| *** jruano has joined #senlin | 00:18 | |
| *** Qiming has quit IRC | 00:26 | |
| *** mathspanda has joined #senlin | 01:20 | |
| *** Qiming has joined #senlin | 01:22 | |
| *** xuhaiwei has joined #senlin | 01:41 | |
| *** mathspanda has quit IRC | 01:42 | |
| *** mathspanda has joined #senlin | 01:50 | |
| *** mathspanda has quit IRC | 01:56 | |
| *** mathspanda has joined #senlin | 01:57 | |
| openstackgerrit | xu-haiwei proposed stackforge/python-senlinclient: Add resource_key to event models https://review.openstack.org/222012 | 02:05 |
|---|---|---|
| *** Yanyanhu has joined #senlin | 02:13 | |
| *** Yanyanhu has quit IRC | 02:18 | |
| *** Yanyanhu has joined #senlin | 02:25 | |
| *** Tennyson has joined #senlin | 02:26 | |
| openstackgerrit | Merged stackforge/python-senlinclient: Add resource_key to event models https://review.openstack.org/222012 | 02:32 |
| *** jruano has quit IRC | 02:51 | |
| *** jruano has joined #senlin | 02:55 | |
| *** jruano has quit IRC | 03:04 | |
| *** lixinhui has joined #senlin | 03:33 | |
| *** mathspanda has quit IRC | 03:53 | |
| *** mathspanda has joined #senlin | 04:01 | |
| *** lixinhui has quit IRC | 04:35 | |
| *** lixinhui has joined #senlin | 04:58 | |
| *** lixinhui has quit IRC | 05:06 | |
| *** lixinhui has joined #senlin | 05:23 | |
| *** mathspanda has quit IRC | 06:04 | |
| LiuWei | hi,when I deepcopy the context object,I met the error:TypeError: object.__new__(NotImplementedType) is not safe, use NotImplementedType.__new__() | 06:07 |
| LiuWei | you can see more details at :http://paste.openstack.org/show/454425/ | 06:08 |
| LiuWei | do you meet the same question when deepcopy context?please give some advise ^.^ | 06:12 |
| *** Tennyson has quit IRC | 06:29 | |
| *** lawrancejing has joined #senlin | 06:35 | |
| xuhaiwei | LiuWei, dont know your problem | 07:06 |
| xuhaiwei | Qiming, are you around? | 07:07 |
| xuhaiwei | Found a quite big problem | 07:07 |
| LiuWei | thanks,I have solved it . | 07:07 |
| Qiming | hi | 07:08 |
| Qiming | what's up | 07:08 |
| xuhaiwei | I am afraid trust is not working in senlin | 07:08 |
| LiuWei | I misunderstand the context between Action class and Profile class. | 07:08 |
| Qiming | xuhaiwei, evidence? | 07:09 |
| xuhaiwei | Does senlin user have the admin priority? | 07:09 |
| xuhaiwei | I just made some test by the webhook | 07:09 |
| Qiming | senlin user is an admin in project 'service' | 07:09 |
| xuhaiwei | I found though I dont use trust, senlin can still create a token | 07:10 |
| Qiming | when it performs some operations on behalf of a requesting user, senlin assumes the roles of that user using trust | 07:10 |
| Qiming | what do you mean? | 07:10 |
| xuhaiwei | I saw the webhook implementation, when we dont use '-C' option, we will use trust to create token, that's true? | 07:11 |
| xuhaiwei | but if I modified the source, dont input trust into the kwargs which is used to get_token, token can still be fetched | 07:12 |
| Qiming | yes | 07:12 |
| Qiming | that is a wrong implementation | 07:13 |
| xuhaiwei | like you said, senlin is an admin in 'service' project | 07:13 |
| Qiming | a token can be created with and without a trust | 07:13 |
| xuhaiwei | yes | 07:13 |
| Qiming | if you don't provide a trust, the token will be created for 'senlin' in the 'service' project | 07:14 |
| xuhaiwei | but if I used trust, the token is still in 'service' project | 07:14 |
| Qiming | if you use that token to create a heat stack for example, the stack will be created in the 'service' project as well, not the requesting user's project | 07:14 |
| Qiming | I'm not sure about that | 07:15 |
| xuhaiwei | so there is no difference whether I use trust or not | 07:15 |
