)]}'
{"specs/keystone/queens/auth-response-restrict-catalog.rst":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"3a28acb7d7a234ca6899a59530ab5afc622af5b1","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Problem Description"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Currently when authenticating, the default response will return the complete"},{"line_number":28,"context_line":"service catalog.  In a common usage scenario it\u0027s likely that the client only"},{"line_number":29,"context_line":"actually cares about one service-type and one region, and it is a waste of time"},{"line_number":30,"context_line":"and compute power to fetch all the endpoints, build them into a response, send"},{"line_number":31,"context_line":"the response, and have the client search the response for the information they"},{"line_number":32,"context_line":"actually care about.  This will be most visible when there are a large number"},{"line_number":33,"context_line":"of regions."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f4e5783_be475277","line":33,"range":{"start_line":27,"start_character":0,"end_line":33,"end_character":11},"updated":"2017-10-17 20:06:15.000000000","message":"Please back up the assertions on speed/cost/etc.\n\nThis really feels like optimization for the sake of human consumption (not computer) consumption of the catalog. If we have concrete benefits encoded in the spec (it doesn\u0027t need to be in-depth, just show what the benefit is) it would help.","commit_id":"2f63b9705aee0bde0dbe02f49ff35cc20b037367"},{"author":{"_account_id":8768,"name":"Chris Friesen","email":"chris.friesen@windriver.com","username":"cbf123"},"change_message_id":"b4079b63468fcbff9421fe9f62e3d703795fdcdb","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Problem Description"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Currently when authenticating, the default response will return the complete"},{"line_number":28,"context_line":"service catalog.  In a common usage scenario it\u0027s likely that the client only"},{"line_number":29,"context_line":"actually cares about one service-type and one region, and it is a waste of time"},{"line_number":30,"context_line":"and compute power to fetch all the endpoints, build them into a response, send"},{"line_number":31,"context_line":"the response, and have the client search the response for the information they"},{"line_number":32,"context_line":"actually care about.  This will be most visible when there are a large number"},{"line_number":33,"context_line":"of regions."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f4e5783_d5d8a853","line":33,"range":{"start_line":27,"start_character":0,"end_line":33,"end_character":11},"in_reply_to":"5f4e5783_be475277","updated":"2017-10-17 23:52:25.000000000","message":"Just did a test.  I started out with one region with 13 endpoints.  I ran \"openstack endpoint list\" and the keystone logs showed:\n\nPOST /identity/v3/auth/tokens \u003d\u003e generated 3704 bytes in 112 msecs\nPOST /identity/v3/auth/tokens \u003d\u003e generated 3704 bytes in 24 msecs\nGET /identity/v3/endpoints \u003d\u003e generated 4388 bytes in 12 msecs\n\n\nI then made 19 new regions and duplicated the endpoints in each, then ran \"openstack endpoint list --region RegionOne\".  This time the keystone logs showed:\n\nPOST /identity/v3/auth/tokens \u003d\u003e generated 42009 bytes in 135 msecs\nPOST /identity/v3/auth/tokens \u003d\u003e generated 42009 bytes in 29 msecs\nGET /identity/v3/endpoints?region_id\u003dRegionOne \u003d\u003e generated 4408 bytes in 14 msecs\n\nThis works out to roughly a 17% reduction in POST time on the server, and roughly 14% reduction in the GET call on the server.\n\nI tried a few more times and the results are essentially repeatable.\n\nSo I guess the question is whether it\u0027s worth the effort for this amount of savings, especially when it looks like we\u0027re currently issuing redundant calls and removing those would make a bigger difference.","commit_id":"2f63b9705aee0bde0dbe02f49ff35cc20b037367"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c78d116aed08d1456f70ea3096bebbc2c4858cbc","unresolved":false,"context_lines":[{"line_number":47,"context_line":"matching endpoints will be returned in the service catalog."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Modified API Calls"},{"line_number":50,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"**Request:** ``POST /v3/auth/tokens``"},{"line_number":53,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f4e5783_aab15049","line":50,"updated":"2017-10-17 17:44:36.000000000","message":"We should note that this won\u0027t result in a new type of token. The token will be scoped to a project, but the catalog will be different. This should allow the token to be used to get a full service catalog or a subset of the service catalog for another region, etc...\n\nI just don\u0027t want folks to think we\u0027re introducing another token type for each possible permutation of the catalog.","commit_id":"2f63b9705aee0bde0dbe02f49ff35cc20b037367"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c78d116aed08d1456f70ea3096bebbc2c4858cbc","unresolved":false,"context_lines":[{"line_number":77,"context_line":"------------"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"We could potentially use project-scoped tokens and have different projects in"},{"line_number":80,"context_line":"each region, but that would be gross."