Open Stack

Excerpts from Daniel P. Berrange's message of 2016-07-08 15:25:16 +0100:
> On Fri, Jul 08, 2016 at 10:14:20PM +0800, ChangBo Guo wrote:
> > Hi ALL,
> > 
> > I have been working a bug [1] about option value interpolation in
> > oslo.config[2], in short, option value interpolation can't handle password
> > containing special characters from environment variable and I  proposed a
> > fix of provide way to forbid option value interpolation explicitly[3].
> > 
> > copy of Doug Hellmann's coments:
> > 
> > "The problem is that the end user who is setting the value of the option
> > cannot control whether the option will do interpolation or not. So the
> > programmer who defines the option has to make that choice, and then we
> > can't change it because that would break existing deployments. The result
> > is that end users won't know for any given option whether interpolation
> > works or not, and if not why (did they do something wrong, or is it not
> > supported).
> > 
> > I've set -2 on this patch because I think it's a bad approach. I see 2
> > other ways we could solve the problem you describe (and I agree that it's
> > an issue we should help with).
> > 
> > 1. We could have an option that turns off interpolation globally, and let
> > the user control that by setting the flag in their configuration file. I'm
> > not sure I like this, but it does give you what you're looking for at the
> > risk of breaking applications that are relying on interpolation, like the
> > nova example.
> > 
> > 2. We could disable interpolation when we get values from environment
> > variables. That would be a big behavioral change, so we would need to think
> > about how to roll it out carefully. For example, do we provide a helper
> > function to give to application developers who are setting default values
> > to environment variables so the variable value can be escaped to avoid
> > interpolation? Or do we build it into the Opt class somehow? I think I like
> > the helper function approach but we should give it more thought."
> > I would like to collect more suggestions to decide the direction to fix
> > similar bug. Any thoughts ?
> 
> I don't see a compelling need to change oslo behaviour wrt interpolation
> at all, given all the option suggested here break copatibility in some
> manner or another.
> 
> The curernt behaviour should just have its error reporting fixed, so that
> it explicitly tells the user that the env var it tried to interpolate
> contains invalid characters, instead of printing the incomprehensible
> stack trace.
> 
> 
> Regards,
> Daniel

Sure, the bug should be fixed. I was also trying to find a way to
address the usability issue ChangBo pointed out in the commit message,
which is that defaults being pulled from environment variables need to
be treated carefully. In some cases the values should be escaped but in
others they shouldn't, and the same environment variable is being used
in all cases.

Doug