)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0cecb8299b4b4d3d9a40ea12f37a5e13c4452f6d","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Keystoneauth compares the roles of the service_user with"},{"line_number":10,"context_line":"[Keystone_authtoken]/service_token_roles, we need to explain this so"},{"line_number":11,"context_line":"that users don\u0027t get confused."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: I024885adad2d14bc2568382c677198132dc88a13"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5fc1f717_7756365f","line":11,"updated":"2019-03-11 15:18:05.000000000","message":"I don\u0027t think this is quite correct. Keystoneauth is a library that doesn\u0027t care about [keystone_authtoken]. Keystonemiddleware is what uses the values in [keystone_authtoken] and doesn\u0027t care about what\u0027s in [service_user].\n\nWhat I\u0027m struggling to understand is why nova implements [service_user] when this functionality should be available through the user set in [keystone_authtoken] for keystonemiddleware? If I can figure out why this functionality is duplicated then I could say better whether this change makes sense.","commit_id":"b6530801b62d53d5ba7a91526753c615bf0adbfb"},{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"f349eb9df314168b550083c7e79c85337cd65a9d","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Keystoneauth compares the roles of the service_user with"},{"line_number":10,"context_line":"[Keystone_authtoken]/service_token_roles, we need to explain this so"},{"line_number":11,"context_line":"that users don\u0027t get confused."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: I024885adad2d14bc2568382c677198132dc88a13"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5fc1f717_5613f35c","line":11,"in_reply_to":"5fc1f717_7756365f","updated":"2019-03-11 23:06:31.000000000","message":"IIUC, the service_user in nova is for when nova is talking to *other* services (cinder, neutron, etc). So...","commit_id":"b6530801b62d53d5ba7a91526753c615bf0adbfb"},{"author":{"_account_id":27614,"name":"ya.wang","email":"me@littleya.com","username":"ya.wang"},"change_message_id":"967aa3144c1602fca5b7da42a95271f0ed27c8ab","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Keystoneauth compares the roles of the service_user with"},{"line_number":10,"context_line":"[Keystone_authtoken]/service_token_roles, we need to explain this so"},{"line_number":11,"context_line":"that users don\u0027t get confused."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: I024885adad2d14bc2568382c677198132dc88a13"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5fc1f717_8a14c84f","line":11,"in_reply_to":"5fc1f717_7756365f","updated":"2019-03-12 07:05:18.000000000","message":"Oh, this is my mistake, the compare should happen in keystonemiddleware.\n\nAnd eric is correct, for example:\nNova send request to neutron with both service_user_token and user_token, neutron first sends them to keystonemiddleware for authentication, keystonemiddleware will compare service_user\u0027s role with [keystone_authtoken]/service_token_roles which configured in neutron, then decide whether to fetch user_token based on the result.\n\nPlease ref here to view the code: https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L374","commit_id":"b6530801b62d53d5ba7a91526753c615bf0adbfb"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"fd3d7beeaaae9539e1e199a2143508633c0e3aad","unresolved":false,"context_lines":[{"line_number":13,"context_line":"For example:"},{"line_number":14,"context_line":"Nova send request to neutron with both service_user_token and"},{"line_number":15,"context_line":"user_token, neutron first sends them to Keystonemiddleware for"},{"line_number":16,"context_line":"authenrication, Keystonemiddleware will compare service_user\u0027s role"},{"line_number":17,"context_line":"with [Keystone_authtoken]/service_token_roles which configured in"},{"line_number":18,"context_line":"neutron, then decide whether to fetch user_token based on the result."