2019-08-13 05:55:01 UTC - Marty Wallace: Hey guys does anyone know how to set
the namespace for the `wsk` CLI? The `wsk property set` command doesn’t seem to
accept namespace anymore:
<https://github.com/apache/openwhisk-cli/commit/2d2d6736cb8c9f36b689fcb3247530b1683e0c89>
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565675701479900
----
2019-08-13 05:55:25 UTC - Marty Wallace: I am trying to create an action in an
IBM instance of OpenWhisk where we’re starting to use namespaces
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565675725480600
----
2019-08-13 05:56:57 UTC - Dominic Kim: @Marty WallaceYou can just omit it.
It will be automatically populated based on your auth key.
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565675817481900
----
2019-08-13 05:57:20 UTC - Marty Wallace: That’s where we got to but can’t see
any way to generate an auth key for a particular namespace
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565675840482400
----
2019-08-13 05:57:31 UTC - Marty Wallace: This is getting into IBM territory
rather than OpenWhisk now though
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565675851482900
----
2019-08-13 05:58:21 UTC - Dominic Kim: I believe you can get the auth key for
your namespace from IBM console.
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565675901483900
----
2019-08-13 06:01:14 UTC - Marty Wallace: Hmm you mean somewhere in
<http://cloud.ibm.com/functions|cloud.ibm.com/functions>
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565676074484400
----
2019-08-13 06:01:24 UTC - Marty Wallace: Sorry I can move this to a private
chat with an IBM person
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565676084484700
----
2019-08-13 06:01:30 UTC - Marty Wallace: If there are any takers
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565676090484900
----
2019-08-13 06:10:14 UTC - Dominic Kim: ok it seems clearly IBM cli is still
using `--namespace` flag.
```
$ ibmcloud fn property set --namespace bb43e4f9-d466-4b8a-bfa2-dbca19be95df
```
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565676614485600
----
2019-08-13 06:10:37 UTC - Dominic Kim: But in `wsk` cli there is no such flag
being used.
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565676637486100
----
2019-08-13 06:11:00 UTC - Marty Wallace: Ok, so we’ll have to get the
`ibmcloud` CLI setup in our docker image then
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565676660486500
----
2019-08-13 06:21:02 UTC - Dominic Kim: It seems you can get your auth key with
this command if you already configured your organization and space.
```
$ ibmcloud fn property get --auth
```
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565677262487700
----
2019-08-13 06:21:41 UTC - Dominic Kim: I confirmed it works with `wsk` cli.
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565677301488100
----
2019-08-13 06:21:59 UTC - Dominic Kim: ```
$ wsk property set --apihost
<http://us-south.functions.cloud.ibm.com|us-south.functions.cloud.ibm.com>
--auth XXXXXXXXX
ok: whisk auth set. Run 'wsk property get --auth' to see the new value.
ok: whisk API host set to
<http://us-south.functions.cloud.ibm.com|us-south.functions.cloud.ibm.com>
$ wsk list
Entities in namespace: default
packages
actions
triggers
rules
```
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565677319488500
----
2019-08-13 06:22:27 UTC - Marty Wallace: Oh great so just set the namespace
first as above then use the following one to get the auth key related to that
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565677347489100
----
2019-08-13 06:22:57 UTC - Dominic Kim: Actually, I just logined to ibm cloud
and setup `org` and `space`.
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565677377489600
----
2019-08-13 06:23:19 UTC - Dominic Kim: After then I just used these to get the
required information.
```
$ ibmcloud fn property get --auth
$ ibmcloud fn property get --apihost
```
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565677399490100
----
2019-08-13 06:23:40 UTC - Dominic Kim: I did not configure the namespace like
above.
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565677420490600
----
2019-08-13 06:24:04 UTC - Marty Wallace: How does it know which namespace the
authentication is for?
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565677444490900
----
2019-08-13 06:24:12 UTC - Marty Wallace: If they’re tied together
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565677452491200
----
2019-08-13 06:24:41 UTC - Dominic Kim: The namespace can be uniquely identified
using the auth key.
