Re: [openstack-dev] Removing Keystoneauth Dependency in Castellan Discussion

2017-12-06 Thread Doug Hellmann
Excerpts from Gage Hugo's message of 2017-12-06 15:16:14 -0600:
> It's been a bit since the summit but I believe this was also discussed at
> the Denver PTG as well:  https://etherpad.openstack.org/p/oslo-ptg-queens
> 
> The keystoneauth stuff seems to be more from Sydney, but if I remember
> correctly, Castellan authenticates through keystoneauth and passes the
> session to barbicanclient.  This is the only use of keystoneauth within
> Castellan, so one idea that was mentioned was to see if Castellan could
> simply pass the credentials to barbicanclient, which would auth through
> keystoneauth instead, removing the dependency from Castellan.

It looks like Castellan tries to authenticate using the token from
the context in two separate cases [1]. That would cause the service
using castellan to connect to barbican as the user making the API
request. Removing the use of keystoneauth would mean that feature
would no longer work, and all requests to barbican would be made
as a hard-coded user.  That seems like a pretty fundamental difference
in behavior.

Which mode is used the most in the services that consume castellan
today?

I'm still not understanding the real motivation for removing the
dependency. Is it just someone's notion of cleaning things up? Or is
there a runtime issue of some sort?

Doug

[1] 
http://git.openstack.org/cgit/openstack/castellan/tree/castellan/key_manager/barbican_key_manager.py#n140

> 
> On Tue, Dec 5, 2017 at 10:54 AM, Doug Hellmann 
> wrote:
> 
> > Excerpts from ARORA, ROHAN's message of 2017-12-05 14:37:49 +:
> > > So from my understanding now, we are wanting to remove the HARD
> > dependency on Keystoneauth, not to remove it completely since that would
> > break the barbican client. Currently seeing if we just remove the
> > dependency from requirements.txt, if that stops Keystoneauth from being
> > used until you try to use the barbican.
> >
> > There would need to be more changes than that, because we still need the
> > package to be installed for testing the Barbican driver.
> >
> > Maybe if someone could explain what the issue is, I can offer more
> > detailed advice. What is wrong with having the keystoneauth dependency?
> > Is it breaking something? Is it interfering with some other library?
> >
> > Doug
> >
> > __
> > OpenStack Development Mailing List (not for usage questions)
> > Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
> > http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
> >

__
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev


Re: [openstack-dev] Removing Keystoneauth Dependency in Castellan Discussion

2017-12-06 Thread Gage Hugo
It's been a bit since the summit but I believe this was also discussed at
the Denver PTG as well:  https://etherpad.openstack.org/p/oslo-ptg-queens

The keystoneauth stuff seems to be more from Sydney, but if I remember
correctly, Castellan authenticates through keystoneauth and passes the
session to barbicanclient.  This is the only use of keystoneauth within
Castellan, so one idea that was mentioned was to see if Castellan could
simply pass the credentials to barbicanclient, which would auth through
keystoneauth instead, removing the dependency from Castellan.

On Tue, Dec 5, 2017 at 10:54 AM, Doug Hellmann 
wrote:

> Excerpts from ARORA, ROHAN's message of 2017-12-05 14:37:49 +:
> > So from my understanding now, we are wanting to remove the HARD
> dependency on Keystoneauth, not to remove it completely since that would
> break the barbican client. Currently seeing if we just remove the
> dependency from requirements.txt, if that stops Keystoneauth from being
> used until you try to use the barbican.
>
> There would need to be more changes than that, because we still need the
> package to be installed for testing the Barbican driver.
>
> Maybe if someone could explain what the issue is, I can offer more
> detailed advice. What is wrong with having the keystoneauth dependency?
> Is it breaking something? Is it interfering with some other library?
>
> Doug
>
> __
> OpenStack Development Mailing List (not for usage questions)
> Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
>
__
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev


Re: [openstack-dev] Removing Keystoneauth Dependency in Castellan Discussion

2017-12-05 Thread Doug Hellmann
Excerpts from ARORA, ROHAN's message of 2017-12-05 14:37:49 +:
> So from my understanding now, we are wanting to remove the HARD dependency on 
> Keystoneauth, not to remove it completely since that would break the barbican 
> client. Currently seeing if we just remove the dependency from 
> requirements.txt, if that stops Keystoneauth from being used until you try to 
> use the barbican.

There would need to be more changes than that, because we still need the
package to be installed for testing the Barbican driver.

Maybe if someone could explain what the issue is, I can offer more
detailed advice. What is wrong with having the keystoneauth dependency?
Is it breaking something? Is it interfering with some other library?

