<div dir="ltr">There's a jython implementation of keystone and I thought there was other work to validate tokens from within Java. Added Jim Baker to the thread.<div><br></div><div>-d</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, May 12, 2016 at 5:06 PM, Michael Still <span dir="ltr"><<a href="mailto:mikal@stillhq.com" target="_blank">mikal@stillhq.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I'm just going to reply to myself here with another status update.<div><br></div><div>The design seems largely settled at this point, with one exception -- how does nova authenticate with the external microservice?</div><div><br></div><div>The current proposal is to have nova use the client's keystone token to authenticate with the external microservice. This is a neat solution because its what nova does when talking to other services in your OpenStack deployment, so its consistent and well understood.</div><div><br></div><div>The catch here is that it means your external microservice needs to know how to do keystone authentication. That's well understood for python microservices, and I can provide sample code for that case using the keystone wsgi middleware. On the other hand, its harder for things like Java where I'm not sure I'm aware of any keystone auth implementation. Is effectively requiring the microservices to be written in python a particular problem? I'm hoping not given that all the current plugins are written in python by definition.</div><div><br></div><div>Cheers,</div><div>Michael</div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><div><div class="h5"><br><div class="gmail_quote">On Wed, May 4, 2016 at 7:37 AM, Michael Still <span dir="ltr"><<a href="mailto:mikal@stillhq.com" target="_blank">mikal@stillhq.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hey,<div><br></div><div>I just wanted to let people know that the review is progressing, but we have a question.</div><div><br></div><div>Do operators really need to call more than one external REST service to collect vendordata? We can implement that in nova, but it would be nice to reduce the complexity to only having one external REST service. If you needed to call more than one service you could of course write a REST service that aggregated REST services.</div><div><br></div><div>Does anyone in the operator community have strong feelings either way? Should nova be able to call more than one external vendordata REST service?</div><div><br></div><div>Thanks,</div><div>Michael</div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><div><div><br><div class="gmail_quote">On Sat, Apr 30, 2016 at 4:11 AM, Michael Still <span dir="ltr"><<a href="mailto:mikal@stillhq.com" target="_blank">mikal@stillhq.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">So, after a series of hallway track chats this week, I wrote this:<div><br></div><div> <a href="https://review.openstack.org/#/c/310904/" target="_blank">https://review.openstack.org/#/c/310904/</a></div><div><br></div><div>Which is a proposal for how to implement vendordata in a way which would (probably) be acceptable to nova, whilst also meeting the needs of operators. I should reinforce that because this week is so hectic nova core hasn't really talked about this yet, but I am pretty sure I understand and have addressed Sean's concerns.</div><div><br></div><div>I'd be curious as to if the proposed solution actually meets your needs.</div><div><br></div><div>Michael</div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><div><div><br><div class="gmail_quote">On Mon, Apr 18, 2016 at 10:55 AM, Fox, Kevin M <span dir="ltr"><<a href="mailto:Kevin.Fox@pnnl.gov" target="_blank">Kevin.Fox@pnnl.gov</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div style="direction:ltr;font-family:Tahoma;color:#000000;font-size:10pt">We've used it too to work around the lack of instance users in nova. Please keep it until a viable solution can be reached.<br>
<br>
Thanks,<br>
Kevin<br>
<div style="font-family:Times New Roman;color:#000000;font-size:16px">
<hr>
<div style="direction:ltr"><font color="#000000" face="Tahoma" size="2"><b>From:</b> David Medberry [<a href="mailto:openstack@medberry.net" target="_blank">openstack@medberry.net</a>]<br>
<b>Sent:</b> Monday, April 18, 2016 7:16 AM<br>
<b>To:</b> Ned Rhudy<br>
<b>Cc:</b> <a href="mailto:openstack-operators@lists.openstack.org" target="_blank">openstack-operators@lists.openstack.org</a><div><div><br>
<b>Subject:</b> Re: [Openstack-operators] Anyone else use vendordata_driver in nova.conf?<br>
</div></div></font><br>
</div><div><div>
<div></div>
<div>
<div dir="ltr">Hi Ned, Jay,
<div><br>
</div>
<div>We use it also and I have to agree, it's onerous to require users to add that functionality back in. Where was this discussed?</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Mon, Apr 18, 2016 at 8:13 AM, Ned Rhudy (BLOOMBERG/ 731 LEX)
<span dir="ltr"><<a href="mailto:erhudy@bloomberg.net" target="_blank">erhudy@bloomberg.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div style="white-space:pre-wrap;font-size:small;font-family:'Courier New',Courier;color:rgb(0,0,0)">
Requiring users to remember to pass specific userdata through to their instance at every launch in order to replace functionality that currently works invisible to them would be a step backwards. It's an alternative, yes, but it's an alternative that adds burden
to our users and is not one we would pursue.
