<p dir="ltr"></p>
<p dir="ltr">On Dec 1, 2016 8:25 AM, "Andrey Kurilin" <<a href="mailto:akurilin@mirantis.com">akurilin@mirantis.com</a>> wrote:<br>
><br>
> As I replied at IRC, please do not mix two separate issues! <br>
> Yes, we have several scenarios which are not support keystone v3 yet. It is an issue, but it is unrelated issue to described in the first mail. <br>
> We have a job which is configured with proper IDENTITY_API_VERSION flag and should be launched against Keystone v2, but there is only keystone v3 and it is a real issue.<br>
><br>
> On Thu, 1 Dec 2016 at 17:48, Lance Bragstad <<a href="mailto:lbragstad@gmail.com">lbragstad@gmail.com</a>> wrote:<br>
>><br>
>> FWIW - i'm seeing a common error in several of the rally failures [0] [1] [2] [3]. Dims also pointed out a few bugs in rally for keystone v3 support [4].<br>
>><br>
>> I checked with the folks in #openstack-containers to see if they were experiencing anymore fallout, but it looks like the magnum gate is under control [5]. We're currently in #openstack-keystone talking through options for the rally situation in case anyone feels like joining.<br>
>><br>
>><br>
>> [0] <a href="http://logs.openstack.org/87/404887/4/check/gate-rally-dsvm-neutron-existing-users-rally/ff60a83/console.html#_2016-12-01_08_05_55_268772">http://logs.openstack.org/87/404887/4/check/gate-rally-dsvm-neutron-existing-users-rally/ff60a83/console.html#_2016-12-01_08_05_55_268772</a><br>
>> [1] <a href="http://logs.openstack.org/43/405143/3/check/gate-rally-dsvm-neutron-existing-users-rally/3ee975b/console.html#_2016-12-01_08_39_02_618302">http://logs.openstack.org/43/405143/3/check/gate-rally-dsvm-neutron-existing-users-rally/3ee975b/console.html#_2016-12-01_08_39_02_618302</a><br>
>> [2] <a href="http://logs.openstack.org/83/394583/26/check/gate-rally-dsvm-cli/af28c0f/console.html#_2016-12-01_14_09_19_584427">http://logs.openstack.org/83/394583/26/check/gate-rally-dsvm-cli/af28c0f/console.html#_2016-12-01_14_09_19_584427</a><br>
>> [3] <a href="http://logs.openstack.org/83/394583/26/check/gate-rally-dsvm-neutron-existing-users-rally/26cd009/console.html#_2016-12-01_14_15_17_147016">http://logs.openstack.org/83/394583/26/check/gate-rally-dsvm-neutron-existing-users-rally/26cd009/console.html#_2016-12-01_14_15_17_147016</a><br>
>> [4] <a href="https://bugs.launchpad.net/rally?field.searchtext=keystone+v3">https://bugs.launchpad.net/rally?field.searchtext=keystone+v3</a><br>
>> [5] <a href="http://eavesdrop.openstack.org/irclogs/%23openstack-containers/%23openstack-containers.2016-12-01.log.html#t2016-12-01T14:57:00">http://eavesdrop.openstack.org/irclogs/%23openstack-containers/%23openstack-containers.2016-12-01.log.html#t2016-12-01T14:57:00</a><br>
>><br>
>> On Thu, Dec 1, 2016 at 6:39 AM, Spyros Trigazis <<a href="mailto:strigazi@gmail.com">strigazi@gmail.com</a>> wrote:<br>
>>><br>
>>> I think for magnum we are OK.<br>
>>><br>
>>> This job [1] finished using keystone v3 [2]<br>
>>><br>
>>> Spyros<br>
>>><br>
>>> [1] <a href="http://logs.openstack.org/93/400593/9/check/gate-functional-dsvm-magnum-api/93e8c14/">http://logs.openstack.org/93/400593/9/check/gate-functional-dsvm-magnum-api/93e8c14/</a><br>
>>> [2] <a href="http://logs.openstack.org/93/400593/9/check/gate-functional-dsvm-magnum-api/93e8c14/logs/devstacklog.txt.gz#_2016-12-01_11_32_58_033">http://logs.openstack.org/93/400593/9/check/gate-functional-dsvm-magnum-api/93e8c14/logs/devstacklog.txt.gz#_2016-12-01_11_32_58_033</a><br>
>>><br>
>>> On 1 December 2016 at 12:26, Davanum Srinivas <<a href="mailto:davanum@gmail.com">davanum@gmail.com</a>> wrote:<br>
>>>><br>
>>>> It has taken years to get here with a lot of work from many folks.<br>
>>>><br>
>>>> -1 for Any revert!<br>
>>>><br>
>>>> <a href="https://etherpad.openstack.org/p/v3-only-devstack">https://etherpad.openstack.org/p/v3-only-devstack</a><br>
