<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">On May 7, 2015 at 11:21:00 AM, Chris St. Pierre (<a href="mailto:chris.a.st.pierre@gmail.com">chris.a.st.pierre@gmail.com</a>) wrote:</div> <blockquote type="cite" class="clean_bq"><span><div><div></div><div>
<title></title>
<div dir="ltr">Jinkies, that sounds like *work*. Got any links to
docs I can start diving into? In particular, keystone audit events
and anything that might be handy about the solution proposal you
mention. Keystone is mostly foreign territory to me so some
learning will be in order.
<div><br></div></div></div></div></span></blockquote><div><br></div><div>The event notifications are documented here: <a href="http://docs.openstack.org/developer/keystone/event_notifications.html">http://docs.openstack.org/developer/keystone/event_notifications.html</a></div><div>As to the rest of the topic, there are a few threads in the past on the ML such as <a href="http://lists.openstack.org/pipermail/openstack-dev/2015-February/055801.html">http://lists.openstack.org/pipermail/openstack-dev/2015-February/055801.html</a></div><div><br></div><div>I don’t think we’ve really gotten much further at this point than that.</div><br><blockquote type="cite" class="clean_bq"><span><div><div><div dir="ltr">
<div>Thanks!</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Thu, May 7, 2015 at 12:49 PM, Morgan
Fainberg <span dir="ltr"><<a href="mailto:morgan.fainberg@gmail.com" target="_blank">morgan.fainberg@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="auto">
<div>Hi Chris,</div>
<div><br></div>
<div>So there is no rule saying you can't ask keystone. However, we
do emit events (audit, needs to be configured) to the message bus
when tenants (or in v3 parlance, projects) are deleted. This allows
nova to mark things in a way to cleanup / do direct
cleanup. </div>
<div><br></div>
<div>There have been a few conversations about this, but we haven't
made significant progress (as far as I know) on this
topic. </div>
<div><br></div>
<div>The best solution proposal (iirc) was that we need to creat a
listener or similar that the other services could hook a callback
to that will do the cleanup directly rather than require blocking
the main API for the cleanup. </div>
<div><br></div>
<div>Keystone is open to these improvements and ideas. It just
doesn't scale of every action from every service has to ask
keystone if <thing> still exists. Let's make sure we don't
start using a pattern that will cause significant issues down the
road. </div>
<div><br></div>
<div>--Morgan</div>
<div><br>
Sent via mobile</div>
<div>
<div class="h5">
<div><br>
On May 7, 2015, at 09:37, Chris St. Pierre <<a href="mailto:chris.a.st.pierre@gmail.com" target="_blank">chris.a.st.pierre@gmail.com</a>> wrote:<br>
<br></div>
<blockquote type="cite">
<div>
<div dir="ltr">This bug recently came to my
attention: <a href="https://bugs.launchpad.net/nova/+bug/1241587" target="_blank">https://bugs.launchpad.net/nova/+bug/1241587</a>
<div><br></div>
<div>I've reopened it, because it is an actual problem, especially
for people using nova-network and Rally, which creates and deletes
tons of tenants.</div>
<div><br></div>
<div>The obvious simple solution is to allow deletion of the
'default' security group if it is assigned to a tenant that doesn't
exist, but I wasn't sure what the most acceptable way to do that
within Nova would be. Is it acceptable to perform a call to the
Keystone API to check for the tenant? Or is there another, better
way?</div>
<div><br></div>
<div>Alternatively, is there a better way to tackle the problem
altogether?</div>
<div><br></div>
<div>Thanks!<br clear="all">
<div><br></div></div></div></div></blockquote></div></div></div></blockquote></div></div></div></div></span></blockquote></body></html>