19:02:26 <lbragstad> #startmeeting keystone-office-hours 19:02:27 <openstack> Meeting started Tue Jan 16 19:02:26 2018 UTC and is due to finish in 60 minutes. The chair is lbragstad. Information about MeetBot at http://wiki.debian.org/MeetBot. 19:02:28 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 19:02:31 <openstack> The meeting name has been set to 'keystone_office_hours' 19:08:56 <cmurphy> kmalloc: can you show me an example of one of our tables that use an int as the PK? checking a few the only one i've found so far is password which isn't exposed publicly 19:09:06 <kmalloc> sure. 19:09:07 <kmalloc> sec. 19:10:42 <kmalloc> most are the new tables 19:10:57 <kmalloc> aka, localuser nonlocaluser, etc, this is all because the rest is historical 19:11:07 <kmalloc> and changing the id/pk structure is hard(tm) 19:12:07 <cmurphy> kmalloc: are you suggesting that the ID that's exposed to the user should be an int rather than a uuid? or you want two columns? 19:12:20 <kmalloc> no, two columns 19:12:27 <cmurphy> okay 19:12:51 <kmalloc> the int PK should just be used internal PK, and referenced for FKs etc as needed 19:13:07 <kmalloc> but converting to the user, the app_cred_id the user sees is "uuid" 19:13:19 <kmalloc> and the int pk is always stripped 19:13:54 <kmalloc> i wont be too picky if you don't want to do this. 19:14:16 <kmalloc> it is just a better mechanism for the RDBMS backends. 19:14:24 <cmurphy> no that all sounds fine, i was going to object if you were wanting the external ID to be an int 19:15:43 <kmalloc> nope, 100% should not expose the PK as an int :) 19:16:08 <kmalloc> should be a separate id that is "user-friendly/unique" for whatever value uuid is user-friendly 19:24:14 <ayoung> jamielennox, or anyone that can answer for him...I was creating a session in some resurrected code using keystoneclient.auth.Session...specificallty, I need the arg parse stuff. Do we have comparable examples for keystoneauth1? 19:28:37 <ayoung> keystoneauth1.loading.cli.register_argparse_arguments( something? 19:34:28 <kmalloc> cli arg parsing? 19:35:13 <kmalloc> ayoung: https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/loading/cli.py#L32 and https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/loading/cli.py#L77 19:35:27 <kmalloc> register adds the values to argparse 19:35:55 <kmalloc> so you pass your parser and the ARGV in 19:36:28 <kmalloc> and then the load_from_argparse does the plugin magic based upon the compiled argparse results 19:40:00 <ayoung> kmalloc, right...what do I need to do to call that? 19:40:03 <ayoung> before I had 19:40:37 <ayoung> https://github.com/admiyo/ossipee/blob/master/ossipee-inventory.py#L9 19:40:43 <ayoung> kmalloc, ^^ 19:41:00 <ayoung> seems like there is one more call there than there should be 19:41:15 <kmalloc> hmm. 19:41:27 <ayoung> that was keystone client,. based on jamielennox 19:41:30 <ayoung> 's example 19:41:41 <ayoung> so I would think I would be mapping one to one with ksa 19:42:14 <ayoung> AttributeError: module 'keystoneauth1.loading.adapter' has no attribute 'load_from_argparse_arguments' 19:42:24 <ayoung> So it is something different 19:43:28 <ayoung> and the warning I got on the old code was 19:43:43 <ayoung> UserWarning: Using keystoneclient sessions has been deprecated. Please update your software to use keystoneauth1. 19:43:51 <ayoung> so something to make a ksa session, I think 19:47:46 <openstackgerrit> Colleen Murphy proposed openstack/keystone master: Add application credentials db migration https://review.openstack.org/524927 19:48:12 <ayoung> argparse.ArgumentError: argument --os-auth-type/--os-auth-plugin: conflicting option strings: --os-auth-type, --os-auth-plugin 19:48:15 <ayoung> hmmm 19:52:44 <kmalloc> that sounds like you've registered multiple times 19:54:40 <ayoung> kmalloc, got successful code for doing this? 19:55:38 <kmalloc> not on hand 19:58:51 <openstackgerrit> Colleen Murphy proposed openstack/keystone master: Add application credentials driver https://review.openstack.org/524928 20:01:36 <ayoung> maybe we need to say jamielennox 's names 3 times to summon him 20:09:25 <openstackgerrit> Merged openstack/keystone master: Implement controller logic for system user assignments https://review.openstack.org/515215 20:14:08 <gagehugo> o/ 20:39:51 <openstackgerrit> Lance Bragstad proposed openstack/keystoneauth master: Implement system scope https://review.openstack.org/529665 20:41:02 <lbragstad> cmurphy: jamielennox ^ my ksa system scope patch 20:41:13 <lbragstad> i reworked it to expect a string instead of a boolnea 20:41:16 <lbragstad> boolean* 20:43:44 <ayoung> kmalloc, I wonder if I should just jump to using osc-lib 20:44:45 <ayoung> looks like it goes too far in the init process, won't let me controll the parts I need before parsing, etc, but I can probably duplicate what iti is doing 20:57:36 <ayoung> dtroyer, I was trying to update some code that origianlly followed jamielennox 's approach to creating a sessions, but it has bit rotted. As I track what is going on now, I wonder if I should be using osc-lib 20:58:07 <ayoung> the code is mostly neutron and nova calls for setting up and tearing down a development environ, and I might decided to redo it using shade. 20:58:15 <gagehugo> lbragstad not sure where exactly, but that is probably something good to document 20:58:33 <lbragstad> gagehugo: yeah 20:58:38 <lbragstad> dev docs maybe? 