[openstack-dev] [Heat] [Keystone] [TripleO] Making use of domains by name - policy and API issues?

Dolph Mathews dolph.mathews at gmail.com
Wed May 7 18:45:23 UTC 2014


On Tue, Apr 29, 2014 at 1:25 AM, Robert Collins
<robertc at robertcollins.net>wrote:

> On 29 April 2014 12:27, Dolph Mathews <dolph.mathews at gmail.com> wrote:
> >
>
>
> > Sure: domain names are unambiguous but user mutable, whereas Heat's
> approach
> > to using admin tenant "name" is at risk to both mutability and ambiguity
> (in
> > a multi-domain deployment).
>
> Isn't domainname/user unambiguous and unique?


Yes


> mutability is really not
> keystones choice.
>
> If keystone won't accept domainname/user then that will force us to
> either do two stack-updates for a single deploy (ugly) or write
> patches to heat (and neutron where the callback-to-nova support has
> the same issue) to manually try a lookup and work around this.
>
> Since its trivial to write such a thunk, what benefit is there to your
> users - e.g. TripleO/heat/nova not have it in keystone itself?
>
> -Rob
>
> --
> Robert Collins <rbtcollins at hp.com>
> Distinguished Technologist
> HP Converged Cloud
>
> _______________________________________________
> OpenStack-dev mailing list
> OpenStack-dev at lists.openstack.org
> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20140507/ed9926c1/attachment.html>


More information about the OpenStack-dev mailing list