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565677481492000
----
2019-08-13 06:25:02 UTC - Marty Wallace: Oh does that give a list of auth keys
for each namespace you have
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565677502492400
----
2019-08-13 06:26:43 UTC - Dominic Kim: Hm.. I will defer to IBM guys.
But what I know about OpenWhisk is, there is 1:1 mapping between `{AUTH_KEY}`
and `{NAMESPACE}`, and 1:N mapping between `{SUBJECT}` and `{AUTH_KEY}`.
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565677603493700
----
2019-08-13 06:27:19 UTC - Dominic Kim: So one subject can join multiple
namespaces with different auth_keys.
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565677639494300
----
2019-08-13 06:27:41 UTC - Dominic Kim: And that's the reason why we can
identify a namespace with an auth key.
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565677661494700
----
2019-08-13 06:39:41 UTC - Dominic Kim: More clearly, one subject can have
multiple auth keys which are mapped with one namespace each.
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565678381496400
----
2019-08-13 06:40:09 UTC - Dominic Kim: So we can uniquely identify a namespace
with an auth key but the opposite is not possible.
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565678409497000
----
2019-08-13 06:40:26 UTC - Dominic Kim: So I should say it's not 1:1 mapping
actually.
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565678426497600
----
2019-08-13 06:40:51 UTC - Marty Wallace: I guess the problem I’m having is I
have several namespaces, but the `ibmcloud fn property get --auth` only gives
me the authentication token for the first one
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565678451498000
----
2019-08-13 06:42:04 UTC - Dominic Kim: May be you can try setting `namespace`
explicitly?
```
$ ibmcloud fn property get --help
propertyGetDescription
Usage:
wsk property get [flags]
Flags:
...
--namespace whisk namespace
...
```
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565678524498500
----
2019-08-13 06:42:49 UTC - Jabin Bastian: @Dominic Kim I work with @Marty
Wallace, we're essentially trying to setup a CI pipeline for deployment using
ibm functions
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565678569499500
----
2019-08-13 06:43:21 UTC - Jabin Bastian: ideally we don't want to store any
ibmcloud tokens/credentials in the CI and just use the wsk auth token to do the
deploy
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565678601000200
----
2019-08-13 06:44:05 UTC - Jabin Bastian: but since ibm functions uses a 1 to
many mapping of the wsk auth token it doesn't seem possible with the latest wsk
cli
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565678645001100
----
2019-08-13 06:44:41 UTC - Jabin Bastian: and you can't use the `ibmcloud fn`
command with a wsk auth token alone
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565678681001900
----
2019-08-13 06:46:01 UTC - Dominic Kim: oh is it?
Since I am not a IBM developer, I don't have many ideas on IBM function.
But is it really true that one auth key is shared among many namespaces? rather
than each namespace has its own auth key?
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565678761003300
----
2019-08-13 06:46:58 UTC - Jabin Bastian: from what I can gather yep, in all the
IBM documentation they say to use `ibmcloud fn property set --namespace`
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565678818004700
----
2019-08-13 06:47:22 UTC - Dominic Kim: Could you try getting auth key with
`--namespace` flag?
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565678842005000
----
2019-08-13 06:47:43 UTC - Dominic Kim: `ibmcloud fn property get --auth
--namespace {YOUR_NAMESPACE}`
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565678863005300
----
2019-08-13 06:48:16 UTC - Jabin Bastian:
<https://cloud.ibm.com/docs/openwhisk?topic=cloud-functions-namespaces>
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565678896006300
----
2019-08-13 06:48:40 UTC - Jabin Bastian: yeah, your command returns the same
`whisk auth` for both namespaces
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565678920007000
----
2019-08-13 06:53:32 UTC - Dominic Kim: @Jabin Bastian yes you are correct.
It seems two different namespaces share one auth key.
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565679212007700
----
2019-08-13 06:54:12 UTC - Dominic Kim: ```
$ ibmcloud fn namespace list
name type id
description
dominic.kim@navercorp.com_Naver CF-based dominic.kim@navercorp.com_Naver
dominic.kim@navercorp.com_paas CF-based dominic.kim@navercorp.com_paas
style95-test-ns IAM-based
1c2022a1-6d00-44ee-8265-c86834451ffc
$
$ ibmcloud target -g RESOURCE_GROUP
$ ibmcloud fn property get --auth --namespace style95-test-ns
whisk auth 2edff303-623b-4023-b87e-072452a12801:xx
whisk namespace dominic.kim@navercorp.com_paas
$
$ ibmcloud fn property get --auth --namespace dominic.kim@navercorp.com_paas
whisk auth 2edff303-623b-4023-b87e-072452a12801:xx
whisk namespace dominic.kim@navercorp.com_paas
$ ibmcloud fn property set --namespace style95-test-ns
ok: whisk namespace set to style95-test-ns
$
$ ibmcloud fn property get --auth
whisk auth 2edff303-623b-4023-b87e-072452a12801:xx
$ ibmcloud fn property get --auth --namespace
whisk auth 2edff303-623b-4023-b87e-072452a12801:xx
whisk namespace 1c2022a1-6d00-44ee-8265-c86834451ffc
```
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565679252008200
----
2019-08-13 06:55:48 UTC - Jabin Bastian: yeah it doesn't seem possible to use
in CI without logging into the ibmcloud cli
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565679348009600
----
2019-08-13 06:56:20 UTC - Dominic Kim: I think IBM guys can give more clear
answers.
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565679380010700
----
2019-08-13 06:56:29 UTC - Jabin Bastian: we've tried using a service account to
restrict the IAM permissions but you can't use that with cloud foundry, which
prevents you from using the `cloud-functions` plugin
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565679389011100
----
2019-08-13 06:56:29 UTC - Dominic Kim: Sorry
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565679389011200
----
2019-08-13 06:56:36 UTC - Jabin Bastian: all good
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565679396011400
----
2019-08-13 06:56:55 UTC - Jabin Bastian: do you know by chance if using an
older wsk cli version would work in the mean time?
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565679415012100
----
2019-08-13 06:57:26 UTC - Dominic Kim: All the answers from my side are just
guessing based on Apache OpenWhisk...
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565679446012400
----
2019-08-13 06:58:09 UTC - Jabin Bastian: fair enough, thanks for the help anyway
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565679489013200
----
2019-08-13 06:58:26 UTC - Jabin Bastian: hopefully we'll get a response from
someone in IBM
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565679506013700
----
2019-08-13 09:12:38 UTC - Jabin Bastian: FYI we managed to work around the
problem by creating a service account with just access to that namespace, then
using the `cloud-functions` plugin (wsk cli) for ibmcloud and then we set our
`WskCliNamespaceMode` to `IAM`
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565687558016300
----
2019-08-13 09:13:23 UTC - Jabin Bastian: which overrides the normal whisk auth
and uses the IAM bearer tokens to auth with the ibm whisk api host
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565687603017300
----
2019-08-13 09:15:21 UTC - Jabin Bastian: you'll see
`[.setOpenWhiskCliOverrides]:595:[Inf] setOpenWhiskCliOverrides(): IAM header
overrides set: Authorization ('Bearer XXXXX'); X-Namespace-Id
(xxx-xxx-xxx-xxx-xxxx)` when you do `ibmcloud wsk list -d` if you did it right
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565687721018100
----
2019-08-13 18:16:35 UTC - Raymond Camden: trying to use ibmcloud CLI. I login
ok. I then target a resource group (got the ID from my account). when I do
`ibmcloud fn action list` I get: Unable to obtain the list of actions for
namespace 'default': The supplied authentication is invalid
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565720195019500
----
2019-08-13 18:44:26 UTC - Raymond Camden: what is "bx wsk" ?
https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1565721866019600?thread_ts=1564848589.379500&cid=C3TPCAQG1
----
