| *** udesale has joined #storyboard | 04:56 | |
| *** tosky has joined #storyboard | 08:02 | |
| *** udesale_ has joined #storyboard | 11:40 | |
| *** udesale has quit IRC | 11:43 | |
| *** ianychoi_ has joined #storyboard | 13:17 | |
| *** ianychoi has quit IRC | 13:20 | |
| *** ianychoi_ is now known as ianychoi | 13:23 | |
| *** jamesmcarthur has joined #storyboard | 15:55 | |
| *** jamesmcarthur has quit IRC | 16:11 | |
| *** jamesmcarthur has joined #storyboard | 16:12 | |
| *** jamesmcarthur has quit IRC | 16:16 | |
| *** jamesmcarthur has joined #storyboard | 16:18 | |
| *** jamesmcarthur has quit IRC | 16:21 | |
| *** udesale_ has quit IRC | 16:26 | |
| *** jamesmcarthur has joined #storyboard | 16:34 | |
| diablo_rojo_phon | SotK: reminder we meet in about an hour ;) | 16:51 |
|---|---|---|
| SotK | diablo_rojo_phon: thank you for the reminder :) | 17:21 |
| *** jamesmcarthur has quit IRC | 17:28 | |
| *** jamesmcarthur has joined #storyboard | 17:29 | |
| *** ironfoot has quit IRC | 17:43 | |
| *** ironfoot has joined #storyboard | 17:43 | |
| *** jamesmcarthur has quit IRC | 17:54 | |
| *** jamesmcarthur has joined #storyboard | 17:55 | |
| diablo_rojo_phon | SotK: fungi so are we meeting today? | 17:57 |
| fungi | we can | 17:58 |
| fungi | believe it or not i'm in the middle of trying to set swift write acls for our storyboard-dev attachments | 17:58 |
| SotK | ooh nice | 17:59 |
| diablo_rojo_phon | Woohoo! | 17:59 |
| fungi | i think i've just set the storyboard-dev-attachments container writeable by the openstackstoriesdev user | 18:01 |
| *** jamesmcarthur has quit IRC | 18:24 | |
| *** jamesmcarthur has joined #storyboard | 18:25 | |
| *** jamesmcarthur has quit IRC | 18:26 | |
| *** jamesmcarthur has joined #storyboard | 18:26 | |
| *** diablo_rojo has quit IRC | 18:26 | |
| fungi | okay, so it looks like the real attachments configuration documenting happens in the sample config, fair enough | 18:26 |
| fungi | https://opendev.org/opendev/storyboard/src/branch/master/etc/storyboard.conf.sample#L201-L248 | 18:26 |
| *** diablo_rojo has joined #storyboard | 18:29 | |
| fungi | seems i also need to set the X-Container-Meta-Temp-URL-Key to something | 18:32 |
| SotK | yeah we really are lacking some more detailed documentation for actually configuring StoryBoard | 18:35 |
| fungi | i've been doing the acls and now the tempurl key metadata using swiftclient | 18:36 |
| fungi | seems to have gone smoothly so far | 18:36 |
| fungi | i think it's all set now, i guess i need to restart the api server | 18:36 |
| fungi | er, i suppose that's restarting apache since it's run from uwsgi? | 18:38 |
| fungi | anyway, i've restarted apache now as well | 18:39 |
| fungi | oh! | 18:39 |
| fungi | i still need to add a clouds.yaml file | 18:39 |
| fungi | oh, wait, i just need to comment out the cloud option instead | 18:41 |
| fungi | since i set all the other ones | 18:41 |
| fungi | so this is all set up with v1 legacy auth to start | 18:42 |
| fungi | i'm more comfortable those are correct for the moment, since it's what i used with the instructions at https://support.rackspace.com/how-to/set-up-cloud-files-and-acls/ | 18:43 |
| fungi | once that's working we can try switching to keystone auth and clouds.yaml | 18:44 |
| mordred | openstacsksdk supports non-standard rackspace auth/ | 18:44 |
| mordred | ? | 18:44 |
| mordred | oh - ew - switftclient | 18:45 |
| fungi | yeah, i needed to either use swiftclient or direct curl to the api to set custom r/w acls for otherwise unprivileged accounts | 18:46 |
| mordred | https://opendev.org/openstack/openstacksdk/src/branch/master/openstack/object_store/v1/_proxy.py#L687-L710 | 18:46 |
| mordred | there's the code for setting temp url keys | 18:47 |
| fungi | i did it via `swift -m ...` | 18:47 |
| fungi | seemed to work fine (also swiftclient docs have an explicit example of doing it there) | 18:47 |
| fungi | i guess sdk can do swift acls as well? probably not plumbed through osc though? | 18:48 |
| mordred | yeah. just saying - if you can't do something with sdk - let me know. swiftclient and friends don't work with clouds.yaml so the mixed experience is pretty yuck | 18:48 |
| mordred | ah - this is just for CLI? | 18:48 |
| mordred | ok. I mean - plumbing that through would likely be more work :) | 18:49 |
