Open Stack

Asking on the operators mailing list may yield more examples where people are using the Neutron client.

From the CERN perspective, we use OSC heavily now it has Kerberos and X.509 support. With the new support of Keystone V3 in the Nova python client, we are interested in extending this support to these methods.

While we are in the process of planning our Nova network to Neutron migration (and thus our Neutron usage is limited to testing currently), it would be attractive if the OSC support Neutron operations with these authentication methods. Worst case, following the same structure as Nova would allow us to work with others interested in Kerberos and X.509 for a single set of patches so we would strongly prefer the same plug in approach for Neutron as used by Nova (compared to re-inventing the wheel).

Tim

From: Kevin Benton [mailto:blak111 at gmail.com]
Sent: 18 February 2015 20:01
To: OpenStack Development Mailing List (not for usage questions)
Subject: Re: [openstack-dev] Pluggable Auth for clients and where should it go

This is something I have been working on internally as well. I've been trying to find a way to make the changes to the python neutronclient in the least invasive way to support pluggable authentication. I would be happy to help review the changes you submit upstream if you have something already well-tested.

>Would you benefit from pluggable auth?

Yes.

>What are you looking for in auth?

Parity with the nova client.

>Would you benefit from the python-neutronclient getting nova's auth capabilities?

Yes

I have a similar constraint with waiting for the move to OSC/SDK. Even if the support for auth was merged into OSC/SDK, it wouldn't work with existing scripts and (more importantly) existing Icehouse/Juno Nova deployments that use the neutron client for the notifications to Neutron.

On Wed, Feb 18, 2015 at 8:52 AM, Justin Hammond <justin.hammond at rackspace.com<mailto:justin.hammond at rackspace.com>> wrote:
Just starting this discussion…

This is in reference to https://blueprints.launchpad.net/python-neutronclient/+spec/pluggable-neutronclient-auth

Originally the blueprint was for python-neutronclient only, but pluggable auth is a wide-reaching issue. With OSC/SDK on the horizon (however far), we should probably begin the discussion of how to best do this (if it hasn't been done).

A request: We have an immediate need to add pluggable auth to the python-neutronclient, modeled after python-novaclient's pluggable auth system, to maintain a consistent workflow for our users. After the discussion in the neutron-drivers meeting (http://eavesdrop.openstack.org/meetings/neutron_drivers/2015/neutron_drivers.2015-02-18-15.31.log.html) it is clear that python-neutronclient will survive for Kilo +12 months, at least. During that timeframe we'd like to have pluggable auth supported so we can bridge that gap. Beyond that immediate need, we are dedicated to making OSC/SDK the way to go in the future, and will gladly assist in adding said features.

We have a solution for our immediate solution but that may not apply to OSC/SDK. So my questions are:


  *   Would you benefit from pluggable auth?
  *   What are you looking for in auth?
  *   Would you benefit from the python-neutronclient getting nova's auth capabilities?
Thank you for your time!

- Justin (roaet)



__________________________________________________________________________
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: OpenStack-dev-request at lists.openstack.org?subject:unsubscribe<http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe>
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev



--
Kevin Benton
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20150218/bdaccbbd/attachment.html>