Re: [openstack-dev] [Glance][Solum] Using os-auth-token and os-image-url with glance client
Steve, Similar to other OpenStack services, Solum client uses the provided/configured username and password of a user to get a token, and sends it to Solum API service in a http header. On the API side, we use keystonemiddleware to validate the token. Upon successful authentication, we store information which we get back from keystone (project-id, username, and token) and use it to instantiate other services' python clients to interact with them (glance, swift, neutron, heat). Let us know if there is a better approach for enabling inter-service interactions. Thanks, Devdatta From: Steve Martinelli <steve...@ca.ibm.com> Sent: Thursday, September 24, 2015 9:01 PM To: OpenStack Development Mailing List (not for usage questions) Subject: Re: [openstack-dev] [Glance][Solum] Using os-auth-token and os-image-url with glance client I can't speak to the glance client changes, but this seems like an awkward design. If you don't know the end user's name and password, then how are you getting the token? Is it the admin token? Why not create a service account and use keystonemiddleware? Thanks, Steve Martinelli OpenStack Keystone Core [Inactive hide details for Devdatta Kulkarni ---2015/09/24 06:44:57 PM---Hi, Glance team, In Solum, we use Glance to store Docke]Devdatta Kulkarni ---2015/09/24 06:44:57 PM---Hi, Glance team, In Solum, we use Glance to store Docker images that we create for applications. We From: Devdatta Kulkarni <devdatta.kulka...@rackspace.com> To: "OpenStack Development Mailing List (not for usage questions)" <openstack-dev@lists.openstack.org> Date: 2015/09/24 06:44 PM Subject: [openstack-dev] [Glance][Solum] Using os-auth-token and os-image-url with glance client Hi, Glance team, In Solum, we use Glance to store Docker images that we create for applications. We use Glance client internally to upload these images. Till recently, 'glance image-create' with only token has been working for us (in devstack). Today, I started noticing that glance image-create with just token is not working anymore. It is also not working when os-auth-token and os-image-url are passed in. According to documentation (http://docs.openstack.org/developer/python-glanceclient/), passing token and image-url should work. The client, which I have installed from master, is asking username (and password, if username is specified). Solum does not have access to end-user's password. So we need the ability to interact with Glance without providing password, as it has been working till recently. I investigated the issue a bit and have filed a bug with my findings. https://bugs.launchpad.net/python-glanceclient/+bug/1499540 Can someone help with resolving this issue. Regards, Devdatta__ OpenStack Development Mailing List (not for usage questions) Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev __ OpenStack Development Mailing List (not for usage questions) Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
Re: [openstack-dev] [Glance][Solum] Using os-auth-token and os-image-url with glance client
Nikhil, Flavio, Thank you for giving immediate attention to this issue. Regards, Devdatta From: Flavio Percoco <fla...@redhat.com> Sent: Friday, September 25, 2015 4:02 AM To: OpenStack Development Mailing List (not for usage questions) Subject: Re: [openstack-dev] [Glance][Solum] Using os-auth-token and os-image-url with glance client On 24/09/15 22:44 +, Devdatta Kulkarni wrote: >Hi, Glance team, > > >In Solum, we use Glance to store Docker images that we create for applications. >We use Glance client internally to upload these images. Till recently, 'glance >image-create' with only token has been > >working for us (in devstack). Today, I started noticing that glance >image-create with just token is not working anymore. It is also not working >when os-auth-token and os-image-url are passed in. According to documentation ( >http://docs.openstack.org/developer/python-glanceclient/), passing token and >image-url should work. The client, which I have installed from master, is >asking username (and password, if username is specified). > > >Solum does not have access to end-user's password. So we need the ability to >interact with Glance without providing password, as it has been working till >recently. > > >I investigated the issue a bit and have filed a bug with my findings. > >https://bugs.launchpad.net/python-glanceclient/+bug/1499540 > > >Can someone help with resolving this issue. > This should fix your issue and we'll backport it to Liberty. https://review.openstack.org/#/c/227723/ Thanks for reporting, Flavio -- @flaper87 Flavio Percoco __ OpenStack Development Mailing List (not for usage questions) Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
Re: [openstack-dev] [Glance][Solum] Using os-auth-token and os-image-url with glance client
On 24/09/15 22:44 +, Devdatta Kulkarni wrote: Hi, Glance team, In Solum, we use Glance to store Docker images that we create for applications. We use Glance client internally to upload these images. Till recently, 'glance image-create' with only token has been working for us (in devstack). Today, I started noticing that glance image-create with just token is not working anymore. It is also not working when os-auth-token and os-image-url are passed in. According to documentation ( http://docs.openstack.org/developer/python-glanceclient/), passing token and image-url should work. The client, which I have installed from master, is asking username (and password, if username is specified). Solum does not have access to end-user's password. So we need the ability to interact with Glance without providing password, as it has been working till recently. I investigated the issue a bit and have filed a bug with my findings. https://bugs.launchpad.net/python-glanceclient/+bug/1499540 Can someone help with resolving this issue. This should fix your issue and we'll backport it to Liberty. https://review.openstack.org/#/c/227723/ Thanks for reporting, Flavio -- @flaper87 Flavio Percoco pgpYK1LGlS_5R.pgp Description: PGP signature __ OpenStack Development Mailing List (not for usage questions) Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