| fungi | it was the manual steps of authorizing the custom user for read/write access | 18:49 |
| mordred | nod. I thought this was code running inside of storyboard and I was sad | 18:49 |
| fungi | i think corvus said he did something similar to set things up for us to store job logs in rackspace's swift | 18:49 |
| SotK | nah we use sdk in storyboard itself | 18:49 |
| mordred | \o/ | 18:50 |
| fungi | but yeah, as far as configuring sb itself i put the v1 auth parameters in the config for now but we can switch it to clouds.yaml | 18:50 |
| fungi | the documentation we have at the moment doesn't quite say what needs to be in clouds.yaml to support this, nor where the clouds.yaml file should be so that sb will find it | 18:51 |
| mordred | clouds.yaml should be in /etc/openstack/clouds.yaml or ~/.config/openstack/clouds.yaml | 18:52 |
| mordred | and the normal stuff we put in for other clouds.yaml should be fine - no need to use old v1 auth | 18:52 |
| fungi | for v1 auth, it seems to use the username and the api key, does using an api key work in clouds.yaml or does it need to be the login password? | 18:52 |
| mordred | api key works if you install the rackspace plugin - but there's no need - I'd just use the login password | 18:53 |
| SotK | heh oops, an example clouds.yaml would've been a nice thing to include | 18:53 |
| fungi | ahh, okay | 18:53 |
| mordred | the rackspace api key thing is theatre - what they _want_ it to be is what application credentials now are - but they gave up many years ago and just stayed with theatre | 18:54 |
| fungi | yeah, i was mostly trying to make sure these credentials didn't have access to anything besides the one swift container we're using | 18:54 |
| fungi | but i think their account management for it is set up appropriately for that anyway | 18:54 |
| * fungi double-checks | 18:55 | |
| mordred | yeah. that's the thing - api-keys in rackspace aren't scoped to anything - and you can only have one per account | 18:55 |
| mordred | so they are effectively just "alternate password that you can't use to log in to the web dashboard" | 18:55 |
| fungi | right, and i have this account set for no access to manage users, billing and payments, ticket access, product access | 18:56 |
| SotK | the support for legacy auth is mostly to work around trouble with getting SAIO to play nice with openstacksdk without just disabling its auth (passing the credentials to openstack.connect works, but I failed to craft a clouds.yaml that could successfully do the same) | 18:56 |
| mordred | SotK: that's weird :) | 18:57 |
| fungi | so the account is set with no permissions for anything in the dashboard, and then i used swiftclient to set specific r/w acls for it to just the one container we're using it with | 18:57 |
| mordred | \o/ | 18:58 |
| fungi | i guess i can copy the clouds.yaml we put on our zuul executors bit just change the credentials | 18:58 |
| fungi | since in theory they have the right parameters for talking to rackspace in a similar way | 18:59 |
| SotK | mordred: I agree, its possible I just failed to find the right magic | 18:59 |
| mordred | fungi: yah | 19:01 |
| *** jamesmcarthur has quit IRC | 19:15 | |
| *** jamesmcarthur has joined #storyboard | 19:16 | |
| *** jamesmcarthur has quit IRC | 19:16 | |
| *** jamesmcarthur has joined #storyboard | 19:16 | |
| fungi | mordred: interestingly, there's no /etc/openstack/clouds.yaml or ~zuul/.config/openstack/clouds.yaml on our zuul executors | 19:23 |
| fungi | oh! | 19:24 |
| fungi | we encode it in job configuration for the swift uploads | 19:24 |
| fungi | don't mind me | 19:24 |
| mordred | :) | 19:28 |
| fungi | and i guess it doesn't actually splat out a clouds.yaml anywhere, seems to plumb values straight into the sdk | 19:37 |
| *** jamesmcarthur has quit IRC | 20:02 | |
| *** jamesmcarthur has joined #storyboard | 20:02 | |
| *** jamesmcarthur has quit IRC | 20:19 | |
| fungi | mordred: if you get time, can you see whether the /etc/openstack/clouds.yaml on storyboard-dev looks like it has sufficient data for interacting with rackspace swift? | 20:21 |
| fungi | i'm curious how storyboard works out which region to use | 20:21 |
| fungi | since it just asks for a cloud name but no region | 20:21 |
