12
*** tamas_erdei is now known as terdei08:13
*** snapiri has quit IRC08:15
*** tesseract has joined #openstack-dev08:16
*** jamesmcarthur has quit IRC08:16
*** zzzeek has quit IRC08:21
*** miloa has joined #openstack-dev08:22
*** zzzeek has joined #openstack-dev08:23
*** zzzeek has quit IRC08:27
*** zzzeek has joined #openstack-dev08:28
*** rpittau|afk is now known as rpittau08:32
*** tesseract has quit IRC08:41
*** tesseract has joined #openstack-dev08:42
*** jamesmcarthur has joined #openstack-dev08:47
*** jamesmcarthur has quit IRC08:52
*** tkajinam has quit IRC08:55
*** maharg101 has joined #openstack-dev08:56
*** tosky has joined #openstack-dev08:56
*** zzzeek has quit IRC08:57
*** zzzeek has joined #openstack-dev08:58
*** jpich has joined #openstack-dev09:00
*** ysandeep is now known as ysandeep|lunch09:22
*** tesseract has quit IRC09:36
*** tesseract has joined #openstack-dev09:36
*** tesseract has quit IRC09:38
*** tesseract has joined #openstack-dev09:38
*** zzzeek has quit IRC09:44
*** zzzeek has joined #openstack-dev09:46
*** gfidente|afk is now known as gfidente09:47
*** zzzeek has quit IRC09:56
*** zzzeek has joined #openstack-dev09:57
*** dtantsur|afk is now known as dtantsur09:57
*** ttx has quit IRC10:16
*** ttx has joined #openstack-dev10:17
*** zzzeek has quit IRC10:18
*** zzzeek has joined #openstack-dev10:20
*** zzzeek has quit IRC10:27
*** zzzeek has joined #openstack-dev10:29
*** yumiriam has joined #openstack-dev10:43
*** jcapitao is now known as jcapitao_afk10:53
*** jamesmcarthur has joined #openstack-dev11:04
*** jamesmcarthur has quit IRC11:09
*** zzzeek has quit IRC11:18
*** zzzeek has joined #openstack-dev11:20
*** whoami-rajat__ has joined #openstack-dev11:26
*** whoami-rajat has quit IRC11:27
*** ysandeep|lunch is now known as ysandeep11:32
*** zzzeek has quit IRC11:38
*** zzzeek has joined #openstack-dev11:43
*** jpich has quit IRC11:44
*** jpich has joined #openstack-dev11:45
*** bbowen_ has joined #openstack-dev12:10
*** bbowen has quit IRC12:10
*** ccamposr__ has joined #openstack-dev12:14
*** ccamposr has quit IRC12:17
*** zzzeek has quit IRC12:28
*** zzzeek has joined #openstack-dev12:30
*** jcapitao_afk is now known as jcapitao12:31
*** zzzeek has quit IRC12:42
*** zzzeek has joined #openstack-dev12:45
*** SotK has quit IRC12:52
*** SotK has joined #openstack-dev12:52
*** miloa has quit IRC13:34
*** miloa has joined #openstack-dev13:37
*** ccamposr__ has quit IRC13:48
*** morazi has quit IRC13:52
*** _mlavalle_1 has quit IRC13:58
*** mlavalle has joined #openstack-dev13:58
*** zzzeek has quit IRC13:59
*** dtantsur is now known as dtantsur|brb14:00
*** zzzeek has joined #openstack-dev14:01
*** morazi has joined #openstack-dev14:03
*** rloo has joined #openstack-dev14:13
*** jgriffith has quit IRC14:39
*** ccamposr has joined #openstack-dev14:46
*** rpittau is now known as rpittau|afk14:46
*** ysandeep is now known as ysandeep|away14:49
*** jamesmcarthur has joined #openstack-dev15:06
*** jamesmcarthur has quit IRC15:10
*** pcaruana has quit IRC15:13
*** pcaruana has joined #openstack-dev15:13
*** nweinber has joined #openstack-dev15:14
*** miloa has quit IRC15:32
*** zzzeek has quit IRC15:38
*** nweinber has quit IRC15:39
*** zzzeek has joined #openstack-dev15:41
*** dtantsur|brb is now known as dtantsur15:45
*** dklyle has joined #openstack-dev15:49
dansmithlbragstad: poke15:54
lbragstado/15:54
dansmithlbragstad: hey, wondering if you can point me in the right direction15:55
lbragstaddansmith i can try - what's up?15:55
dansmithlbragstad: I want to make a simpleish http call to another service, by address, from inside a request handler, using the user's token15:55
dansmithbasically "oops, this is the wrong service, let me proxy that for you" sort of deal15:56
lbragstadok15:58
dansmithactually, someone else pointed me at something in nova which might be what I want, although I'm sure it's not going to go straight to the host15:58
dansmithlemme get a clean link15:58
dansmith'https://github.com/openstack/nova/blob/stable/ussuri/nova/network/neutron.py#L260-L27615:59
dansmiththat will give me an adapter that uses the user's token it seems15:59
dansmithand from that I guess I can do a client.get() ,,,16:00
*** jgriffith has joined #openstack-dev16:00
dansmithbut will that let me use a full url, or does that have to go through the catalog? the example I see just provides a relative url, not one with a host16:01