| Qiming | if you provide a trust, you cannot provide a 'project' for token creation | 07:15 |
| Qiming | there is big difference | 07:15 |
| Qiming | the correct implementation must use trust, or else everything falls apart | 07:16 |
| xuhaiwei | yes, when trust is provided token can only be created in 'service' project | 07:16 |
| Qiming | the token can be created, yes, but when it is later authenticated by keystone, keystone knows where you are from | 07:16 |
| xuhaiwei | that will cause the 403 error when hitting the policy check | 07:16 |
| Qiming | that token has access to the project indicated by the trust | 07:17 |
| xuhaiwei | because the user project is not 'service' | 07:17 |
| Qiming | I have never seen that happening | 07:17 |
| Qiming | if that does happen, it is a bug for sure | 07:17 |
| xuhaiwei | maybe webhook is the only case | 07:17 |
| Qiming | there have been some bugs fixed recently | 07:18 |
| Qiming | to make sure your experimentation really reflects what the code's behavior | 07:18 |
| Qiming | I'd suggest you to delete all data in your credential table | 07:18 |
| Qiming | start from a clean install | 07:19 |
| xuhaiwei | ok, I will test again | 07:19 |
| Qiming | okay | 07:19 |
| openstackgerrit | Qiming Teng proposed stackforge/senlin: Update locale string https://review.openstack.org/222058 | 07:37 |
| xuhaiwei | Qiming, got the problem | 07:46 |
| xuhaiwei | it is still the trust parameter's name's problem | 07:46 |
| Qiming | username or user_name ? | 07:47 |
| xuhaiwei | openstacksdk uses trust_id | 07:47 |
| xuhaiwei | no, I remembered you or yanyan have fixed this | 07:47 |
| Qiming | I see, we were provide 'trusts' .... for whatever reason | 07:47 |
| xuhaiwei | yes | 07:47 |
| *** yuanying has joined #senlin | 07:48 | |
| openstackgerrit | xu-haiwei proposed stackforge/senlin: Fix trust parameter error https://review.openstack.org/222060 | 07:55 |
| Qiming | xuhaiwei, can we add a test case for the patch above ^ ? | 07:57 |
| xuhaiwei | ok | 07:57 |
| Qiming | this is a serious bug, need to be verified in future in case we accidentally change it to something else | 07:57 |
| Qiming | maybe just modifying existing test cases would suffice | 07:58 |
| xuhaiwei | ok | 07:58 |
| xuhaiwei | by the way, I am not understanding well about the '-C' option | 07:58 |
| openstackgerrit | LiuWei proposed stackforge/senlin: (WIP) cross-az policy https://review.openstack.org/221684 | 08:00 |
| Qiming | okay | 08:00 |
| Qiming | it allows a user A to say: I'm creating a webhook that will be triggered as user B ... and here is user B's credential | 08:01 |
| Qiming | in some deployments, this will be very convenient, at least as we can imagine | 08:02 |
| Qiming | you may create a special user 'alarm-trigger' | 08:02 |
| Qiming | that user can do nothing else other than trigger a webhook | 08:02 |
| xuhaiwei | yes, passing password seems not safe | 08:02 |
| Qiming | all monitoring/alarming services will use that for this purpose | 08:03 |
| Qiming | yes, it is not safe | 08:03 |
| Qiming | instead, it can contain things like 'trust' or whatever | 08:03 |
| xuhaiwei | when that user trigger the webhook, he just trigger the url, but anyone else can trigger the webhook if he knows the url, can't he? | 08:03 |
| Qiming | yes, but that triggering action will translate to a 'user', 'project' context when called | 08:04 |
| Qiming | we have webhook middleware to translate that back | 08:04 |
| xuhaiwei | if A created a webhook, and said: B can run it, but if C knows the url, C can also run it | 08:06 |
| Qiming | yes | 08:06 |
| Qiming | that is about webhook url management problem | 08:07 |
| Qiming | A should take care of it | 08:07 |
