)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"6bc055aedc3c22a1e4e201c5160b53f7e0d8057f","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"remove re-auth logic for ironic client wrapper"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"We are using keystone session to build ironic client now, keystone"},{"line_number":10,"context_line":"session support to re-auth for expired token, so we don\u0027t need to"},{"line_number":11,"context_line":"re-auth again in client wrapper."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: Ifbb6e19d4e2811ebaafc4e5899e46b13b4520f62"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"7f515b1d_58afeae2","line":10,"range":{"start_line":9,"start_character":58,"end_line":10,"end_character":44},"updated":"2017-09-25 16:20:47.000000000","message":"How is this different than the [service_user] group of config options?","commit_id":"1f45b8374280044454f3c1cc7e0d4b341d2d2baf"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"383b594d9e59a4b2fe8825c6f1da19b70723ac70","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"remove re-auth logic for ironic client wrapper"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"We are using keystone session to build ironic client now, keystone"},{"line_number":10,"context_line":"session support to re-auth for expired token, so we don\u0027t need to"},{"line_number":11,"context_line":"re-auth again in client wrapper."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: Ifbb6e19d4e2811ebaafc4e5899e46b13b4520f62"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"7f515b1d_f871f60d","line":10,"range":{"start_line":9,"start_character":58,"end_line":10,"end_character":44},"in_reply_to":"7f515b1d_58afeae2","updated":"2017-09-25 16:37:29.000000000","message":"To be clear, why do we need service users:\n\nhttps://specs.openstack.org/openstack/nova-specs/specs/ocata/implemented/use-service-tokens.html\n\nIf ksa will just re-auth the user token for us automatically?","commit_id":"1f45b8374280044454f3c1cc7e0d4b341d2d2baf"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7eacb831c61602f09254d249f4c6ab462d97608c","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"remove re-auth logic for ironic client wrapper"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"We are using keystone session to build ironic client now, keystone"},{"line_number":10,"context_line":"session support to re-auth for expired token, so we don\u0027t need to"},{"line_number":11,"context_line":"re-auth again in client wrapper."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: Ifbb6e19d4e2811ebaafc4e5899e46b13b4520f62"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"7f515b1d_5a6a3ab3","line":10,"range":{"start_line":9,"start_character":58,"end_line":10,"end_character":44},"in_reply_to":"7f515b1d_aee0d4cd","updated":"2017-09-25 19:11:18.000000000","message":"Thanks Matthew, that clears it up. I was failing to make the connection that we\u0027re using the [ironic] credentials from nova.conf here rather than the user token.","commit_id":"1f45b8374280044454f3c1cc7e0d4b341d2d2baf"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"aa4f92112c44eee9da8687d08c7878d25d6c5e11","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"remove re-auth logic for ironic client wrapper"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"We are using keystone session to build ironic client now, keystone"},{"line_number":10,"context_line":"session support to re-auth for expired token, so we don\u0027t need to"},{"line_number":11,"context_line":"re-auth again in client wrapper."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: Ifbb6e19d4e2811ebaafc4e5899e46b13b4520f62"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"7f515b1d_aee0d4cd","line":10,"range":{"start_line":9,"start_character":58,"end_line":10,"end_character":44},"in_reply_to":"7f515b1d_f871f60d","updated":"2017-09-25 17:54:57.000000000","message":"For ksa to reauth, it needs to have credentials. Nova will never know an end user\u0027s credentials, so it would never be able to give such to ksa for it to reauth an end user\u0027s API request. Service tokens solve that end-user auth case. Service tokens are also going to be used for more than what they are today, so implementing them for expiration was a step in that direction.\n\nBut the code in question here isn\u0027t about end users, it\u0027s about service users. A session is created and authed using the credentials from the ironic section of the nova conf. That session is cached, so eventually the token will expire and it will need to reauth. Before ksa started doing reauth automatically, nova added this code to cover that. With ksa doing the reauth now, that code should no longer be necessary.","commit_id":"1f45b8374280044454f3c1cc7e0d4b341d2d2baf"}],"nova/virt/ironic/client_wrapper.py":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"acd7a7f4b5604c4b8756174f12e4f2e903f2b34a","unresolved":false,"context_lines":[{"line_number":133,"context_line":"        \"\"\""},{"line_number":134,"context_line":"        retry_on_conflict \u003d kwargs.pop(\u0027retry_on_conflict\u0027, True)"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"        # authentication retry for token expirtion is done in keystone session,"},{"line_number":137,"context_line":"        # other retries are handled by ironicclient starting with 0.8.0"},{"line_number":138,"context_line":"        client \u003d self._get_client(retry_on_conflict\u003dretry_on_conflict)"},{"line_number":139,"context_line":"        return self._multi_getattr(client, method)(*args, **kwargs)"}],"source_content_type":"text/x-python","patch_set":1,"id":"5f2577a7_5355c14f","line":136,"range":{"start_line":136,"start_character":41,"end_line":136,"end_character":50},"updated":"2017-09-11 03:59:29.000000000","message":"nit: expiration*","commit_id":"6b514a0497a8b638fa6f1c6881875be07ce1e9a7"}]}