[openstack-dev] [panko][ceilometer][keystone] Support X-Is-Admin-Project

Innus, Martins minnus at buffalo.edu
Thu Sep 7 18:15:06 UTC 2017


Hi,
	Just getting started with OpenStack and one of the stumbling blocks so far is that unless I missed it, there is no way for the main admin user to request event data for all projects:

[root at srv-m10-05-02 keystone]# ceilometer event-list -q 'event_type=compute.instance.create.start'
+------------+------------+-----------+--------+
| Message ID | Event Type | Generated | Traits |
+------------+------------+-----------+--------+
+------------+------------+-----------+————+



Where there are definitely instances running and the user that created them has no issue seeing the events:

[minnus at srv-m10-05-02 ~]$ ceilometer  event-list -q 'event_type=compute.instance.create.start' --limit 1
+--------------------------------------+-------------------------------+----------------------------+---------------------------------------------------------------------------+
| Message ID                           | Event Type                    | Generated                  | Traits                                                                    |
+--------------------------------------+-------------------------------+----------------------------+---------------------------------------------------------------------------+
| b7ce7652-9745-487d-9fcc-570c7c972080 | compute.instance.create.start | 2017-08-29T15:37:39.707727 | +------------------+---------+------------------------------------------+ |
|                                      |                               |                            | |       name       |   type  |                  value

……


The fix seems to be something like the attached patch and setting the appropriate configs in keystone.conf.


One curious thing is that with the default keystone config, requests from all projects have "X-Is-Admin-Project: True”

If I set admin_project_domain_name and admin_project_name , only then do the non admin projects have the header set to False.

This is on:
 - Centos 7.3
 - Ocata
 - Panko backed by MariaDB.

Is this change something that would be accepted?

Thanks!

Martins

-------------- next part --------------
A non-text attachment was scrubbed...
Name: panko.patch
Type: application/octet-stream
Size: 559 bytes
Desc: panko.patch
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20170907/e3a736f6/attachment.obj>


More information about the OpenStack-dev mailing list