<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Dec 1, 2016 at 7:39 PM, Morgan Fainberg <span dir="ltr"><<a href="mailto:morgan.fainberg@gmail.com" target="_blank">morgan.fainberg@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="gmail-HOEnZb"><div class="gmail-h5"><p dir="ltr"></p>
<p dir="ltr">On Dec 1, 2016 8:25 AM, "Andrey Kurilin" <<a href="mailto:akurilin@mirantis.com" target="_blank">akurilin@mirantis.com</a>> wrote:<br>
><br>
> As I replied at IRC, please do not mix two separate issues! <br>
> Yes, we have several scenarios which are not support keystone v3 yet. It is an issue, but it is unrelated issue to described in the first mail. <br>
> We have a job which is configured with proper IDENTITY_API_VERSION flag and should be launched against Keystone v2, but there is only keystone v3 and it is a real issue.<br>
><br>
> On Thu, 1 Dec 2016 at 17:48, Lance Bragstad <<a href="mailto:lbragstad@gmail.com" target="_blank">lbragstad@gmail.com</a>> wrote:<br>
>><br>
>> FWIW - i'm seeing a common error in several of the rally failures [0] [1] [2] [3]. Dims also pointed out a few bugs in rally for keystone v3 support [4].<br>
>><br>
>> I checked with the folks in #openstack-containers to see if they were experiencing anymore fallout, but it looks like the magnum gate is under control [5]. We're currently in #openstack-keystone talking through options for the rally situation in case anyone feels like joining.<br>
>><br>
>><br>
>> [0] <a href="http://logs.openstack.org/87/404887/4/check/gate-rally-dsvm-neutron-existing-users-rally/ff60a83/console.html#_2016-12-01_08_05_55_268772" target="_blank">http://logs.openstack.org/<wbr>87/404887/4/check/gate-rally-<wbr>dsvm-neutron-existing-users-<wbr>rally/ff60a83/console.html#_<wbr>2016-12-01_08_05_55_268772</a><br>
>> [1] <a href="http://logs.openstack.org/43/405143/3/check/gate-rally-dsvm-neutron-existing-users-rally/3ee975b/console.html#_2016-12-01_08_39_02_618302" target="_blank">http://logs.openstack.org/<wbr>43/405143/3/check/gate-rally-<wbr>dsvm-neutron-existing-users-<wbr>rally/3ee975b/console.html#_<wbr>2016-12-01_08_39_02_618302</a><br>
>> [2] <a href="http://logs.openstack.org/83/394583/26/check/gate-rally-dsvm-cli/af28c0f/console.html#_2016-12-01_14_09_19_584427" target="_blank">http://logs.openstack.org/<wbr>83/394583/26/check/gate-rally-<wbr>dsvm-cli/af28c0f/console.html#<wbr>_2016-12-01_14_09_19_584427</a><br>
>> [3] <a href="http://logs.openstack.org/83/394583/26/check/gate-rally-dsvm-neutron-existing-users-rally/26cd009/console.html#_2016-12-01_14_15_17_147016" target="_blank">http://logs.openstack.org/<wbr>83/394583/26/check/gate-rally-<wbr>dsvm-neutron-existing-users-<wbr>rally/26cd009/console.html#_<wbr>2016-12-01_14_15_17_147016</a><br>
>> [4] <a href="https://bugs.launchpad.net/rally?field.searchtext=keystone+v3" target="_blank">https://bugs.launchpad.<wbr>net/rally?field.searchtext=<wbr>keystone+v3</a><br>
>> [5] <a href="http://eavesdrop.openstack.org/irclogs/%23openstack-containers/%23openstack-containers.2016-12-01.log.html#t2016-12-01T14:57:00" target="_blank">http://eavesdrop.<wbr>openstack.org/irclogs/%<wbr>23openstack-containers/%<wbr>23openstack-containers.2016-<wbr>12-01.log.html#t2016-12-01T14:<wbr>57:00</a><br>
>><br>
>> On Thu, Dec 1, 2016 at 6:39 AM, Spyros Trigazis <<a href="mailto:strigazi@gmail.com" target="_blank">strigazi@gmail.com</a>> wrote:<br>
>>><br>
>>> I think for magnum we are OK.<br>
>>><br>
>>> This job [1] finished using keystone v3 [2]<br>
>>><br>
>>> Spyros<br>
>>><br>