},{"line_number":19,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"5fc1f717_890dac3f","line":16,"range":{"start_line":16,"start_character":0,"end_line":16,"end_character":14},"updated":"2019-04-05 23:30:57.000000000","message":"authentication","commit_id":"fa07df1e99eb751a9f9739c0e0851c8f20b30b00"}],"doc/source/admin/support-compute.rst":[{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"fa0121dc4799f4bb2d7b765a2f5c4b94b74013df","unresolved":false,"context_lines":[{"line_number":530,"context_line":".. note::"},{"line_number":531,"context_line":""},{"line_number":532,"context_line":"   Please note that the role of the :oslo.config:group:`service_user` you"},{"line_number":533,"context_line":"   configured need to be a superset of"},{"line_number":534,"context_line":"   :oslo.config:option:`keystone_authtoken.service_token_roles`."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5fc1f717_a128dde1","line":533,"range":{"start_line":533,"start_character":3,"end_line":533,"end_character":18},"updated":"2019-03-11 13:19:36.000000000","message":"configure needs","commit_id":"b6530801b62d53d5ba7a91526753c615bf0adbfb"},{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"f349eb9df314168b550083c7e79c85337cd65a9d","unresolved":false,"context_lines":[{"line_number":531,"context_line":""},{"line_number":532,"context_line":"   Please note that the role of the :oslo.config:group:`service_user` you"},{"line_number":533,"context_line":"   configured need to be a superset of"},{"line_number":534,"context_line":"   :oslo.config:option:`keystone_authtoken.service_token_roles`."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5fc1f717_161d6b65","line":534,"updated":"2019-03-11 23:06:31.000000000","message":"...perhaps this needs to clarify that it\u0027s the service_token_roles in the *other services\u0027* confs?","commit_id":"b6530801b62d53d5ba7a91526753c615bf0adbfb"},{"author":{"_account_id":27614,"name":"ya.wang","email":"me@littleya.com","username":"ya.wang"},"change_message_id":"967aa3144c1602fca5b7da42a95271f0ed27c8ab","unresolved":false,"context_lines":[{"line_number":531,"context_line":""},{"line_number":532,"context_line":"   Please note that the role of the :oslo.config:group:`service_user` you"},{"line_number":533,"context_line":"   configured need to be a superset of"},{"line_number":534,"context_line":"   :oslo.config:option:`keystone_authtoken.service_token_roles`."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5fc1f717_85a59b06","line":534,"in_reply_to":"5fc1f717_161d6b65","updated":"2019-03-12 07:05:18.000000000","message":"Yes, now this only affects there services: cinder, glance and neutron, so we need explain this.","commit_id":"b6530801b62d53d5ba7a91526753c615bf0adbfb"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"6c283aa41fbecd2b5173c4c20425a727ab075de1","unresolved":false,"context_lines":[{"line_number":533,"context_line":"  configure needs to be a superset of"},{"line_number":534,"context_line":"  :oslo.config:option:`keystone_authtoken.service_token_roles` (The option"},{"line_number":535,"context_line":"  :oslo.config:option:`keystone_authtoken.service_token_roles` is configured"},{"line_number":536,"context_line":"  in cinder, glance and neutron)."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5fc1f717_5b3dc6db","line":536,"range":{"start_line":536,"start_character":5,"end_line":536,"end_character":31},"updated":"2019-03-30 15:57:50.000000000","message":"We use generic common tooling for getting the keystoneauth adapter which has these ksa options, so wouldn\u0027t ironic and castellan (barbican), and placement also be in this list?","commit_id":"fa07df1e99eb751a9f9739c0e0851c8f20b30b00"},{"author":{"_account_id":27614,"name":"ya.wang","email":"me@littleya.com","username":"ya.wang"},"change_message_id":"25c42ab3ff6122124246f41f5738c10973d85137","unresolved":false,"context_lines":[{"line_number":533,"context_line":"  configure needs to be a superset of"},{"line_number":534,"context_line":"  :oslo.config:option:`keystone_authtoken.service_token_roles` (The option"},{"line_number":535,"context_line":"  :oslo.config:option:`keystone_authtoken.service_token_roles` is configured"},{"line_number":536,"context_line":"  in cinder, glance and neutron)."