[openstack-dev] [Glance][Solum] Using os-auth-token and os-image-url with glance client
Hi, Glance team, In Solum, we use Glance to store Docker images that we create for applications. We use Glance client internally to upload these images. Till recently, 'glance image-create' with only token has been working for us (in devstack). Today, I started noticing that glance image-create with just token is not working anymore. It is also not working when os-auth-token and os-image-url are passed in. According to documentation (http://docs.openstack.org/developer/python-glanceclient/), passing token and image-url should work. The client, which I have installed from master, is asking username (and password, if username is specified). Solum does not have access to end-user's password. So we need the ability to interact with Glance without providing password, as it has been working till recently. I investigated the issue a bit and have filed a bug with my findings. https://bugs.launchpad.net/python-glanceclient/+bug/1499540 Can someone help with resolving this issue. Regards, Devdatta __ OpenStack Development Mailing List (not for usage questions) Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
Re: [openstack-dev] [Glance][Solum] Using os-auth-token and os-image-url with glance client
Devdatta, Thanks for creating the bug. We should get this fixed. It was opened in the upgrade to 1.x.x. Steve, my guess is that the context is being used to delegate the token to glanceclient and then glance. We have this awkwardness with other openstack services and is cause of much issue for some operations. I am not sure what's the best way Solum should adopt as there seem to be tradeoffs with each approach. In this case however, we should try to fix this for the next release of client. On 9/24/15 10:01 PM, Steve Martinelli wrote: > > I can't speak to the glance client changes, but this seems like an > awkward design. > > If you don't know the end user's name and password, then how are you > getting the token? Is it the admin token? Why not create a service > account and use keystonemiddleware? > > Thanks, > > Steve Martinelli > OpenStack Keystone Core > > Inactive hide details for Devdatta Kulkarni ---2015/09/24 06:44:57 > PM---Hi, Glance team, In Solum, we use Glance to store DockeDevdatta > Kulkarni ---2015/09/24 06:44:57 PM---Hi, Glance team, In Solum, we use > Glance to store Docker images that we create for applications. We > > From: Devdatta Kulkarni <devdatta.kulka...@rackspace.com> > To: "OpenStack Development Mailing List (not for usage questions)" > <openstack-dev@lists.openstack.org> > Date: 2015/09/24 06:44 PM > Subject: [openstack-dev] [Glance][Solum] Using os-auth-token and > os-image-url with glance client > > > > > > Hi, Glance team, > > In Solum, we use Glance to store Docker images that we create for > applications. We use Glance client internally to upload these images. > Till recently, 'glance image-create' with only token has been > working for us (in devstack). Today, I started noticing that glance > image-create with just token is not working anymore. It is also not > working when os-auth-token and os-image-url are passed in. According > to documentation > (_http://docs.openstack.org/developer/python-glan__ceclient/_ > <http://docs.openstack.org/developer/python-glanceclient/>), passing > token and image-url should work. The client, which I have installed > from master, is asking username (and password, if username is specified). > > Solum does not have access to end-user's password. So we need the > ability to interact with Glance without providing password, as it has > been working till recently. > > I investigated the issue a bit and have filed a bug with my findings. > _https://bugs.launchpad.net/python-glanceclient/+bug/1499540_ > > Can someone help with resolving this issue. > > Regards, > Devdatta__ > OpenStack Development Mailing List (not for usage questions) > Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe > http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev > > > > > > __ > OpenStack Development Mailing List (not for usage questions) > Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe > http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev -- Thanks, Nikhil __ OpenStack Development Mailing List (not for usage questions) Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
Re: [openstack-dev] [Glance][Solum] Using os-auth-token and os-image-url with glance client
I can't speak to the glance client changes, but this seems like an awkward
design.
If you don't know the end user's name and password, then how are you
getting the token? Is it the admin token? Why not create a service account
and use keystonemiddleware?
Thanks,
Steve Martinelli
OpenStack Keystone Core
From: Devdatta Kulkarni <devdatta.kulka...@rackspace.com>
To: "OpenStack Development Mailing List (not for usage questions)"
<openstack-dev@lists.openstack.org>
Date: 2015/09/24 06:44 PM
Subject: [openstack-dev] [Glance][Solum] Using os-auth-token and
os-image-url with glance client
Hi, Glance team,
In Solum, we use Glance to store Docker images that we create for
applications. We use Glance client internally to upload these images. Till
recently, 'glance image-create' with only token has been
working for us (in devstack). Today, I started noticing that glance
image-create with just token is not working anymore. It is also not working
when os-auth-token and os-image-url are passed in. According to
documentation (http://docs.openstack.org/developer/python-glanceclient/),
passing token and image-url should work. The client, which I have installed
from master, is asking username (and password, if username is specified).
Solum does not have access to end-user's password. So we need the ability
to interact with Glance without providing password, as it has been working
till recently.
I investigated the issue a bit and have filed a bug with my findings.
https://bugs.launchpad.net/python-glanceclient/+bug/1499540
Can someone help with resolving this issue.
Regards,
Devdatta
__
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
__
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