>>> [1] <a href="http://logs.openstack.org/93/400593/9/check/gate-functional-dsvm-magnum-api/93e8c14/" target="_blank">http://logs.openstack.org/<wbr>93/400593/9/check/gate-<wbr>functional-dsvm-magnum-api/<wbr>93e8c14/</a><br>
>>> [2] <a href="http://logs.openstack.org/93/400593/9/check/gate-functional-dsvm-magnum-api/93e8c14/logs/devstacklog.txt.gz#_2016-12-01_11_32_58_033" target="_blank">http://logs.openstack.org/<wbr>93/400593/9/check/gate-<wbr>functional-dsvm-magnum-api/<wbr>93e8c14/logs/devstacklog.txt.<wbr>gz#_2016-12-01_11_32_58_033</a><br>
>>><br>
>>> On 1 December 2016 at 12:26, Davanum Srinivas <<a href="mailto:davanum@gmail.com" target="_blank">davanum@gmail.com</a>> wrote:<br>
>>>><br>
>>>> It has taken years to get here with a lot of work from many folks.<br>
>>>><br>
>>>> -1 for Any revert!<br>
>>>><br>
>>>> <a href="https://etherpad.openstack.org/p/v3-only-devstack" target="_blank">https://etherpad.openstack.<wbr>org/p/v3-only-devstack</a><br>
>>>> <a href="http://markmail.org/message/aqq7itdom36omnf6" target="_blank">http://markmail.org/message/<wbr>aqq7itdom36omnf6</a><br>
>>>> <a href="https://review.openstack.org/#/q/status:merged+project:openstack-dev/devstack+branch:master+topic:bp/keystonev3" target="_blank">https://review.openstack.org/#<wbr>/q/status:merged+project:<wbr>openstack-dev/devstack+branch:<wbr>master+topic:bp/keystonev3</a><br>
>>>><br>
>>>> Thanks,<br>
>>>> Dims<br>
>>>><br>
>>>> On Thu, Dec 1, 2016 at 5:38 AM, Andrey Kurilin <<a href="mailto:akurilin@mirantis.com" target="_blank">akurilin@mirantis.com</a>> wrote:<br>
>>>> > Hi folks!<br>
>>>> ><br>
>>>> > Today devstack team decided to switch to keystone v3 by default[0].<br>
>>>> > Imo, it is important thing, but it was made in silent, so other project was<br>
>>>> > unable to prepare to that change. Also, proposed way to select Keystone API<br>
>>>> > version via devstack configuration doesn't work(IDENTITY_API_VERSION<br>
>>>> > variable doesn't work [1] ).<br>
>>>> ><br>
>>>> > Switching to keystone v3 broke at least Rally and Magnum(based on comment to<br>
>>>> > [0]) gates. Also, python-novaclient has two separate jobs for checking<br>
>>>> > compatibility with keystone V2 and V3. One of these jobs became redundant.<br>
>>>> ><br>
>>>> > That is why I submitted a revert [2] .<br>
>>>> ><br>
>>>> > PS: Please, do not make such changes in silent!<br>
>>>> ><br>
>>>> > [0] - <a href="https://review.openstack.org/#/c/386183" target="_blank">https://review.openstack.org/#<wbr>/c/386183</a><br>
>>>> > [1] -<br>
>>>> > <a href="https://github.com/openstack-infra/project-config/blob/master/jenkins/jobs/rally.yaml#L70-L74" target="_blank">https://github.com/openstack-<wbr>infra/project-config/blob/<wbr>master/jenkins/jobs/rally.<wbr>yaml#L70-L74</a><br>
>>>> > [2] - <a href="https://review.openstack.org/405264" target="_blank">https://review.openstack.org/<wbr>405264</a><br>
>>>> ><br>
>>>> > --<br>
>>>> > Best regards,<br>
>>>> > Andrey Kurilin.<br>
>>>> ><br>
>>>> > ______________________________<wbr>______________________________<wbr>______________<br>
>>>> > OpenStack Development Mailing List (not for usage questions)<br>
>>>> > Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.<wbr>openstack.org?subject:<wbr>unsubscribe</a><br>
>>>> > <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/<wbr>cgi-bin/mailman/listinfo/<wbr>openstack-dev</a><br>
>>>> ><br>
>>>><br>
>>>><br>
>>>><br>
>>>> --<br>
>>>> Davanum Srinivas :: <a href="https://twitter.com/dims" target="_blank">https://twitter.com/dims</a><br>
>>>><br>
>>>> ______________________________<wbr>______________________________<wbr>______________<br>