<div><br>
</div>
<div>What is the rationale for desiring to remove this functionality?<br>
<div style="font-size:small;font-family:'Courier New',Courier;color:rgb(0,0,0)">
<br>
<div>
<div>From: <a href="mailto:jaypipes@gmail.com" target="_blank">jaypipes@gmail.com</a>
</div>
<div>Subject: Re: [Openstack-operators] Anyone else use vendordata_driver in nova.conf?<br>
</div>
</div>
<div>
<div>
<blockquote>On 04/18/2016 09:24 AM, Ned Rhudy (BLOOMBERG/ 731 LEX) wrote:<br>
> I noticed while reading through Mitaka release notes that<br>
> vendordata_driver has been deprecated in Mitaka<br>
> (<a href="https://review.openstack.org/#/c/288107/" target="_blank">https://review.openstack.org/#/c/288107/</a>) and is slated for removal at<br>
> some point. This came as somewhat of a surprise to me - I searched<br>
> openstack-dev for vendordata-related subject lines going back to January<br>
> and found no discussion on the matter (IRC logs, while available on<br>
> eavesdrop, are not trivially searchable without a little scripting to<br>
> fetch them first, so I didn't check there yet).<br>
><br>
> We at Bloomberg make heavy use of this particular feature to inject<br>
> dynamically generated JSON into the metadata service of instances; the<br>
> content of the JSON differs depending on the instance making the request<br>
> to the metadata service. The functionality that adds the contents of a<br>
> static JSON file, while remaining around, is not suitable for our use case.<br>
><br>
> Please let me know if you use vendordata_driver so that I/we can present<br>
> an organized case for why this option or equivalent functionality needs<br>
> to remain around. The alternative is that we end up patching the<br>
> vendordata driver directly in Nova when we move to Mitaka, which I'd<br>
> like to avoid; as a matter of principle I would rather see more<br>
> classloader overrides, not fewer.<br>
<br>
Wouldn't an alternative be to use something like Chef, Puppet, Ansible, <br>
Saltstack, etc and their associated config variable storage services <br>
like Hiera or something similar to publish custom metadata? That way, <br>
all you need to pass to your instance (via userdata) is a URI or <br>
connection string and some auth details for your config storage service <br>
and the instance can grab whatever you need.<br>
<br>
Thoughts?<br>
-jay<br>
<br>
_______________________________________________<br>
OpenStack-operators mailing list<br>
<a href="mailto:OpenStack-operators@lists.openstack.org" target="_blank">OpenStack-operators@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
</blockquote>
<br>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
_______________________________________________<br>
OpenStack-operators mailing list<br>
<a href="mailto:OpenStack-operators@lists.openstack.org" target="_blank">OpenStack-operators@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
<br>
</blockquote>
</div>
<br>
</div>
</div>
</div></div></div>
</div>
</div>
<br>_______________________________________________<br>
OpenStack-operators mailing list<br>
<a href="mailto:OpenStack-operators@lists.openstack.org" target="_blank">OpenStack-operators@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div></div></div><span><font color="#888888">-- <br><div>Rackspace Australia</div>
</font></span></div>
</blockquote></div><br><br clear="all"><div><br></div></div></div><span><font color="#888888">-- <br><div>Rackspace Australia</div>
</font></span></div>
</blockquote></div><br><br clear="all"><div><br></div></div></div><span class="HOEnZb"><font color="#888888">-- <br><div>Rackspace Australia</div>
</font></span></div>
</blockquote></div><br></div>