| fungi | does openstacksdk default to the first region in the clouds.yaml if none are specified for a call? | 20:22 |
| fungi | or is swift effectively regionless? | 20:22 |
| *** jamesmcarthur has joined #storyboard | 20:26 | |
| mordred | fungi on it | 20:26 |
| mordred | fungi: python -c 'import openstack ; c = openstack.connect(cloud="openstackci-rax") ; print(c.service_catalog)' | 20:28 |
| mordred | fungi: as root verifies that it can log in and get a catalog | 20:28 |
| mordred | fungi: root@storyboard-dev01:~# python -c 'import openstack ; c = openstack.connect(cloud="openstackci-rax") ; print(c.list_containers())' | 20:29 |
| mordred | fungi: fails - but I think it is correct to fail? | 20:29 |
| mordred | fungi: openstacksdk defaults to the first region if there is only one region | 20:29 |
| mordred | fungi: openstacksdk defaults to the first region - or alternately you can just say "region_name" instead of giving a list of regions | 20:30 |
| fungi | yeah, it should be able to stat the storyboard-dev-attachments container with that account though | 20:32 |
| fungi | at least i was able to stat it with that account using swift v1 auth and the api key for that account | 20:33 |
| mordred | cool. let me try | 20:33 |
| mordred | fungi: no - it does not like that | 20:34 |
| mordred | are we sure it's the right project-id? | 20:34 |
| mordred | fungi: python -c 'import openstack ; openstack.enable_logging(http_debug=True) ; c = openstack.connect(cloud="openstackci-rax") ; print(c.get_container("storyboard-dev-attachments"))' | 20:35 |
| mordred | in case you want to try it yourself and see the http trace | 20:35 |
| mordred | yes - that's the right project id | 20:36 |
| fungi | same project id as we use elsewhere for openstackci-rax yeah | 20:36 |
| mordred | fungi: this is the same project as our other accounts witha second user? | 20:37 |
| fungi | yep | 20:37 |
| mordred | nod. then yeah | 20:38 |
| mordred | so - in general, it doesn't seem happy doing a head of that container | 20:38 |
| mordred | for me | 20:38 |
| fungi | i was able to `swift -A https://auth.api.rackspacecloud.com/v1.0 -U openstackstoriesdev -K REDACTED stat storyboard-dev-attachments` using the api key for it | 20:38 |
| *** iurygregory has quit IRC | 20:38 | |
| *** iurygregory has joined #storyboard | 20:39 | |
| mordred | does that command have the ability to do an http trace? | 20:39 |
| fungi | maybe, checking | 20:39 |
| mordred | fungi: and can you put the api key somewhere I could get at it? | 20:39 |
| fungi | yeah, --debug should do it | 20:40 |
| fungi | there's a working swiftclient install on bridge.o.o at ~fungi/swiftclient/bin/swift if you want to see it for yourself | 20:41 |
| fungi | adding --debug to the command above shows the full requests and responses | 20:42 |
| mordred | fungi: ORD not DFW | 20:43 |
| mordred | changing the region in clouds.yaml fixes it | 20:44 |
| mordred | (and it's ORD that the api-key version is going to | 20:44 |
| fungi | oh | 20:44 |
| fungi | huh | 20:44 |
| fungi | strangely there's now one in both dfw and ord | 20:46 |
| mordred | fungi: python -c 'import openstack ; c = openstack.connect(cloud="openstackci-rax") ; print(c.get_container("storyboard-dev-attachments"))' now works in case you want to verify | 20:47 |
| fungi | the one in dfw is the public one i created a while back, i wonder how the private ord one came about | 20:47 |
| fungi | maybe the commands i ran to set acls also created a container, and defaulted to ord somehow? | 20:48 |
| fungi | anyway thanks! i have enough to experiment with now | 20:49 |
| *** jamesmcarthur has quit IRC | 21:03 | |
| *** jamesmcarthur has joined #storyboard | 21:03 | |
| *** jamesmcarthur has quit IRC | 21:08 | |
| *** iurygregory has quit IRC | 21:12 | |
| *** jamesmcarthur has joined #storyboard | 21:26 | |
| *** jamesmcarthur has quit IRC | 21:26 | |
| *** jamesmcarthur has joined #storyboard | 21:26 | |
| fungi | well, anyway, i think it should be working at this point, i'll recheck the webclient series to get some fresh previews | 22:04 |
| *** openstackstatus has quit IRC | 22:56 | |
| *** openstack has joined #storyboard | 22:58 | |
| *** ChanServ sets mode: +o openstack | 22:58 | |
| *** tosky has quit IRC | 23:00 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!