)]}'
{"specs/api-v3-support.rst":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bc0ae5845a55ef9c1c5cc65f908fd891981a0b5a","unresolved":false,"context_lines":[{"line_number":16,"context_line":"supported, and has deprecated the v2 API (URLs with /v2.0).  The openstack"},{"line_number":17,"context_line":"puppet modules should use this API."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Keystone v3 REST API: http://developer.openstack.org/api-ref-identity-v3.html"},{"line_number":20,"context_line":"Trust extension:"},{"line_number":21,"context_line":"https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-trust-ext.md"},{"line_number":22,"context_line":"and"}],"source_content_type":"text/x-rst","patch_set":4,"id":"da86d52c_01579527","line":19,"updated":"2015-02-06 23:45:22.000000000","message":"These should probably be in the references section.","commit_id":"61f37d42b299c7f41e8b20e13fb64ea6bcde91d3"},{"author":{"_account_id":9983,"name":"Richard Megginson","email":"rmeggins@redhat.com","username":"rmeggins"},"change_message_id":"3ab7e4a02f738d65d87a5e7433874db76223a09c","unresolved":false,"context_lines":[{"line_number":16,"context_line":"supported, and has deprecated the v2 API (URLs with /v2.0).  The openstack"},{"line_number":17,"context_line":"puppet modules should use this API."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Keystone v3 REST API: http://developer.openstack.org/api-ref-identity-v3.html"},{"line_number":20,"context_line":"Trust extension:"},{"line_number":21,"context_line":"https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-trust-ext.md"},{"line_number":22,"context_line":"and"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba7be1f8_b08283fe","line":19,"in_reply_to":"da86d52c_01579527","updated":"2015-02-20 15:15:55.000000000","message":"Done","commit_id":"61f37d42b299c7f41e8b20e13fb64ea6bcde91d3"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bc0ae5845a55ef9c1c5cc65f908fd891981a0b5a","unresolved":false,"context_lines":[{"line_number":120,"context_line":""},{"line_number":121,"context_line":"The URL to use to access the Keystone v3 API is **/v3**.  There are many places"},{"line_number":122,"context_line":"in the current puppet openstack code which have a hard coded url of **/v2.0**."},{"line_number":123,"context_line":"These will have to be changed to use \"/v3\"."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"For trust support, a **keystone_trust** resource will be added.  This resource"},{"line_number":126,"context_line":"will be used to manage trusts.  The openstack command line client is being"}],"source_content_type":"text/x-rst","patch_set":4,"id":"da86d52c_a187a9d6","line":123,"updated":"2015-02-06 23:45:22.000000000","message":"Is /v3 backwards-compatible with everything we\u0027ve implemented via /v2.0 ?","commit_id":"61f37d42b299c7f41e8b20e13fb64ea6bcde91d3"},{"author":{"_account_id":9983,"name":"Richard Megginson","email":"rmeggins@redhat.com","username":"rmeggins"},"change_message_id":"3ab7e4a02f738d65d87a5e7433874db76223a09c","unresolved":false,"context_lines":[{"line_number":120,"context_line":""},{"line_number":121,"context_line":"The URL to use to access the Keystone v3 API is **/v3**.  There are many places"},{"line_number":122,"context_line":"in the current puppet openstack code which have a hard coded url of **/v2.0**."},{"line_number":123,"context_line":"These will have to be changed to use \"/v3\"."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"For trust support, a **keystone_trust** resource will be added.  This resource"},{"line_number":126,"context_line":"will be used to manage trusts.  The openstack command line client is being"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba7be1f8_90e2dfd3","line":123,"in_reply_to":"da86d52c_a187a9d6","updated":"2015-02-20 15:15:55.000000000","message":"Yes, although in some cases the arguments are different.  For example, in v2 there is \"openstack user role add $role --user $user --project $project\" but in v3 this becomes \"openstack role add $role --user $user [--project $project|--domain $domain]\"","commit_id":"61f37d42b299c7f41e8b20e13fb64ea6bcde91d3"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bc0ae5845a55ef9c1c5cc65f908fd891981a0b5a","unresolved":false,"context_lines":[{"line_number":127,"context_line":"extended to support trusts."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Keystone requires a v3 policy file.  The Keystone package provides a base v3"},{"line_number":130,"context_line":"policy file.  The puppet-keystone code will install and configure this file."