20:58:40 <gagehugo> I feel like that may have gotten brought up for tags as well before we nix'd the id 20:58:54 <gagehugo> sure 20:59:03 <lbragstad> oh - that's right, because tag name and project were unique.. 20:59:07 <ayoung> kmalloc, if I use shade, is there a way I can keep the passwords out of config files? 20:59:11 <lbragstad> so no id required 21:00:14 <gagehugo> ye 21:04:51 <openstackgerrit> Colleen Murphy proposed openstack/keystone master: Add application credentials driver https://review.openstack.org/524928 21:08:20 <mordred> ayoung: the os_client_config.Config constructor supports a pw_func parameter which is a function to call in the case of a missing password 21:10:15 <mordred> ayoung: which, incidentally, is what osc-lib uses to prompt you for a password 21:10:46 <ayoung> mordred, so the thing I liked about creaing a session from cli args is that it get OS_PASSWORD implicitly. 21:11:05 <mordred> ah - yes. if that's all you want it's even easier 21:11:08 <ayoung> so people source the same .rc file as they do for cli calls, but then called my code instead 21:11:33 <ayoung> I'm really trying to not rewrite my 4 year old code 21:11:44 <openstackgerrit> Lance Bragstad proposed openstack/oslo.policy master: Move _capture_stdout to a common place https://review.openstack.org/534440 21:11:53 <mordred> yah. please don't resurrect any additional ways of creating keystone sessions - we've got that very well covered now :) 21:12:10 <ayoung> actually, last commit was Mar 17, 2016 21:12:39 <mordred> ayoung: all of the helper factory functions in os_client_config/__init__.py support passing in an argparse instance 21:13:10 <mordred> ayoung: and will register the common argparse options for you, then os_client_config will consume them when creating the config object 21:13:56 <ayoung> mordred, let me cut to the chase. I need a novaclient and a neutron client from environ vars 21:14:02 <openstackgerrit> Lance Bragstad proposed openstack/oslo.policy master: Move _capture_stdout to a common place https://review.openstack.org/534440 21:14:24 <mordred> yup. that's SUPER easy 21:14:52 <ayoung> https://docs.openstack.org/os-client-config/latest/user/using.html something off there? 21:15:02 <mordred> ayoung: do you specifically want an instance of python-novaclient and python-neutronclient? or do you want ksa Adapters to make REST calls on them? 21:15:15 <ayoung> um.... 21:15:30 <ayoung> I was working with python-nova and pythonneutron clients 21:15:37 <mordred> gotcha. 21:15:48 <openstackgerrit> Colleen Murphy proposed openstack/keystone master: Add Application Credentials manager https://review.openstack.org/524747 21:15:50 <mordred> so for that, you want https://docs.openstack.org/os-client-config/latest/user/using.html#constructing-legacy-client-objects 21:15:50 <ayoung> from novaclient import client as novaclient 21:15:53 <mordred> yah 21:16:00 <mordred> I mean- I'd avoid using that myself 21:16:14 <mordred> but if that's what you want, we got you covered :) 21:16:18 <ayoung> mordred, this code is almost old enough to buy cigaretts 21:16:27 <ayoung> just trying to get it working again 21:16:43 <ayoung> if I end up doing too much work, I'll redo it as an ansible playbook 21:16:45 <mordred> the simplest way is nova = os_client_config.make_client('compute', cloud='envvars') 21:16:59 <mordred> that'll get youa novaclient.Client from OS_ env vars 21:17:01 <ayoung> ++ 21:17:05 <ayoung> I'll try that, thanks 21:17:18 <mordred> you can get fancier if you need to - like if you also want to support argparse arguments 21:18:16 <mordred> ayoung: nova = os_client_config.make_client('compute', cloud='envvars', options=Some_argparse_namespace_object) 21:18:37 <mordred> ayoung: let me know if you run in to any issues - the use case you describe should be pretty solid 21:20:32 <openstackgerrit> Colleen Murphy proposed openstack/keystone master: Add application credentials db migration https://review.openstack.org/524927 21:20:33 <openstackgerrit> Colleen Murphy proposed openstack/keystone master: Add application credentials driver https://review.openstack.org/524928 21:20:33 <openstackgerrit> Colleen Murphy proposed openstack/keystone master: Add Application Credentials manager https://review.openstack.org/524747 21:20:33 <mordred> os_client_config.make_client('compute', cloud='envvars', options=argparse.ArgumentParser()) will do the trick if you don't have any _other_ argparse items to add 21:20:34 <openstackgerrit> Colleen Murphy proposed openstack/keystone master: Add Application Credentials controller https://review.openstack.org/524423 21:20:34 <openstackgerrit> Colleen Murphy proposed openstack/keystone master: Add application credential auth plugin https://review.openstack.org/525346 21:20:35 <openstackgerrit> Colleen Murphy proposed openstack/keystone master: Allow overriding app cred restrictions https://review.openstack.org/533431 21:20:35 <openstackgerrit> Colleen Murphy proposed openstack/keystone master: Add api-ref for application credentials https://review.openstack.org/533744 22:00:35 <openstackgerrit> Lance Bragstad proposed openstack/oslo.policy master: Render deprecated policy names when generating files https://review.openstack.org/532685 22:00:44 <lbragstad> whew - barely beat the buzzer! 22:00:47 <lbragstad> #endmeeting