| Qiming | the only thing we (senlin) can do is we allow A to create a webhook that will be triggered as if the request comes from B | 08:07 |
| xuhaiwei | if A wants B to run it, A should tell B the url, so where does the credentials work? | 08:07 |
| Qiming | you are mixing two things together | 08:08 |
| Qiming | A creates a webhook, and he can tell anyone he trusts to trigger that URL | 08:08 |
| xuhaiwei | yes | 08:09 |
| Qiming | this is totally not senlin's business, we cannot control it | 08:09 |
| Qiming | When A creates a webhook, he has a freedom to choose whose credential will be used for triggering the webhook | 08:09 |
| Qiming | that is where the -C parameter comes to play | 08:09 |
| Qiming | there are three cases here: | 08:10 |
| Qiming | if A is an admin, and A doesn't provide additional credentials, senlin will use A's credential for webhook creation | 08:10 |
| Qiming | in other words, in future, when the webhook is triggered, senlin-engine will receive a request as if it comes from A | 08:11 |
| Qiming | case 2 | 08:11 |
| Qiming | sorry, in the above case, A is not an admin | 08:11 |
| Qiming | back to case 2 | 08:11 |
| Qiming | if A IS an admin, in theory, A can access any object (cluster/node ...), but we cannot create webhook that will be triggered in future as the admin | 08:12 |
| Qiming | so in this case, we use the target object's owner id for webhook creation | 08:12 |
| Qiming | case 3 | 08:12 |
| Qiming | a user A (admin or not), wants a webhook to be triggered as user B, and user A does have the credentials of user B, fine, we allow it | 08:13 |
| Qiming | is this clear enough? | 08:13 |
| xuhaiwei | still case 3 | 08:14 |
| Qiming | you got to read the webhook_trigger workflow to understand this | 08:14 |
| xuhaiwei | I have read the source code | 08:14 |
| Qiming | to senlin-engine, it doesnt care whether a request comes from a webhook or REST request | 08:15 |
| xuhaiwei | I just think we asked for B's credentials but not used it when B is triggering the webhook | 08:16 |
| Qiming | although there are some trivial translation | 08:16 |
| Qiming | you haven't read the whole story | 08:16 |
| Qiming | when a webhook is triggered, the request is first translated by the webhook middleware here: http://git.openstack.org/cgit/stackforge/senlin/tree/senlin/api/middleware/webhook.py | 08:17 |
| xuhaiwei | yes, got the project_id and so on | 08:18 |
| Qiming | the middleware parses the URI | 08:18 |
| Qiming | use the extracted project, webhook_id, key to get credential saved when the webhook was created | 08:19 |
| xuhaiwei | yes, from the url got project_id and webhook id | 08:19 |
| xuhaiwei | yes | 08:19 |
| Qiming | after decryption, line 98 will return the user trust created between user B and 'senlin', right? | 08:19 |
| Qiming | that is what was stored when the trust was created when you create the webhook | 08:20 |
| xuhaiwei | yes | 08:20 |
| Qiming | then, back to line 53 | 08:20 |
| Qiming | we use 'senlin' user name, password, but attach the previously created trust | 08:20 |
| Qiming | when we get a token from line 62 | 08:21 |
| Qiming | we get a new token from keystone | 08:21 |
| Qiming | this new token will be used down the request processing flow, until it arrives the senlin-api | 08:22 |
| Qiming | what senlin-api sees? | 08:22 |
| xuhaiwei | the token contains userB's credential | 08:22 |
| Qiming | it sees a request from 'senlin', it also says: okay, I'm senlin, but I'm doing this on behalf of B | 08:23 |
| Qiming | please treat me as B when I'm requesting anything | 08:23 |
| Qiming | this whole design cost us about 3 weeks, we evaluated quite some other alternatives before decision was made | 08:25 |
