| openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Add redirect testing https://review.opendev.org/692929 | 00:01 |
|---|---|---|
| openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Deflate .htaccess https://review.opendev.org/692930 | 00:01 |
| openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: WIP: identity: autogenerate docs https://review.opendev.org/692931 | 00:01 |
| *** jawad_axd has joined #openstack-sdks | 00:04 | |
| *** Qiming has quit IRC | 00:05 | |
| *** Qiming has joined #openstack-sdks | 00:05 | |
| *** jawad_axd has quit IRC | 00:08 | |
| openstackgerrit | Merged openstack/python-openstackclient master: neutron: autogenerate docs https://review.opendev.org/691767 | 00:41 |
| *** jawad_axd has joined #openstack-sdks | 00:46 | |
| *** dave-mccowan has joined #openstack-sdks | 00:48 | |
| *** jawad_axd has quit IRC | 00:50 | |
| *** mriedem has joined #openstack-sdks | 00:51 | |
| *** jawad_axd has joined #openstack-sdks | 01:07 | |
| *** jawad_axd has quit IRC | 01:11 | |
| *** slaweq_ has joined #openstack-sdks | 01:35 | |
| *** slaweq__ has joined #openstack-sdks | 01:38 | |
| *** slaweq_ has quit IRC | 01:41 | |
| *** dave-mccowan has quit IRC | 01:43 | |
| *** jawad_axd has joined #openstack-sdks | 01:48 | |
| *** jawad_axd has quit IRC | 01:53 | |
| *** dave-mccowan has joined #openstack-sdks | 01:59 | |
| *** enriquetaso has joined #openstack-sdks | 02:05 | |
| *** dave-mccowan has quit IRC | 02:08 | |
| *** enriquetaso has quit IRC | 02:10 | |
| *** slaweq__ has quit IRC | 02:23 | |
| *** slaweq__ has joined #openstack-sdks | 02:42 | |
| *** slaweq has joined #openstack-sdks | 02:44 | |
| *** slaweq__ has quit IRC | 02:46 | |
| *** mriedem has quit IRC | 02:47 | |
| *** jawad_axd has joined #openstack-sdks | 02:50 | |
| *** ricolin has joined #openstack-sdks | 02:53 | |
| *** jawad_axd has quit IRC | 02:55 | |
| *** ricolin has quit IRC | 03:35 | |
| *** slaweq has quit IRC | 03:40 | |
| *** ricolin has joined #openstack-sdks | 03:41 | |
| *** ricolin has quit IRC | 03:57 | |
| *** ricolin has joined #openstack-sdks | 03:57 | |
| *** ricolin has quit IRC | 04:13 | |
| *** jdwidari has quit IRC | 05:10 | |
| *** ricolin has joined #openstack-sdks | 05:23 | |
| *** slaweq has joined #openstack-sdks | 05:24 | |
| *** slaweq_ has joined #openstack-sdks | 05:27 | |
| *** slaweq has quit IRC | 05:29 | |
| *** slaweq_ has quit IRC | 05:45 | |
| *** ricolin has quit IRC | 05:50 | |
| *** jawad_axd has joined #openstack-sdks | 07:15 | |
| *** slaweq_ has joined #openstack-sdks | 07:15 | |
| *** ricolin has joined #openstack-sdks | 07:17 | |
| *** slaweq__ has joined #openstack-sdks | 07:20 | |
| *** slaweq_ has quit IRC | 07:22 | |
| *** gtema has joined #openstack-sdks | 07:44 | |
| *** ricolin_ has joined #openstack-sdks | 07:45 | |
| *** ricolin has quit IRC | 07:47 | |
| openstackgerrit | Bence Romsics proposed openstack/openstacksdk master: Add router add/remove route operations https://review.opendev.org/674324 | 07:53 |
| openstackgerrit | Bence Romsics proposed openstack/openstacksdk master: Handle HTTP errors in add/remove router interface calls https://review.opendev.org/687304 | 07:53 |
| *** ricolin_ has quit IRC | 08:04 | |
| *** ricolin_ has joined #openstack-sdks | 08:04 | |
| *** slaweq has joined #openstack-sdks | 08:19 | |
| *** slaweq__ has quit IRC | 08:19 | |
| *** tosky has joined #openstack-sdks | 08:30 | |
| *** ricolin_ has quit IRC | 08:37 | |
| *** gtema has quit IRC | 08:40 | |
| *** gtema has joined #openstack-sdks | 08:40 | |
| *** jpena|off is now known as jpena | 08:42 | |
| *** gtema has quit IRC | 08:45 | |
| *** gtema has joined #openstack-sdks | 08:45 | |
| *** ralonsoh has joined #openstack-sdks | 08:52 | |
| openstackgerrit | Thomas Bechtold proposed openstack/openstacksdk master: update OVH vendor entry https://review.opendev.org/692961 | 08:53 |
| *** slaweq has quit IRC | 09:04 | |
| *** jpich has joined #openstack-sdks | 09:06 | |
| *** cdent has joined #openstack-sdks | 09:12 | |
| *** tosky has quit IRC | 09:13 | |
| *** cdent has quit IRC | 09:18 | |
| *** tosky has joined #openstack-sdks | 09:36 | |
| *** cdent has joined #openstack-sdks | 09:36 | |
| *** dtantsur|afk is now known as dtantsur | 10:26 | |
| *** cdent has quit IRC | 10:46 | |