},{"line_number":131,"context_line":"* Create an \"admin domain\" which is the \"super\" domain holding the"},{"line_number":132,"context_line":"  administrators for all domains in the cloud"},{"line_number":133,"context_line":"* Change \u0027admin_domain_id\u0027 token string in the policy file to the actual id of"}],"source_content_type":"text/x-rst","patch_set":4,"id":"da86d52c_4178adf8","line":130,"updated":"2015-02-06 23:45:22.000000000","message":"Why are the defaults not sufficient for the general use case?","commit_id":"61f37d42b299c7f41e8b20e13fb64ea6bcde91d3"},{"author":{"_account_id":9983,"name":"Richard Megginson","email":"rmeggins@redhat.com","username":"rmeggins"},"change_message_id":"3ab7e4a02f738d65d87a5e7433874db76223a09c","unresolved":false,"context_lines":[{"line_number":127,"context_line":"extended to support trusts."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Keystone requires a v3 policy file.  The Keystone package provides a base v3"},{"line_number":130,"context_line":"policy file.  The puppet-keystone code will install and configure this file."},{"line_number":131,"context_line":"* Create an \"admin domain\" which is the \"super\" domain holding the"},{"line_number":132,"context_line":"  administrators for all domains in the cloud"},{"line_number":133,"context_line":"* Change \u0027admin_domain_id\u0027 token string in the policy file to the actual id of"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba7be1f8_d011b7ad","line":130,"in_reply_to":"da86d52c_4178adf8","updated":"2015-02-20 15:15:55.000000000","message":"The default has the literal string \"admin_domain_id\" which must be replaced with the actual ID of the admin domain.  In addition, keystone has removed the ability to use the admin_token after the v3 policy has been put into effect.  We could probably work around this limitation, but for now, it\u0027s easier just to allow us to continue to use the admin_token to complete the configuration.","commit_id":"61f37d42b299c7f41e8b20e13fb64ea6bcde91d3"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bc0ae5845a55ef9c1c5cc65f908fd891981a0b5a","unresolved":false,"context_lines":[{"line_number":175,"context_line":"Module API impact"},{"line_number":176,"context_line":"-----------------"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"Each API method which is either added or changed should have the following,"},{"line_number":179,"context_line":"depending upon if it is a new class or an addition to an existing class."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"* For new classes:"}],"source_content_type":"text/x-rst","patch_set":4,"id":"da86d52c_21f81949","line":178,"updated":"2015-02-06 23:45:22.000000000","message":"This section should probably be \"None\" or describe new parameters in the manifests instead of using the boilerplate text.","commit_id":"61f37d42b299c7f41e8b20e13fb64ea6bcde91d3"},{"author":{"_account_id":9983,"name":"Richard Megginson","email":"rmeggins@redhat.com","username":"rmeggins"},"change_message_id":"3ab7e4a02f738d65d87a5e7433874db76223a09c","unresolved":false,"context_lines":[{"line_number":175,"context_line":"Module API impact"},{"line_number":176,"context_line":"-----------------"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"Each API method which is either added or changed should have the following,"},{"line_number":179,"context_line":"depending upon if it is a new class or an addition to an existing class."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"* For new classes:"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba7be1f8_d0d617c5","line":178,"in_reply_to":"da86d52c_21f81949","updated":"2015-02-20 15:15:55.000000000","message":"I\u0027m leaving this alone for now and marking the bp as WIP.","commit_id":"61f37d42b299c7f41e8b20e13fb64ea6bcde91d3"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bc0ae5845a55ef9c1c5cc65f908fd891981a0b5a","unresolved":false,"context_lines":[{"line_number":214,"context_line":"End user impact"},{"line_number":215,"context_line":"---------------------"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"Aside from the API, are there other ways a user will interact with this"},{"line_number":218,"context_line":"feature?"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"* Does this change have an impact on python-novaclient? What does the user"}],"source_content_type":"text/x-rst","patch_set":4,"id":"da86d52c_a1a3294e","line":217,"updated":"2015-02-06 23:45:22.000000000","message":"Please include the end user impact instead of using the boilerplate text.","commit_id":"61f37d42b299c7f41e8b20e13fb64ea6bcde91d3"},{"author":{"_account_id":9983,"name":"Richard Megginson","email":"rmeggins@redhat.com","username":"rmeggins"},"change_message_id":"3ab7e4a02f738d65d87a5e7433874db76223a09c","unresolved":false,"context_lines":[{"line_number":214,"context_line":"End user impact"},{"line_number":215,"context_line":"---------------------"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"Aside from the API, are there other ways a user will interact with this"},{"line_number":218,"context_line":"feature?"