| xuhaiwei | I need to go through back and think about it more:) | 08:27 |
| Qiming | yep | 08:28 |
| Qiming | that is the core of the trust based authentication | 08:28 |
| yuanying | I'm not sure why `credential` option is pass from client | 08:28 |
| Qiming | :) no .... | 08:28 |
| Qiming | need me explain that again, ;) | 08:28 |
| yuanying | hmm | 08:28 |
| Qiming | is that a yes? | 08:29 |
| Qiming | yuanying, read this first: http://git.openstack.org/cgit/stackforge/senlin/tree/doc/source/developer/authorization.rst | 08:29 |
| yuanying | I'll discuss to xuhaiwei | 08:29 |
| Qiming | and this: http://git.openstack.org/cgit/stackforge/senlin/tree/doc/source/developer/webhook.rst | 08:30 |
| yuanying | oh, | 08:30 |
| yuanying | thanks! | 08:30 |
| * Qiming feels lucky that he wrote something before | 08:30 | |
| yuanying | haha | 08:31 |
| yuanying | I saw that, senlin webhook-create -C 'project_id=admin' was worked | 08:32 |
| Qiming | webhook-create -C 'god=idiot' will work as well | 08:32 |
| yuanying | so, I'm confusing what is credential | 08:33 |
| Qiming | several possible combinations actually | 08:33 |
| Qiming | you will need some background from keystone to understand that | 08:33 |
| yuanying | ok | 08:33 |
| Qiming | for example, some valid combinations inclue: | 08:33 |
| Qiming | s/inclue/include/: | 08:34 |
| Qiming | user_id + password | 08:34 |
| Qiming | user_id + password + trust_id | 08:34 |
| Qiming | user_id + token | 08:34 |
| Qiming | user_name + password + user_domain_name | 08:34 |
| Qiming | user_name + password + project_id | 08:35 |
| Qiming | oh, the last one won't work | 08:35 |
| Qiming | user_name + password + project_id + user_domain_name | 08:35 |
| Qiming | user_id + token + project_name + project_domain_name | 08:35 |
| *** lawrancejing has quit IRC | 08:36 | |
| yuanying | these are parameter for keystone authentication | 08:36 |
| Qiming | I am not 100% sure how will sdk or keystone treat with extra keys | 08:36 |
| Qiming | yep | 08:36 |
| Qiming | if you specify god_name=jesus, it may and may not complain though | 08:37 |
| openstackgerrit | Qiming Teng proposed stackforge/python-senlinclient: Fix node-update behavior https://review.openstack.org/222073 | 08:43 |
| Qiming | sigh, SDK doesn't have support for stack update | 08:45 |
| openstackgerrit | Yanyan Hu proposed stackforge/senlin: Rework context initialization in action module https://review.openstack.org/221676 | 08:48 |
| Yanyanhu | Qiming, yes, the node update feature has been frozen for a while as this reason | 08:48 |
| Yanyanhu | just came back | 08:49 |
| openstackgerrit | Merged stackforge/senlin: Update locale string https://review.openstack.org/222058 | 09:08 |
| Qiming | Yanyanhu, just posted comments to your patch above | 09:32 |
| Yanyanhu | ok, thanks | 09:32 |
| Qiming | something I'd suggest we will do this once | 09:32 |
| Yanyanhu | ok | 09:33 |
| Yanyanhu | hi, Qiming, about your comment in this fiel https://review.openstack.org/#/c/221676/2/senlin/engine/actions/cluster_action.py, so you mean we don't pass context even for those actions which derived from an existing action? | 09:36 |
| Qiming | yes | 09:36 |
| Qiming | it is useless | 09:36 |
| Qiming | we had this discussion yesterday | 09:37 |
| Qiming | at the end of the day, you cannot pass stateful things through RPC | 09:37 |
| Yanyanhu | yes, but I thought that is for actions created for RPC request? | 09:38 |
| Yanyanhu | e.g. those actions created in engine service | 09:38 |
| Yanyanhu | since these actions will be transmitted through queue or DB | 09:38 |
| Qiming | oh really? | 09:38 |
| Qiming | do you call start_action? | 09:38 |