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5fc1f717_8ac43110","line":536,"range":{"start_line":536,"start_character":5,"end_line":536,"end_character":31},"in_reply_to":"5fc1f717_5b3dc6db","updated":"2019-04-01 06:10:50.000000000","message":"Thanks for review. Now only cinder, glance and neutron will receive service token from nova.\n\nReferences:\nhttps://github.com/openstack/nova/blob/stable%2Fstein/nova/service_auth.py#L33\nhttps://github.com/openstack/nova/blob/stable%2Fstein/nova/volume/cinder.py#L101\nhttps://github.com/openstack/nova/blob/stable%2Fstein/nova/image/glance.py#L69\nhttps://github.com/openstack/nova/blob/stable%2Fstein/nova/network/neutronv2/api.py#L162","commit_id":"fa07df1e99eb751a9f9739c0e0851c8f20b30b00"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"fd3d7beeaaae9539e1e199a2143508633c0e3aad","unresolved":false,"context_lines":[{"line_number":533,"context_line":"  configure needs to be a superset of"},{"line_number":534,"context_line":"  :oslo.config:option:`keystone_authtoken.service_token_roles` (The option"},{"line_number":535,"context_line":"  :oslo.config:option:`keystone_authtoken.service_token_roles` is configured"},{"line_number":536,"context_line":"  in cinder, glance and neutron)."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5fc1f717_291fd86c","line":536,"range":{"start_line":536,"start_character":5,"end_line":536,"end_character":31},"in_reply_to":"5fc1f717_80cde487","updated":"2019-04-05 23:30:57.000000000","message":"\u003e IIUC, service_auth is used/useful when an API call might take a really long time, which shouldn\u0027t happen with placement for sure. Ironic, I\u0027m not so sure, but I guess it\u0027s not an issue since... we\u0027re not doing it.\n\nYeah true.","commit_id":"fa07df1e99eb751a9f9739c0e0851c8f20b30b00"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"fd3d7beeaaae9539e1e199a2143508633c0e3aad","unresolved":false,"context_lines":[{"line_number":533,"context_line":"  configure needs to be a superset of"},{"line_number":534,"context_line":"  :oslo.config:option:`keystone_authtoken.service_token_roles` (The option"},{"line_number":535,"context_line":"  :oslo.config:option:`keystone_authtoken.service_token_roles` is configured"},{"line_number":536,"context_line":"  in cinder, glance and neutron)."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5fc1f717_091a1c7c","line":536,"range":{"start_line":536,"start_character":5,"end_line":536,"end_character":31},"in_reply_to":"5fc1f717_8ac43110","updated":"2019-04-05 23:30:57.000000000","message":"\u003e Thanks for review. Now only cinder, glance and neutron will receive\n \u003e service token from nova.\n \u003e \n \u003e References:\n \u003e https://github.com/openstack/nova/blob/stable%2Fstein/nova/service_auth.py#L33\n \u003e https://github.com/openstack/nova/blob/stable%2Fstein/nova/volume/cinder.py#L101\n \u003e https://github.com/openstack/nova/blob/stable%2Fstein/nova/image/glance.py#L69\n \u003e https://github.com/openstack/nova/blob/stable%2Fstein/nova/network/neutronv2/api.py#L162\n\nAh OK thanks for the references for clarity.","commit_id":"fa07df1e99eb751a9f9739c0e0851c8f20b30b00"},{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"85475e1ef1d35be1b0bfde95c01fddc2397da029","unresolved":false,"context_lines":[{"line_number":533,"context_line":"  configure needs to be a superset of"},{"line_number":534,"context_line":"  :oslo.config:option:`keystone_authtoken.service_token_roles` (The option"},{"line_number":535,"context_line":"  :oslo.config:option:`keystone_authtoken.service_token_roles` is configured"},{"line_number":536,"context_line":"  in cinder, glance and neutron)."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5fc1f717_80cde487","line":536,"range":{"start_line":536,"start_character":5,"end_line":536,"end_character":31},"in_reply_to":"5fc1f717_8ac43110","updated":"2019-04-01 20:11:08.000000000","message":"True story.\n\nBarbican never got ksa integration.\n\nIIUC, service_auth is used/useful when an API call might take a really long time, which shouldn\u0027t happen with placement for sure. Ironic, I\u0027m not so sure, but I guess it\u0027s not an issue since... we\u0027re not doing it.","commit_id":"fa07df1e99eb751a9f9739c0e0851c8f20b30b00"}]}