| *** cdent has joined #openstack-sdks | 11:12 | |
| *** gtema has quit IRC | 11:49 | |
| *** gtema has joined #openstack-sdks | 11:51 | |
| *** jdwidari has joined #openstack-sdks | 12:09 | |
| *** jdwidari has quit IRC | 12:12 | |
| *** gtema has quit IRC | 12:26 | |
| *** gtema has joined #openstack-sdks | 12:28 | |
| *** mnasiadka has joined #openstack-sdks | 12:29 | |
| *** jpena is now known as jpena|lunch | 12:32 | |
| *** tosky_ has joined #openstack-sdks | 12:42 | |
| *** gtema has quit IRC | 12:44 | |
| *** tosky has quit IRC | 12:45 | |
| *** tosky_ is now known as tosky | 12:59 | |
| *** cdent has quit IRC | 13:07 | |
| openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Update a stale doc reference to use :neutron-doc: https://review.opendev.org/692605 | 13:09 |
| openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: common: autogenerate docs https://review.opendev.org/691989 | 13:09 |
| openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: openstack.cli: autogenerate docs https://review.opendev.org/692914 | 13:09 |
| openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: compute: autogenerate docs https://review.opendev.org/692916 | 13:09 |
| openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Add redirect testing https://review.opendev.org/692929 | 13:09 |
| openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Deflate .htaccess https://review.opendev.org/692930 | 13:09 |
| openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: WIP: identity: autogenerate docs https://review.opendev.org/692931 | 13:09 |
| efried | dtroyer: trivial rebase to resolve merge conflict ^ | 13:09 |
| efried | couple of those already had your +A | 13:09 |
| *** jangutter has joined #openstack-sdks | 13:10 | |
| *** gtema has joined #openstack-sdks | 13:10 | |
| *** jdwidari has joined #openstack-sdks | 13:17 | |
| *** gtema has quit IRC | 13:34 | |
| *** gtema has joined #openstack-sdks | 13:39 | |
| dtroyer | efried: thanks, will have a look after the next call (or during depending on how it goes :) | 13:48 |
| efried | no hurry | 13:49 |
| *** gtema has quit IRC | 13:53 | |
| *** mriedem has joined #openstack-sdks | 13:58 | |
| *** gtema has joined #openstack-sdks | 14:00 | |
| *** cdent has joined #openstack-sdks | 14:10 | |
| *** goldyfruit_ has joined #openstack-sdks | 14:19 | |
| mnasiadka | Hi there | 14:23 |
| mnasiadka | Any idea how to request a system scoped token in Ansible os_* modules that are using openstacksdk? | 14:24 |
| *** slaweq has joined #openstack-sdks | 14:26 | |
| efried | mnasiadka: There are many words in there that I don't know. The people most likely to be able to answer your question are probably all at the summit/PTG in Shanghai at the moment, so you may want to ask your question on the mailing list, or wait until next week. | 14:30 |
| openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: identity: autogenerate docs https://review.opendev.org/692931 | 14:31 |
| *** slaweq_ has joined #openstack-sdks | 14:31 | |
| *** slaweq has quit IRC | 14:32 | |
| mnasiadka | efried: It was my plan to wait until next week, but I decided it won't hurt to ask now, and in a week ;-) | 14:32 |
| efried | good plan :) | 14:32 |
| *** jangutter has quit IRC | 14:33 | |
| gtema | the only opportunity to influence the token scope is not to specify project_name, but both domain_name and user_domain_name | 14:33 |
| gtema | this will give you domain scoped token | 14:34 |
| *** goldyfruit___ has joined #openstack-sdks | 14:34 | |
| gtema | if you do not specify domain_name, but project_name - you get project scoped token | 14:34 |
| *** goldyfruit_ has quit IRC | 14:36 | |
| mnasiadka | gtema: we have a bug opened in Kolla (https://bugs.launchpad.net/kolla-ansible/+bug/1850656), we're trying to find the proper approach. | 14:37 |
| openstack | Launchpad bug 1850656 in kolla-ansible train "Deploy will fail if keystone.conf has '[oslo_policy]/enforce_scope=true'" [Medium,In progress] - Assigned to Radosław Piliszek (yoctozepto) | 14:37 |
| mnasiadka | gtema: seems for identity:create_endpoint we need system scoped token... | 14:38 |
| gtema | and this with Ansible (facepalm). efried, do you know how to get system scoped token from Keystone? | 14:39 |