*** jamesmcarthur has joined #openstack-dev16:01
lbragstadso - iiuc you should be able to use the session object associated with that client16:02
lbragstadand that should give you the ability to call https://opendev.org/openstack/keystoneauth/src/branch/master/keystoneauth1/session.py#L644-L64816:02
dansmithokay, so that client is catalog-only, but if I sniff out the session I can go direct?16:03
lbragstadyes - i think so16:03
dansmithokay thanks I'll try it16:03
lbragstadok - let me know if that doesn't work16:03
lbragstadbut if you dig deep enough into ksa - you should be able to curate your own requests and bypass any of the catalog logic or assumptions16:04
dansmithack thanks16:05
*** zzzeek has quit IRC16:10
*** zzzeek has joined #openstack-dev16:12
dansmithlbragstad: actually, unwinding that code in nova, it goes pretty deep and interacts with the config for things I'm not quite sure about16:17
dansmithif I get the auth plugin from context.get_auth_plugin(), can I just initialize a Session directly with that and go?16:21
*** ircuser-1 has quit IRC16:29
dansmithman, nova has so much wrapped around this16:33
*** zzzeek has quit IRC16:35
*** zzzeek has joined #openstack-dev16:37
*** whoami-rajat__ has quit IRC16:39
lbragstaddansmith yeah - that's a good question, i was just looking at that16:42
dansmithI think I might've gotten it16:42
lbragstadit looks like most of it comes from config, so keystone_authtoken credentials?16:42
dansmithwell, I dunno, I think there's all kinds of auth plugn swap-ability, which I don't care about if I'm just feeding it the existing token16:42
dansmithI copied and cut out some stuff from nova and am working on trying it16:43
dansmithI got it to make a call to another http server, I just need to set up another openstack service to have it call16:43
dansmithlbragstad: are you a reasonable person to look at the keystoney bits of this when I have something posted?16:43
dansmithlike, to tell me "that won't work if the deployment is configured with fancypants9000 auth" or something16:44
lbragstadi'm not sure how helpful i'll be but i can take a look16:44
dansmithokay thanks16:44
lbragstaddoes nova not have a way to get a client using a session with a user token? i think all the ksa session i'm seeing are using the nova service user creds16:47
dansmithwell, it used to in the neutron module, which is the url I pasted above, but it's very roundabout16:48
dansmithI'm actually doing this for glance and so I had to just strip out the bits of the nova stuff down to the "give me an adapter for the current token" bits16:49
lbragstadok - that makes sense16:51
*** nweinber has joined #openstack-dev16:57
*** gyee has joined #openstack-dev16:58
*** jpich has quit IRC17:02
*** jcapitao has quit IRC17:03
*** jamesmcarthur has quit IRC17:04
dansmithlbragstad: dude.17:15
dansmithI think it works.17:15
lbragstad\o/17:16
lbragstadso - you were able to dig out an instance of the Session and use that?17:16
dansmithI just created a Session with auth= set to an auth plugin initialized from the token17:17
lbragstadnice17:17
dansmithnova has this auth plugin subclass that takes a token, so I copied that17:18
lbragstadnova needed to subclass that?17:18
*** tesseract has quit IRC17:18
* lbragstad thought there was a plugin for that in ksa17:19
dansmithlbragstad: needed to, or did? :)17:19
dansmithlbragstad: if so, that'd reduce the amount of crap I have to clean up17:19
lbragstaddo you have a link to the subclass?17:19
dansmithhttps://github.com/openstack/nova/blob/master/nova/context.py#L5117:20
lbragstadhttps://opendev.org/openstack/keystoneauth/src/branch/master/keystoneauth1/identity/v3/token.py#L3517:21
lbragstadyou might be able to use this17:24
lbragstadhttps://docs.openstack.org/keystoneauth/latest/api/keystoneauth1.identity.v3.html#keystoneauth1.identity.v3.TokenMethod17:24
dansmithokay I can try that17:24
lbragstadlike this example, but using v3.Token instead of v3.Password17:25
lbragstadhttps://docs.openstack.org/keystoneauth/latest/authentication-plugins.html#v3-identity-plugins17:25
lbragstadthe session should be able to deal with whatever auth plugins are passed in17:25
dansmithokay17:27
*** frenzy_friday has quit IRC17:29
dansmithlbragstad: https://pastebin.com/raw/rU2GmXwc17:36