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"* Does this change have an impact on python-novaclient? What does the user"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba7be1f8_d0ed378d","line":217,"in_reply_to":"da86d52c_a1a3294e","updated":"2015-02-20 15:15:55.000000000","message":"deferring this to later after the bp is no longer WIP","commit_id":"61f37d42b299c7f41e8b20e13fb64ea6bcde91d3"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"b59ff58ac485c39014ce9ef3fd89321db9139e27","unresolved":false,"context_lines":[{"line_number":110,"context_line":"  specified in the Keystone config with the **DEFAULT/default_domain_id**"},{"line_number":111,"context_line":"  configuration parameter."},{"line_number":112,"context_line":"* The v3 api is being used - using a URL ending in \"/v3\" and/or using openstack"},{"line_number":113,"context_line":"  with the --os-identity-api-version 2 flag.  In this case, Keystone will"},{"line_number":114,"context_line":"  **not** implicitly add a default domain - the domain must be explicitly"},{"line_number":115,"context_line":"  specified, either in the resource title (keystone_user { \"admin::domain\" })"},{"line_number":116,"context_line":"  or in a parameter (keystone_user {\"admin\": domain \u003d\u003e \u0027domain\u0027}).  In order to"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a80dd14_cc40160a","line":113,"updated":"2015-03-17 23:07:51.000000000","message":"Typo here, I think this should be --os-identity-api-version 3.","commit_id":"626a253b872fe5792f77f73b890e4b6b86215dc3"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"b59ff58ac485c39014ce9ef3fd89321db9139e27","unresolved":false,"context_lines":[{"line_number":156,"context_line":"lookup the default_domain_id from the config and make this available to the"},{"line_number":157,"context_line":"resource provider.  When this is not possible, the domain will be required,"},{"line_number":158,"context_line":"either as an explicit class parameter (e.g. `domain \u003d\u003e somedomain`) or"},{"line_number":159,"context_line":"implicitly in the name/title::"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"  keystone_user { \u0027user::domain\u0027 }"},{"line_number":162,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a80dd14_8c87fe11","line":159,"updated":"2015-03-17 23:07:51.000000000","message":"+1 but I would like it to be clear that specifying the domain is preferred and reading it from keystone.conf is falling back to legacy behavior, sort of the way reading the token from keystone.conf is a fall-back when credentials aren\u0027t specified.","commit_id":"626a253b872fe5792f77f73b890e4b6b86215dc3"},{"author":{"_account_id":9983,"name":"Richard Megginson","email":"rmeggins@redhat.com","username":"rmeggins"},"change_message_id":"6eeda58eb40ba7e733687fd9ec92793c99595d68","unresolved":false,"context_lines":[{"line_number":156,"context_line":"lookup the default_domain_id from the config and make this available to the"},{"line_number":157,"context_line":"resource provider.  When this is not possible, the domain will be required,"},{"line_number":158,"context_line":"either as an explicit class parameter (e.g. `domain \u003d\u003e somedomain`) or"},{"line_number":159,"context_line":"implicitly in the name/title::"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"  keystone_user { \u0027user::domain\u0027 }"},{"line_number":162,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a80dd14_27a9cddd","line":159,"in_reply_to":"9a80dd14_8c87fe11","updated":"2015-03-17 23:23:18.000000000","message":"Done","commit_id":"626a253b872fe5792f77f73b890e4b6b86215dc3"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"b59ff58ac485c39014ce9ef3fd89321db9139e27","unresolved":false,"context_lines":[{"line_number":176,"context_line":"* Change \"admin_required\": \"role:admin\" to"},{"line_number":177,"context_line":"  \"admin_required\": \"is_admin:1 or role:admin\""},{"line_number":178,"context_line":"* Change \"cloud_admin\": \"rule:admin_required and domain_id:admin_domain_id\" to"},{"line_number":179,"context_line":"  \"cloud_admin\": \"is_admin:1 or (rule:admin_required and domain_id:admin_domain_id)\""},{"line_number":180,"context_line":"* Change \"admin_or_owner\": \"(rule:admin_required and"},{"line_number":181,"context_line":"  domain_id:%(target.token.user.domain.id)s) or rule:owner\" to"},{"line_number":182,"context_line":"  \"admin_or_owner\": \"is_admin:1 or (rule:admin_required