Doug

__
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev


Re: [openstack-dev] Removing Keystoneauth Dependency in Castellan Discussion

2017-12-05 Thread ARORA, ROHAN
So from my understanding now, we are wanting to remove the HARD dependency on 
Keystoneauth, not to remove it completely since that would break the barbican 
client. Currently seeing if we just remove the dependency from 
requirements.txt, if that stops Keystoneauth from being used until you try to 
use the barbican.

Best,
Rohan

-Original Message-
From: Doug Hellmann [mailto:d...@doughellmann.com] 
Sent: Monday, December 04, 2017 4:00 PM
To: openstack-dev <openstack-dev@lists.openstack.org>
Subject: Re: [openstack-dev] Removing Keystoneauth Dependency in Castellan 
Discussion

Excerpts from ARORA, ROHAN's message of 2017-12-04 21:47:45 +:
> Wanted to start a thread to discuss the potential removal of the Keystoneauth 
> dependency from Castellan. Whether it is needed or not, approaches we might 
> want to take, etc.
> From my understanding, Tin, Gage, and Ade discussed this at the Sydney 
> summit, so we were hoping for some details/clarifications before getting to 
> work on it.
> 
> Best,
> Rohan

My understanding is that keystone is used when the barbican driver
is invoked. So I don't understand how we can remove the dependency
completely. We could possibly make it an "extras" so that it is
only installed if the barbican driver is going to be used. Is that
what you mean?

Doug

__
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openstack.org_cgi-2Dbin_mailman_listinfo_openstack-2Ddev=DwIGaQ=LFYZ-o9_HUMeMTSQicvjIg=HrszLFXMaQd7t9slUzbd4w=FujA9G4eVEAZYg6NIXvhNicVpcBdHJAIW-ZRJ2yeNjs=3x2COEHUcYS41wWEg97O9AmICZre8dUTMw_77FOWpeU=
 
__
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev


Re: [openstack-dev] Removing Keystoneauth Dependency in Castellan Discussion

2017-12-04 Thread ARORA, ROHAN
I do believe that was something Tin mentioned after I had talked to him after 
our IRC chat last week. Seems like the right way to go. Tin?

Best,
Rohan

-Original Message-
From: Doug Hellmann [mailto:d...@doughellmann.com] 
Sent: Monday, December 04, 2017 4:00 PM
To: openstack-dev <openstack-dev@lists.openstack.org>
Subject: Re: [openstack-dev] Removing Keystoneauth Dependency in Castellan 
Discussion

Excerpts from ARORA, ROHAN's message of 2017-12-04 21:47:45 +:
> Wanted to start a thread to discuss the potential removal of the Keystoneauth 
> dependency from Castellan. Whether it is needed or not, approaches we might 
> want to take, etc.
> From my understanding, Tin, Gage, and Ade discussed this at the Sydney 
> summit, so we were hoping for some details/clarifications before getting to 
> work on it.
> 
> Best,
> Rohan

My understanding is that keystone is used when the barbican driver
is invoked. So I don't understand how we can remove the dependency
completely. We could possibly make it an "extras" so that it is
only installed if the barbican driver is going to be used. Is that
what you mean?

Doug

__
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openstack.org_cgi-2Dbin_mailman_listinfo_openstack-2Ddev=DwIGaQ=LFYZ-o9_HUMeMTSQicvjIg=HrszLFXMaQd7t9slUzbd4w=FujA9G4eVEAZYg6NIXvhNicVpcBdHJAIW-ZRJ2yeNjs=3x2COEHUcYS41wWEg97O9AmICZre8dUTMw_77FOWpeU=
 
__
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev


Re: [openstack-dev] Removing Keystoneauth Dependency in Castellan Discussion

2017-12-04 Thread Doug Hellmann
Excerpts from ARORA, ROHAN's message of 2017-12-04 21:47:45 +:
> Wanted to start a thread to discuss the potential removal of the Keystoneauth 
> dependency from Castellan. Whether it is needed or not, approaches we might 
> want to take, etc.
> From my understanding, Tin, Gage, and Ade discussed this at the Sydney 
> summit, so we were hoping for some details/clarifications before getting to 
> work on it.
> 
> Best,
> Rohan

My understanding is that keystone is used when the barbican driver
is invoked. So I don't understand how we can remove the dependency
completely. We could possibly make it an "extras" so that it is
only installed if the barbican driver is going to be used. Is that
what you mean?

Doug

__
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev