Hi David,
admin_domain_name is used at the moment to fill in the domain when missing
in a few cases. The get_credentials method is one of them.
Another two are setting the default domain for the users in tempest.conf
[0], and setting the domain for credentials loaded from a YAML file [1].
[0]
http://git.openstack.org/cgit/openstack/tempest/tree/tempest/config.py#n1246
[1]
http://git.openstack.org/cgit/openstack/tempest/tree/tempest/common/accounts.py#n219
There is also a tenant_isolation_domain_name, which is used when
provisioning v3 isolated credentials.
Because tenant_isolation and pre-provisioned credentials are mutually
exclusive, and to avoid having too many config options, I would suggest to
rename tenant_isolation_domain_name to default_credentials_domain_name (or
something similar), and to use it in [0], [1] and in the code you quoted.
The admin_domain_name would then become fully optional, and it should be
assumed == default_credentials_domain_name unless configured otherwise.
andrea
On Tue, Jul 14, 2015 at 8:49 PM David Kranz wrote:
> Now that the tempest periodic jobs are back (thanks infra!), I was
> looking into the real failures. It seems the main one is caused by the
> fact that the v3 check for primary creds fails if 'admin_domain_name' in
> the identity section is None, which it is when devstack configures
> tempest for non-admin.
>
> The problem is with this code and there is even a comment related to
> this issue. There are various ways to fix this but I'm not sure what the
> value should be for the non-admin case. Andrea, any ideas?
>
> -David
>
> def get_credentials(fill_in=True, identity_version=None, **kwargs):
> params = dict(DEFAULT_PARAMS, **kwargs)
> identity_version = identity_version or CONF.identity.auth_version
> # In case of "v3" add the domain from config if not specified
> if identity_version == 'v3':
> domain_fields = set(x for x in
> auth.KeystoneV3Credentials.ATTRIBUTES
> if 'domain' in x)
> if not domain_fields.intersection(kwargs.keys()):
> # TODO(andreaf) It might be better here to use a dedicated
> config
> # option such as CONF.auth.tenant_isolation_domain_name
> params['user_domain_name'] = CONF.identity.admin_domain_name
> auth_url = CONF.identity.uri_v3
> else:
> auth_url = CONF.identity.uri
> return auth.get_credentials(auth_url,
> fill_in=fill_in,
> identity_version=identity_version,
> **params)
>
>
> __
> OpenStack Development Mailing List (not for usage questions)
> Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
>
__
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