and"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a80dd14_6cec8abc","line":179,"updated":"2015-03-17 23:07:51.000000000","message":"(I think?) This implies that we need to create a new admin user cloud_admin. I\u0027m not sure I agree that we need to or should create a new user, maybe more discussion is needed about these plans or the spec could be expanded to talk about this.","commit_id":"626a253b872fe5792f77f73b890e4b6b86215dc3"},{"author":{"_account_id":9983,"name":"Richard Megginson","email":"rmeggins@redhat.com","username":"rmeggins"},"change_message_id":"6eeda58eb40ba7e733687fd9ec92793c99595d68","unresolved":false,"context_lines":[{"line_number":176,"context_line":"* Change \"admin_required\": \"role:admin\" to"},{"line_number":177,"context_line":"  \"admin_required\": \"is_admin:1 or role:admin\""},{"line_number":178,"context_line":"* Change \"cloud_admin\": \"rule:admin_required and domain_id:admin_domain_id\" to"},{"line_number":179,"context_line":"  \"cloud_admin\": \"is_admin:1 or (rule:admin_required and domain_id:admin_domain_id)\""},{"line_number":180,"context_line":"* Change \"admin_or_owner\": \"(rule:admin_required and"},{"line_number":181,"context_line":"  domain_id:%(target.token.user.domain.id)s) or rule:owner\" to"},{"line_number":182,"context_line":"  \"admin_or_owner\": \"is_admin:1 or (rule:admin_required and"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a80dd14_a7ebfd10","line":179,"in_reply_to":"9a80dd14_6cec8abc","updated":"2015-03-17 23:23:18.000000000","message":"Right.  You have to have a cloud admin user and a cloud admin domain.  Both of these can be exisiting, and perhaps we should just make the \"admin\" user the cloud admin user, and make the \"default\" domain the cloud admin domain, by default.","commit_id":"626a253b872fe5792f77f73b890e4b6b86215dc3"}],"specs/kilo/api-v3-support.rst":[{"author":{"_account_id":6525,"name":"Gilles Dubreuil","email":"gilles@redhat.com","username":"q-1illes-a"},"change_message_id":"857ff5ab93f433a9a67ad093fa1389566384e98e","unresolved":false,"context_lines":[{"line_number":40,"context_line":"  specified in the request) point to the enterprise LDAP server, both in"},{"line_number":41,"context_line":"  read-write and read-only mode.  In order to do this, the services will need"},{"line_number":42,"context_line":"  to use v3 for authentication and specify the domain for the user and for the"},{"line_number":43,"context_line":"  tenant/project."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Proposed change"},{"line_number":46,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":17,"id":"1af86dd1_a25c2bee","line":43,"updated":"2015-06-12 04:08:25.000000000","message":"Can we please use only project word everywhere?","commit_id":"de3505ce5dabb5abd3a23d618b49037e99751213"},{"author":{"_account_id":9983,"name":"Richard Megginson","email":"rmeggins@redhat.com","username":"rmeggins"},"change_message_id":"e226bba1b15073faa79fbba5d9e21d91f6257cf4","unresolved":false,"context_lines":[{"line_number":40,"context_line":"  specified in the request) point to the enterprise LDAP server, both in"},{"line_number":41,"context_line":"  read-write and read-only mode.  In order to do this, the services will need"},{"line_number":42,"context_line":"  to use v3 for authentication and specify the domain for the user and for the"},{"line_number":43,"context_line":"  tenant/project."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Proposed change"},{"line_number":46,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":17,"id":"1af86dd1_a47417fd","line":43,"in_reply_to":"1af86dd1_a25c2bee","updated":"2015-06-12 20:13:42.000000000","message":"Done","commit_id":"de3505ce5dabb5abd3a23d618b49037e99751213"},{"author":{"_account_id":6525,"name":"Gilles Dubreuil","email":"gilles@redhat.com","username":"q-1illes-a"},"change_message_id":"857ff5ab93f433a9a67ad093fa1389566384e98e","unresolved":false,"context_lines":[{"line_number":172,"context_line":"  it.  For the api version, this is only for the _identity_ API version -- for"},{"line_number":173,"context_line":"  example, to allow the identity API command `create user` to accept the"},{"line_number":174,"context_line":"  `--domain` argument.  For other services e.g. for glance to use `image list`,"},{"line_number":175,"context_line":"  it is not necessary to specify an identity API version."