| gtema | I was previously always referring to https://docs.openstack.org/keystone/pike/api_curl_examples.html for samples | 14:39 |
| efried | gtema: I don't even know what a system scoped token is. | 14:39 |
| gtema | it's kinda neither of both, but is even more powerful | 14:40 |
| gtema | https://docs.openstack.org/keystone/stein/admin/tokens-overview.html#system-scoped-tokens | 14:40 |
| gtema | I hoped you know a bit more than I about Keystone ;-) | 14:41 |
| efried | https://docs.openstack.org/keystone/stein/admin/tokens-overview.html#operation_create_system_token ? | 14:41 |
| efried | gtema: I know things about ksa, but very little about keystone itself :( | 14:41 |
| gtema | ok, with this link it might be possible to trace down which request is being sent | 14:42 |
| efried | It looks like ``--os-system-scope all`` might be the secret sauce you're looking for? | 14:42 |
| gtema | yeah | 14:42 |
| mnasiadka | tried using system-scope: all in the auth dict that os_* Ansible modules consume, but didn't really help :) | 14:43 |
| gtema | mnasiadka, no, forget it. For the moment I doubt it will work | 14:44 |
| mnasiadka | Well, I found that bit in the python-openstackclient, but not really in openstacksdk - so I thought it will not work :) | 14:44 |
| gtema | oh, can you try following: in your clouds.yaml or kind of do not specify project_name, domain_name, but 'system: all' | 14:45 |
| efried | according to a release note... | 14:45 |
| gtema | not system-scope, but really system: all | 14:45 |
| efried | efried@efried-ThinkPad-W520:~/openstack/python-openstackclient$ cat releasenotes/notes/implement-system-scope-4c3c47996f98deac.yaml | 14:45 |
| efried | --- | 14:45 |
| efried | features: | 14:45 |
| efried | - | | 14:45 |
| efried | Add support for system-scope to ``role`` commands. This includes the ability to | 14:45 |
| efried | generate system-scoped tokens using ``system_scope: all`` in ``cloud.yaml`` | 14:45 |
| efried | or ``OS_SYSTEM_SCOPE=all`` in an environment variable. Support is also | 14:45 |
| efried | included for managing role assignments on the system using ``--system`` | 14:45 |
| efried | when adding and removing roles. | 14:45 |
| efried | [`bp system-scope <https://blueprints.launchpad.net/keystone/+spec/system-scope>`_] | 14:45 |
| efried | so, try that clouds.yaml or env var thing? | 14:46 |
| mnasiadka | ok, so system: all - let's try :) | 14:46 |
| efried | the env var ought to map to that --os-system-scope CLI opt as well. | 14:46 |
| efried | looks like ``system_scope: all`` | 14:46 |
| gtema | https://github.com/openstack/python-openstackclient/blob/master/openstackclient/identity/v3/token.py#L200 | 14:47 |
| gtema | according to that it is system: all | 14:47 |
| gtema | but a nice hint - might be changed in future | 14:47 |
| mnasiadka | without deprecation? :) | 14:48 |
| gtema | This could change in the future when, or if, | 14:49 |
| gtema | # keystone supports the ability to scope to a subset of the entire | 14:49 |
| gtema | # deployment system. | 14:49 |
| mnasiadka | ok, makes sense | 14:49 |
| efried | gtema: it looks like the `system` key is for the API, not the CLI. | 14:50 |
| gtema | yeah, I was searching what KSA will look for | 14:51 |
| gtema | https://review.opendev.org/#/c/525687/21/keystone/tests/common/auth.py | 14:52 |
| gtema | might be still API | 14:52 |
| efried | https://docs.openstack.org/api-ref/identity/v3/index.html?expanded=token-authentication-with-scoped-authorization-detail#authentication-and-token-management | 14:52 |
| gtema | also looking to same place - and yes: system is a key for API | 14:53 |
| efried | mnasiadka: you said SDK, are you trying to write the SDK side of this, or are you working with a CLI? | 14:53 |
| gtema | now need to reverse it to what should be in clouds.yaml | 14:53 |
| gtema | sdk is used by ansible modules | 14:53 |
| mnasiadka | efried: I'm just using ansible in Kolla-Ansible (OpenStack deployer), and ansible is using openstacksdk for all openstack modules | 14:54 |
| gtema | so whatever ansible does go to SDK and it uses KSA | 14:54 |
| efried | I'm having trouble finding where sdk supports /tokens APIs at all... | 14:56 |
| gtema | it is done by KSA | 14:57 |
| efried | I suppose you could always just grab a raw identity proxy and POST /tokens manually. | 14:57 |