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Security Impact"},{"line_number":83,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f4e5783_aac830a5","line":80,"range":{"start_line":80,"start_character":13,"end_line":80,"end_character":37},"updated":"2017-10-17 17:44:36.000000000","message":"Yeah - we\u0027ve typically had distaste for filtering the service catalog based on the project assignments. This would be a good opportunity to elaborate on why. In my opinion, it doesn\u0027t really enforce security since it\u0027s only providing security through obscurity. Getting Morgan\u0027s take on this would be useful to document as well, since I know he has opinions on it.","commit_id":"2f63b9705aee0bde0dbe02f49ff35cc20b037367"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"199e8b69aa1be3feaee0acd609cb30890f0f621c","unresolved":false,"context_lines":[{"line_number":77,"context_line":"------------"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"We could potentially use project-scoped tokens and have different projects in"},{"line_number":80,"context_line":"each region, but that would be gross."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Security Impact"},{"line_number":83,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f4e5783_7971f475","line":80,"range":{"start_line":80,"start_character":13,"end_line":80,"end_character":37},"in_reply_to":"5f4e5783_7e0b1a29","updated":"2017-10-17 20:12:21.000000000","message":"Agreed - I didn\u0027t mean to imply security in my comment. Simply that we should take the opportunity to explain *why* we shy away from service catalog filtering and how this specific case is different from that.\n\nWhen this comes up in conversation, we rarely have a documented reason. Trying to avoid tribal knowledge.","commit_id":"2f63b9705aee0bde0dbe02f49ff35cc20b037367"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"3a28acb7d7a234ca6899a59530ab5afc622af5b1","unresolved":false,"context_lines":[{"line_number":77,"context_line":"------------"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"We could potentially use project-scoped tokens and have different projects in"},{"line_number":80,"context_line":"each region, but that would be gross."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Security Impact"},{"line_number":83,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f4e5783_7e0b1a29","line":80,"range":{"start_line":80,"start_character":13,"end_line":80,"end_character":37},"in_reply_to":"5f4e5783_aac830a5","updated":"2017-10-17 20:06:15.000000000","message":"Lance: We need to be explicit that this is *not* for security cases. Filtering the catalog provides zero added security and it and we need to ensure no one assume this would provide any additional layers of security.\n\nThis isn\u0027t really an alternative to the problem. Please remove the alternative.","commit_id":"2f63b9705aee0bde0dbe02f49ff35cc20b037367"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"3a28acb7d7a234ca6899a59530ab5afc622af5b1","unresolved":false,"context_lines":[{"line_number":97,"context_line":"Performance Impact"},{"line_number":98,"context_line":"------------------"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"If the feature is implemented optimally it should reduce the amount of data"},{"line_number":101,"context_line":"returned from the DB which should result in less work to format and send the"},{"line_number":102,"context_line":"service catalog."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Other Deployer Impact"},{"line_number":105,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f4e5783_3e012207","line":102,"range":{"start_line":100,"start_character":0,"end_line":102,"end_character":16},"updated":"2017-10-17 20:06:15.000000000","message":"See above comments. Please provide some metrics to back up this assertion *and* change \"Should\" to \"will\" with the metrics to back this up.","commit_id":"2f63b9705aee0bde0dbe02f49ff35cc20b037367"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c78d116aed08d1456f70ea3096bebbc2c4858cbc","unresolved":false,"context_lines":[{"line_number":130,"context_line":"1. Implement the API changes"},{"line_number":131,"context_line":"2. Add relevent tests"},{"line_number":132,"context_line":"3. Update all appropriate documentation/api-ref"},{"line_number":133,"context_line":"4. Update keystone-client/openstack-cli"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f4e5783_ea3f4884","line":133,"updated":"2017-10-17 17:44:36.000000000","message":"keystoneauth might needs updates as well.","commit_id":"2f63b9705aee0bde0dbe02f49ff35cc20b037367"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"3a28acb7d7a234ca6899a59530ab5afc622af5b1","unresolved":false,"context_lines":[{"line_number":130,"context_line":"1. Implement the API changes"},{"line_number":131,"context_line":"2. Add relevent tests"},{"line_number":132,"context_line":"3. Update all appropriate documentation/api-ref"},{"line_number":133,"context_line":"4. Update keystone-client/openstack-cli"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f4e5783_9915d042","line":133,"in_reply_to":"5f4e5783_ea3f4884","updated":"2017-10-17 20:06:15.000000000","message":"Likely KSA will just need to know the new mechansim to filter (Server side) the catalog. Most of this work could also be done in KSA client-side only.","commit_id":"2f63b9705aee0bde0dbe02f49ff35cc20b037367"}]}