lbragstaddansmith do you have a snippet of the code you're running?17:37
dansmithlbragstad: https://pastebin.com/3equSf8k17:38
dansmithlbragstad: that returns the session, and then I do a session.post() on it17:38
dansmithnote it works with the commented-out line, which uses that nova subclass17:38
lbragstadweird... and it fails in post()?17:39
dansmithyup17:39
*** nweinber has quit IRC17:42
lbragstadseems like a gap in that plugin17:43
dansmithokay well, in that case I'll clean what I have up and mark it as "should be replaced by something generic in keystoneauth1"17:46
lbragstadyeah - that works, what version are you using?17:47
lbragstadof ksa17:47
dansmithdan@guaranine:/opt/stack/glance$ pip3 freeze | grep keystoneauth117:47
dansmithkeystoneauth1==4.3.017:47
dansmithwhatever devstack installed this morning17:48
lbragstadthat's the latest release and nothing has been merged to master since17:54
lbragstadi opened a bug17:56
lbragstadhttps://bugs.launchpad.net/keystoneauth/+bug/191078817:56
openstackLaunchpad bug 1910788 in keystoneauth "Using request() methods on session objects with Token plugins break" [Undecided,New]17:56
lbragstaddansmith possible workaround18:13
lbragstadhttps://bugs.launchpad.net/keystoneauth/+bug/1910788/comments/218:13
openstackLaunchpad bug 1910788 in keystoneauth "Using request() methods on session objects with Token plugins break" [Undecided,New]18:13
dansmithlbragstad: but I need to know the auth url?18:14
lbragstadyeah - https://opendev.org/openstack/keystoneauth/src/branch/master/keystoneauth1/identity/v3/token.py#L53 =/18:14
lbragstadi guess if you don't have that then you can't use it18:15
*** ralonsoh has quit IRC18:17
lbragstadit looks like the _ContextAuthPlugin wrapper has a service catalog?18:27
lbragstadhttps://github.com/openstack/nova/blob/master/nova/context.py#L5918:27
lbragstaddansmith yeah - i don't think the AuthMethod implementation or it's subclasses are meant to work that way - the same thing is true for the PasswordMethod18:31
lbragstadhttp://paste.openstack.org/show/801520/18:31
lbragstadiiuc - the reason it works in nova is because _ContextAuthPlugin is subclassing BaseAuthPlugin - which implements get_headers()18:32
*** ccamposr has quit IRC18:32
*** ccamposr has joined #openstack-dev18:35
*** ccamposr has quit IRC18:39
lbragstaddoing a bit more digging and i think the service catalog provided to the constructor of _ContextAuthPlugin ultimately comes from the headers of the request, which are set by keystonemiddleware - so it should be the service catalog associated with the token used in the request18:40
*** dtantsur is now known as dtantsur|afk18:43
lbragstadyeah - nova is pulling it out manually https://github.com/openstack/nova/blob/master/nova/api/auth.py#L10018:45
*** gfidente is now known as gfidente|afk19:00
*** ccamposr has joined #openstack-dev19:01
*** zlr20830 has joined #openstack-dev19:02
*** maharg101 has quit IRC19:05
*** mcriswell has joined #openstack-dev19:15
*** zlr20830 has quit IRC19:17
*** nweinber has joined #openstack-dev19:19
*** jamesmcarthur has joined #openstack-dev19:23
dansmithlbragstad: ack, so.. should I be doing something different?20:01
dansmithlbragstad: this is what I have right now, btw: https://review.opendev.org/c/openstack/glance/+/769976/1/glance/context.py20:01
lbragstaddansmith looking20:08
dansmithI guess I'm not sure about that nova code which de-json's the service catalog from the request.. surely that'd be a huge hole20:09
*** jamesmcarthur has quit IRC20:11
dansmithconfig does have the auth_url and identity_uri,20:11
dansmithwhich look to match the workaround in your comment20:11
dansmithso if using that code and stuffing one of those in for the service catalog url, I can surely do that20:11
*** ccamposr__ has joined #openstack-dev20:14
*** ccamposr has quit IRC20:14
dansmithlbragstad: when I do that, I get 404 from the remote side, presumably because I'm not auth'd20:21
dansmithspecifically this: auth = identity.v3.Token(CONF.keystone_authtoken.identity_uri, context.auth_token)20:21
lbragstadyeah - that would work, too20:21
lbragstadthen you won't need to subclass the authplugin20:22
dansmithbut ^20:22
*** jamesmcarthur has joined #openstack-dev20:22
lbragstadotherwise - you can do something like: http://paste.openstack.org/show/801524/20:30
lbragstadthe identity_endpoint that's extracted from the service catalog in the header *should* be the identity endpoint/vip that was used to create context.auth_token20:32
dansmithlbragstad: I'm confused... is Token going to actually use the url we give it or are we just trying to give it something because it requires a param there? since I'm giving it the token, shouldn't it just be passing that straight on through like the from-nova hack does?20:33
lbragstadToken should use the url you pass it - the _ContextAuthPlugin in nova has it's own service catalog passed in20:34
lbragstadi think the reason why you need to give Token an auth_url is because it needs to know where to validate that token20:35
dansmithbut..20:37
dansmithlbragstad: it's already been validated, I just need to pass it along in the request to the other side20:37
dansmith*that* side should validate it, but I don't want to validate it again before I use it to make another request20:37
lbragstadyeah - that makes sense20:38
dansmithlbragstad: so does that mean maybe my hack is actually what I should keep to avoid a bunch of code and another token verify?20:39
lbragstadi'm double checking that now20:39
*** jamesmcarthur has quit IRC20:39
lbragstadi don't see anything in the AuthConstructor/BaseIdentityPlugin inheritance that performs a validation in the constructor - checking session side quick20:42
lbragstadok - yeah...20:50
dansmithhack is good? :)20:51
*** diablo_rojo__ has joined #openstack-dev20:59
*** maharg101 has joined #openstack-dev21:02
lbragstadok - wow21:02
lbragstadso - this is what you originally hit https://opendev.org/openstack/keystoneauth/src/branch/master/keystoneauth1/session.py#L78021:03
lbragstadwhich calls https://opendev.org/openstack/keystoneauth/src/branch/master/keystoneauth1/plugin.py#L10621:03
lbragstadbounces back to the session https://opendev.org/openstack/keystoneauth/src/branch/master/keystoneauth1/session.py#L121321:04
lbragstadand finally calls the auth plugin https://opendev.org/openstack/keystoneauth/src/branch/master/keystoneauth1/session.py#L119121:04
*** maharg101 has quit IRC21:06
lbragstadand ultimately makes it here https://opendev.org/openstack/keystoneauth/src/branch/master/keystoneauth1/identity/v3/base.py#L18621:07
dansmithcan I just take a moment to say that I think what i'm asking to do here is not super crazy, yet this whole foray has made me question *everything*? :P21:08
lbragstadso - if i'm not too confused... it appears that calling get_auth_headers() via session.request() does invoke an auth request...21:09
lbragstadno - the use case is really simple to understand21:09
lbragstadbut following the code to figure out if that's actually doing what we think is really opaque21:10
dansmithseems like it21:11
*** slaweq has quit IRC21:13
lbragstaddansmith actually - https://docs.openstack.org/keystoneauth/latest/authentication-plugins.html#simple-plugins21:21
lbragstad^ that might be what you want21:21
lbragstada = token_endpoint.Token('http://192.168.1.150/identity/', token)21:21
lbragstadthe get_token implementation is the same as the _ContextAuthPlugin21:23
lbragstadhttps://opendev.org/openstack/keystoneauth/src/branch/master/keystoneauth1/token_endpoint.py#L30-L3121:23
*** nweinber has quit IRC21:37
dansmithlbragstad: that's what I tried above and pasted the 40421:39
dansmith[12:21:07]  <dansmith> lbragstad: when I do that, I get 404 from the remote side, presumably because I'm not auth'd21:39
dansmith[12:21:38]  <dansmith> specifically this: auth = identity.v3.Token(CONF.keystone_authtoken.identity_uri, context.auth_token)21:39
dansmither, wait,21:40
dansmithmaybe that's not what I'm doing21:40
dansmithmine comes from identity21:40
dansmithhuh-friggin-zuh!21:42
lbragstadyeah..21:42
dansmithworks, thanks a bunch21:43
lbragstadi tripped over the overridden get_token() implementation and didn't know what it was21:43
lbragstadbecause it's an auth plugin, not grouped with the rest of the auth plugins...21:43
lbragstadso - that's fun... sorry for the wild goose chase21:43
dansmithno worries, I sent us on said chase21:44
*** jamesmcarthur has joined #openstack-dev22:14
*** jamesmcarthur has quit IRC22:17
*** rloo has quit IRC22:59
*** yumiriam has quit IRC23:15
« Thursday, 2021-01-07 Index Saturday, 2021-01-09 »

Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!