<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Jul 15, 2014 at 7:20 AM, Morgan Fainberg <span dir="ltr"><<a href="mailto:morgan.fainberg@gmail.com" target="_blank">morgan.fainberg@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class=""><div class="h5"><br><br>On Tuesday, July 15, 2014, Steven Hardy <<a href="mailto:shardy@redhat.com" target="_blank">shardy@redhat.com</a>> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
On Mon, Jul 14, 2014 at 02:43:19PM -0400, Adam Young wrote:<br>
> On 07/14/2014 11:47 AM, Steven Hardy wrote:<br>
> >Hi all,<br>
> ><br>
> >I'm probably missing something, but can anyone please tell me when devstack<br>
> >will be moving to keystone v3, and in particular when API auth_token will<br>
> >be configured such that auth_version is v3.0 by default?<br>
> ><br>
> >Some months ago, I posted this patch, which switched auth_version to v3.0<br>
> >for Heat:<br>
> ><br>
> ><a href="https://review.openstack.org/#/c/80341/" target="_blank">https://review.openstack.org/#/c/80341/</a><br>
> ><br>
> >That patch was nack'd because there was apparently some version discovery<br>
> >code coming which would handle it, but AFAICS I still have to manually<br>
> >configure auth_version to v3.0 in the heat.conf for our API to work<br>
> >properly with requests from domains other than the default.<br>
> ><br>
> >The same issue is observed if you try to use non-default-domains via<br>
> >python-heatclient using this soon-to-be-merged patch:<br>
> ><br>
> ><a href="https://review.openstack.org/#/c/92728/" target="_blank">https://review.openstack.org/#/c/92728/</a><br>
> ><br>
> >Can anyone enlighten me here, are we making a global devstack move to the<br>
> >non-deprecated v3 keystone API, or do I need to revive this devstack patch?<br>
> ><br>
> >The issue for Heat is we support notifications from "stack domain users",<br>
> >who are created in a heat-specific domain, thus won't work if the<br>
> >auth_token middleware is configured to use the v2 keystone API.<br>
> ><br>
> >Thanks for any information :)<br>
> ><br>
> >Steve<br>
> There are reviews out there in client land now that should work. I was<br>
> testing discover just now and it seems to be doing the right thing. If the<br>
> AUTH_URL is chopped of the V2.0 or V3 the client should be able to handle<br>
> everything from there on forward.<br>
<br>
Perhaps I should restate my problem, as I think perhaps we still have<br>
crossed wires:<br>
<br>
- Certain configurations of Heat *only* work with v3 tokens, because we<br>
create users in a non-default domain<br>
- Current devstack still configures versioned endpoints, with v2.0 keystone<br>
- Heat breaks in some circumstances on current devstack because of this.<br>
- Adding auth_version='v3.0' to the auth_token section of heat.conf fixes<br>
the problem.<br>
<br>
So, back in March, client changes were promised to fix this problem, and<br>
now, in July, they still have not - do I revive my patch, or are fixes for<br>
this really imminent this time?<br>
<br>
Basically I need the auth_token middleware to accept a v3 token for a user<br>
in a non-default domain, e.g validate it *always* with the v3 API not v2.0,<br>
even if the endpoint is still configured versioned to v2.0.<br>
<br>
Sorry to labour the point, but it's frustrating to see this still broken<br>
so long after I proposed a fix and it was rejected.<br>
<br></blockquote><div><br></div></div></div><div>We just did a test converting over the default to v3 (and falling back to v2 as needed, yes fallback will still be needed) yesterday (Dolph posted a couple of test patches and they seemed to succeed - yay!!) It looks like it will just work. Now there is a big caveate, this default will only change in the keystone middleware project, and it needs to have a patch or three get through gate converting projects over to use it before we accept the code.</div>
<div><br></div><div>Nova has approved the patch to switch over, it is just fighting with Gate. Other patches are proposed for other projects and are in various states of approval.</div></blockquote><div><br></div><div>I assume you mean switch over to keystone middleware project [0], not switch over to keystone v3. Based on [1] my understanding is no changes to nova are needed to use the v2 compatible parts of the v3 API, But are changes needed to support domains or is this not a problem because the auth middleware uses uuids for user_id and project_id, so nova doesn't need to have any concept of domains? Are any nova changes needed to support the v3 API?</div>
<div><br></div><div><br></div><div>Switching over the default to v3 in the middleware doesn't test nova + v3 user tokens, tempest nova tests don't generate v3 user tokens (although I hear there is an experimental job to do this). So you are testing that moving the middleware to v3 but accepting v2 API user tokens works. But what happens if someone tries to use a the non-default domain? Or using other v3 only features? Switching over to v3 for the middleware without actually testing any v3 user facing features sounds like a big testing gap.</div>
<div><br></div><div>I see the keystone middleware patch has landed [3]</div><div><br></div><div><br></div><div><br></div><div>[0] <a href="https://review.openstack.org/#/c/102342/">https://review.openstack.org/#/c/102342/</a></div>
<div>[1] <a href="http://docs.openstack.org/developer/keystone/http-api.htm">http://docs.openstack.org/developer/keystone/http-api.htm</a></div><div>[2] <a href="http://git.openstack.org/cgit/openstack/nova/tree/nova/db/sqlalchemy/models.py#n200">http://git.openstack.org/cgit/openstack/nova/tree/nova/db/sqlalchemy/models.py#n200</a></div>
<div>[3] <a href="https://review.openstack.org/#/c/106819">https://review.openstack.org/#/c/106819</a></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div><br></div><div>So, in short. This is happening and soon. There are some things that need to get through gate and then we will do the release of keystonemiddleware that should address your problem here. At least my reading of the issue and the fixes that are pending indicates as much. (Please let me know if I am misreading anything here).</div>
<div><br></div><div>Cheers,</div><div>Morgan</div>
<br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div></div>