| *** slaweq_ is now known as slaweq | 14:59 | |
| *** jawad_axd has quit IRC | 15:00 | |
| openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: identity: autogenerate docs https://review.opendev.org/692931 | 15:01 |
| openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: image: autogenerate docs https://review.opendev.org/693025 | 15:01 |
| mnasiadka | efried: that's the last option on the table | 15:03 |
| *** jawad_axd has joined #openstack-sdks | 15:04 | |
| *** slaweq_ has joined #openstack-sdks | 15:07 | |
| *** slaweq has quit IRC | 15:08 | |
| *** jawad_axd has quit IRC | 15:09 | |
| *** slaweq__ has joined #openstack-sdks | 15:11 | |
| *** slaweq_ has quit IRC | 15:12 | |
| gtema | so, it seems to me now, that in clouds.yaml it should really be system_scope under auth section | 15:15 |
| gtema | can be even a boolean, important that neither of project_xxx nor domain_xxx are present | 15:16 |
| *** jawad_axd has joined #openstack-sdks | 15:18 | |
| gtema | so when I have 'system_scope: true' in my clouds.yaml the KSA get's really system_scope. | 15:18 |
| gtema | Problem is that in my case I get empty catalog from keystone back and KSA/SDK doesn't know what to do with it | 15:19 |
| *** slaweq__ has quit IRC | 15:19 | |
| gtema | mnasiadka: you should try it first without ansible at all, whether you can really login with system scope. This requires also a heavy admin user privileges, from what I understand | 15:24 |
| *** slaweq__ has joined #openstack-sdks | 15:47 | |
| *** slaweq__ has quit IRC | 15:52 | |
| *** jawad_axd has quit IRC | 16:02 | |
| yoctozepto | gtema: this is admin user, with role admin on system all | 16:04 |
| openstackgerrit | Artem Goncharov proposed openstack/python-openstackclient master: Switch image to use SDK https://review.opendev.org/650374 | 16:04 |
| yoctozepto | we just could not get the ansible module to work in the new environ | 16:05 |
| gtema | I know, I mean I can't verify whether this works at all, since I do not have access currently to admin user | 16:05 |
| gtema | if you could prepare clouds.yaml config with your admin user and system_scope: true, and then try execute http://paste.openstack.org/show/785811/ | 16:07 |
| *** jpena|lunch is now known as jpena | 16:11 | |
| *** jawad_axd has joined #openstack-sdks | 16:14 | |
| *** jawad_axd has quit IRC | 16:19 | |
| yoctozepto | gtema: I see, I'll try to set it up later, thanks | 16:23 |
| *** gtema has quit IRC | 16:35 | |
| *** jawad_axd has joined #openstack-sdks | 16:35 | |
| *** jawad_axd has quit IRC | 16:39 | |
| *** jpena is now known as jpena|brb | 16:45 | |
| *** jpena|brb is now known as jpena | 17:27 | |
| *** jpich has quit IRC | 17:49 | |
| *** also_stingrayza has joined #openstack-sdks | 17:52 | |
| *** stingrayza has quit IRC | 17:53 | |
| *** goldyfruit___ has quit IRC | 17:53 | |
| *** cdent has quit IRC | 17:57 | |
| *** goldyfruit___ has joined #openstack-sdks | 17:58 | |
| *** also_stingrayza has quit IRC | 18:35 | |
| *** stingrayza has joined #openstack-sdks | 18:36 | |
| *** jpena is now known as jpena|off | 18:45 | |
| *** goldyfruit_ has joined #openstack-sdks | 18:46 | |
| *** goldyfruit___ has quit IRC | 18:49 | |
| *** ralonsoh has quit IRC | 18:54 | |
| *** goldyfruit_ has quit IRC | 19:14 | |
| openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Refactor AggregateTests https://review.opendev.org/693073 | 19:37 |
| *** mriedem is now known as mriedem_afk | 19:38 | |
| *** jawad_axd has joined #openstack-sdks | 20:13 | |
| *** tosky has quit IRC | 20:16 | |
| *** mriedem_afk is now known as mriedem | 20:18 | |
| *** goldyfruit_ has joined #openstack-sdks | 20:33 | |
| openstackgerrit | Eric Fried proposed openstack/python-openstackclient master: Refactor AggregateTests https://review.opendev.org/693073 | 21:32 |
| *** jawad_axd has quit IRC | 22:12 | |
| *** mriedem has quit IRC | 22:58 | |
| *** yoctozepto has quit IRC | 23:04 | |
| *** yoctozepto has joined #openstack-sdks | 23:04 | |
| openstackgerrit | Merged openstack/python-openstackclient master: Update a stale doc reference to use :neutron-doc: https://review.opendev.org/692605 | 23:07 |
| *** tobiash has quit IRC | 23:11 | |
| *** tobiash has joined #openstack-sdks | 23:12 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!