>>>> OpenStack Development Mailing List (not for usage questions)<br>
>>>> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.<wbr>openstack.org?subject:<wbr>unsubscribe</a><br>
>>>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/<wbr>cgi-bin/mailman/listinfo/<wbr>openstack-dev</a><br>
>>><br>
>>><br>
>>><br>
>>> ______________________________<wbr>______________________________<wbr>______________<br>
>>> OpenStack Development Mailing List (not for usage questions)<br>
>>> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.<wbr>openstack.org?subject:<wbr>unsubscribe</a><br>
>>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/<wbr>cgi-bin/mailman/listinfo/<wbr>openstack-dev</a><br>
>>><br>
>><br>
>> ______________________________<wbr>______________________________<wbr>______________<br>
>> OpenStack Development Mailing List (not for usage questions)<br>
>> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.<wbr>openstack.org?subject:<wbr>unsubscribe</a><br>
>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/<wbr>cgi-bin/mailman/listinfo/<wbr>openstack-dev</a><br>
><br>
><br>
> ______________________________<wbr>______________________________<wbr>______________<br>
> OpenStack Development Mailing List (not for usage questions)<br>
> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.<wbr>openstack.org?subject:<wbr>unsubscribe</a><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/<wbr>cgi-bin/mailman/listinfo/<wbr>openstack-dev</a><br>
></p>
</div></div><p dir="ltr">This has been a long running set of changes that has been in the works for a long, long, long time. We have tried this before and have made a number of changes needed for this. I agree there should have been at least one more email announcement that this is occurring, I am a big -1 on revert. We need to be at v3 only this cycle.</p></blockquote><div>I agree that moving to keystone v3 is important thing for whole OpenStack and as I said in IRC, I have a patch for porting all "keystone v2 only" scenarios to support v3 as well, but it doesn't relate to the subject of my mail.<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<p dir="ltr">V2 is inherently insecure compared to v3. I apologize for the headache, but I am going to ask politely that we/rally-team work on correcting the scenario instead of reverting the change. This only improves OpenStack at this point. </p></blockquote><div>> work on correcting the scenario<br>:( I do not know how much times I should repeat, but I'll do it one more time: the problem is not in our scenarios. We have a job for checking keystone V2. This is only one job which has "keystone v2 only" scenarios and it became failure since "IDENTITY_API_VERSION" variable of job doesn't do what should do(setup keystone v2).<br></div><div> <br></div><div>Thanks to Boris B. (aka breton) we have possible fix - <a href="https://review.openstack.org/#/c/405536">https://review.openstack.org/#/c/405536</a><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<p dir="ltr">Thanks for understanding.<span class="gmail-HOEnZb"><font color="#888888"><br>
--Morgan</font></span></p>
<br>______________________________<wbr>______________________________<wbr>______________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.<wbr>openstack.org?subject:<wbr>unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/<wbr>cgi-bin/mailman/listinfo/<wbr>openstack-dev</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div dir="ltr">Best regards,<br>Andrey Kurilin.<br></div></div>
</div></div>