>>>> <a href="http://markmail.org/message/aqq7itdom36omnf6">http://markmail.org/message/aqq7itdom36omnf6</a><br>
>>>> <a href="https://review.openstack.org/#/q/status:merged+project:openstack-dev/devstack+branch:master+topic:bp/keystonev3">https://review.openstack.org/#/q/status:merged+project:openstack-dev/devstack+branch:master+topic:bp/keystonev3</a><br>
>>>><br>
>>>> Thanks,<br>
>>>> Dims<br>
>>>><br>
>>>> On Thu, Dec 1, 2016 at 5:38 AM, Andrey Kurilin <<a href="mailto:akurilin@mirantis.com">akurilin@mirantis.com</a>> wrote:<br>
>>>> > Hi folks!<br>
>>>> ><br>
>>>> > Today devstack team decided to switch to keystone v3 by default[0].<br>
>>>> > Imo, it is important thing, but it was made in silent, so other project was<br>
>>>> > unable to prepare to that change. Also, proposed way to select Keystone API<br>
>>>> > version via devstack configuration doesn't work(IDENTITY_API_VERSION<br>
>>>> > variable doesn't work [1] ).<br>
>>>> ><br>
>>>> > Switching to keystone v3 broke at least Rally and Magnum(based on comment to<br>
>>>> > [0]) gates. Also, python-novaclient has two separate jobs for checking<br>
>>>> > compatibility with keystone V2 and V3. One of these jobs became redundant.<br>
>>>> ><br>
>>>> > That is why I submitted a revert [2] .<br>
>>>> ><br>
>>>> > PS: Please, do not make such changes in silent!<br>
>>>> ><br>
>>>> > [0] - <a href="https://review.openstack.org/#/c/386183">https://review.openstack.org/#/c/386183</a><br>
>>>> > [1] -<br>
>>>> > <a href="https://github.com/openstack-infra/project-config/blob/master/jenkins/jobs/rally.yaml#L70-L74">https://github.com/openstack-infra/project-config/blob/master/jenkins/jobs/rally.yaml#L70-L74</a><br>
>>>> > [2] - <a href="https://review.openstack.org/405264">https://review.openstack.org/405264</a><br>
>>>> ><br>
>>>> > --<br>
>>>> > Best regards,<br>
>>>> > Andrey Kurilin.<br>
>>>> ><br>
>>>> > __________________________________________________________________________<br>
>>>> > OpenStack Development Mailing List (not for usage questions)<br>
>>>> > Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
>>>> > <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
>>>> ><br>
>>>><br>
>>>><br>
>>>><br>
>>>> --<br>
>>>> Davanum Srinivas :: <a href="https://twitter.com/dims">https://twitter.com/dims</a><br>
>>>><br>
>>>> __________________________________________________________________________<br>
>>>> OpenStack Development Mailing List (not for usage questions)<br>
>>>> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
>>>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
>>><br>
>>><br>
>>><br>
>>> __________________________________________________________________________<br>
>>> OpenStack Development Mailing List (not for usage questions)<br>
>>> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
>>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
>>><br>
>><br>
>> __________________________________________________________________________<br>
>> OpenStack Development Mailing List (not for usage questions)<br>
>> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
><br>
><br>
> __________________________________________________________________________<br>
> OpenStack Development Mailing List (not for usage questions)<br>
> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
></p>
<p dir="ltr">This has been a long running set of changes that has been in the works for a long, long, long time. We have tried this before and have made a number of changes needed for this. I agree there should have been at least one more email announcement that this is occurring, I am a big -1 on revert. We need to be at v3 only this cycle.</p>
<p dir="ltr">V2 is inherently insecure compared to v3. I apologize for the headache, but I am going to ask politely that we/rally-team work on correcting the scenario instead of reverting the change. This only improves OpenStack at this point. </p>
<p dir="ltr">Thanks for understanding.<br>
--Morgan</p>