| Yanyanhu | yes | 09:39 |
| Yanyanhu | actually you're right | 09:39 |
| Qiming | there is no difference | 09:39 |
| Yanyanhu | the result is the same even for those actions derived from existing one | 09:39 |
| Qiming | I have struggled on that for many hours last week | 09:39 |
| Yanyanhu | so seems we don't need context param in action base at all? | 09:40 |
| Qiming | I'm afraid so | 09:40 |
| Yanyanhu | or said DBsession param | 09:40 |
| Yanyanhu | hmm | 09:40 |
| Yanyanhu | ok, maybe we should remove it | 09:40 |
| Qiming | you just pass in a tuple (user, project, domain) when creating an action from scratch | 09:41 |
| Yanyanhu | yea | 09:41 |
| Qiming | when you load an action from DB, the logic can be changed | 09:41 |
| Qiming | I'm not 100% sure the 'context'/dbsession should be created in _from_db_record | 09:42 |
| Qiming | maybe we have to | 09:42 |
| Qiming | because the target we stored in DB could reference anything | 09:42 |
| Qiming | try deserialize a cluster then a node then a policy there to get the (user, project, domain) ? | 09:43 |
| Yanyanhu | yes | 09:43 |
| Yanyanhu | that's one reason | 09:43 |
| Qiming | that sounds a dirty job | 09:43 |
| Yanyanhu | yes, we shouldn't do this | 09:43 |
| Yanyanhu | ok | 09:43 |
| Yanyanhu | understand | 09:44 |
| Yanyanhu | so we keep this 'context/session' param | 09:44 |
| Yanyanhu | hi, Qiming, actually about the refactoring about context usage in senlin service, my only concern is 'oslo context' could be bonded with other oslo lib like 'oslo.messaging' or 'oslo.db' more and more tightly | 09:44 |
| Qiming | any evidence on that? | 09:45 |
| Qiming | they are different projects | 09:45 |
| Yanyanhu | one thing is the context serialization/deserializatoin in oslo.messaing | 09:45 |
| Qiming | it would be very hard for them to make disruptive change now | 09:45 |
| Yanyanhu | and also some context usage in DB | 09:45 |
| Yanyanhu | hope they don't do this kind of work | 09:47 |
| Yanyanhu | since it could make the context more and more complicated | 09:47 |
| Yanyanhu | you can even find a property name as 'show_deleted' in oslo context base. This is weird I think | 09:48 |
| Yanyanhu | and also read_only. Don't know what this property for | 09:50 |
| Qiming | we don't use it | 09:52 |
| Qiming | we delete the usage of 'context.show_deleted' | 09:52 |
| Yanyanhu | yes, it shouldn't belong to context | 09:52 |
| Qiming | the reason is that we are doing asynchronous execution | 09:52 |
| Yanyanhu | I think | 09:52 |
| *** Yanyanhu has quit IRC | 10:01 | |
| *** Yanyanhu has joined #senlin | 10:01 | |
| openstackgerrit | Yanyan Hu proposed stackforge/senlin: [WIP]Add functional test for cluster resize https://review.openstack.org/222105 | 10:08 |
| *** Yanyanhu has quit IRC | 10:12 | |
| *** Qiming has quit IRC | 10:28 | |
| *** lixinhui has quit IRC | 10:33 | |
| *** zhenguo has quit IRC | 10:33 | |
| openstackgerrit | xu-haiwei proposed stackforge/senlin: Fix trust parameter error https://review.openstack.org/222060 | 10:40 |
| *** Qiming has joined #senlin | 11:32 | |
| openstackgerrit | LiuWei proposed stackforge/senlin: (WIP) cross-az policy https://review.openstack.org/221684 | 11:41 |
| *** LiuWei has quit IRC | 12:11 | |
| *** Qiming has quit IRC | 12:50 | |
| *** jdandrea has joined #senlin | 13:03 | |
| *** zhenguo has joined #senlin | 13:11 | |
| *** jruano has joined #senlin | 14:14 | |
| *** jruano_ has joined #senlin | 14:35 | |
| *** jruano has quit IRC | 14:38 | |
| *** jruano_ has quit IRC | 15:06 | |
| *** zhenguo has quit IRC | 17:07 | |
| *** xuhaiwei has quit IRC | 23:31 | |
| *** xuhaiwei has joined #senlin | 23:38 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!