},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"All of the domain-aware Keystone resources (such as keystone_user) will always"},{"line_number":178,"context_line":"add a *domain* argument for those operations which require a domain (such as"}],"source_content_type":"text/x-rst","patch_set":17,"id":"1af86dd1_62ce335c","line":175,"updated":"2015-06-12 04:08:25.000000000","message":"I know what you mean but this is a bit confusing, maybe clearly re-list what needs or doesn\u0027t need the version?","commit_id":"de3505ce5dabb5abd3a23d618b49037e99751213"},{"author":{"_account_id":9983,"name":"Richard Megginson","email":"rmeggins@redhat.com","username":"rmeggins"},"change_message_id":"e226bba1b15073faa79fbba5d9e21d91f6257cf4","unresolved":false,"context_lines":[{"line_number":172,"context_line":"  it.  For the api version, this is only for the _identity_ API version -- for"},{"line_number":173,"context_line":"  example, to allow the identity API command `create user` to accept the"},{"line_number":174,"context_line":"  `--domain` argument.  For other services e.g. for glance to use `image list`,"},{"line_number":175,"context_line":"  it is not necessary to specify an identity API version."},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"All of the domain-aware Keystone resources (such as keystone_user) will always"},{"line_number":178,"context_line":"add a *domain* argument for those operations which require a domain (such as"}],"source_content_type":"text/x-rst","patch_set":17,"id":"1af86dd1_8460fb36","line":175,"in_reply_to":"1af86dd1_62ce335c","updated":"2015-06-12 20:13:42.000000000","message":"Done","commit_id":"de3505ce5dabb5abd3a23d618b49037e99751213"},{"author":{"_account_id":6525,"name":"Gilles Dubreuil","email":"gilles@redhat.com","username":"q-1illes-a"},"change_message_id":"857ff5ab93f433a9a67ad093fa1389566384e98e","unresolved":false,"context_lines":[{"line_number":331,"context_line":"        Keystone_user_role[$role_name] ~\u003e Service \u003c| name \u003d\u003d \u0027glance-api\u0027 |\u003e"},{"line_number":332,"context_line":"      }"},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"* Do not use a version suffix in Keystone authentication URLs"},{"line_number":335,"context_line":""},{"line_number":336,"context_line":"For example, use `http://keystone.host:35357/` instead of"},{"line_number":337,"context_line":"`http://keystone.host:35357/v2.0/` or `http://keystone.host:35357/v3/`.  Both"}],"source_content_type":"text/x-rst","patch_set":17,"id":"1af86dd1_42be9700","line":334,"updated":"2015-06-12 04:08:25.000000000","message":"I that not true for authentication URLs only?\nService URLs such as identity URLs need the version, isn\u0027t?\n\nFor instance: \n`http://keystone.host:5000/` instead of `http://keystone.host:5000/v2.0/`\nbut still need to use `http://keystone.host:35357/v2.0/`\n\nIn such case won\u0027t it be better avoiding Openstack puppet module to do any automagic?","commit_id":"de3505ce5dabb5abd3a23d618b49037e99751213"},{"author":{"_account_id":9983,"name":"Richard Megginson","email":"rmeggins@redhat.com","username":"rmeggins"},"change_message_id":"e226bba1b15073faa79fbba5d9e21d91f6257cf4","unresolved":false,"context_lines":[{"line_number":331,"context_line":"        Keystone_user_role[$role_name] ~\u003e Service \u003c| name \u003d\u003d \u0027glance-api\u0027 |\u003e"},{"line_number":332,"context_line":"      }"},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"* Do not use a version suffix in Keystone authentication URLs"},{"line_number":335,"context_line":""},{"line_number":336,"context_line":"For example, use `http://keystone.host:35357/` instead of"},{"line_number":337,"context_line":"`http://keystone.host:35357/v2.0/` or `http://keystone.host:35357/v3/`.  Both"}],"source_content_type":"text/x-rst","patch_set":17,"id":"1af86dd1_6465ff43","line":334,"in_reply_to":"1af86dd1_42be9700","updated":"2015-06-12 20:13:42.000000000","message":"It is true for authentication URLs only, and I clarified that in the docs.","commit_id":"de3505ce5dabb5abd3a23d618b49037e99751213"},{"author":{"_account_id":6926,"name":"Bogdan Dobrelya","email":"bdobreli@redhat.com","username":"bogdando"},"change_message_id":"945e15cb6979e4c69f62493cf998504f408ef17b","unresolved":false,"context_lines":[{"line_number":84,"context_line":"  keystone_user_role { \"admin::admin_domain@::users\": roles \u003d\u003e [\u0027admin\u0027]}"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"This would assign the admin user to the admin role in the project"},{"line_number":87,"context_line":"\"admin\" in the services domain.  The last one would assign the the \"admin\" user"},{"line_number":88,"context_line":"the role of \"admin\" in the domain \"users\".  The \"::\" needs to be specified in"},{"line_number":89,"context_line":"order to differentiate a legacy project name from a domain name."},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"fa32b979_054e1b6f","line":87,"updated":"2015-06-16 08:15:33.000000000","message":"Could you please also add the description for the given \"::admin_domain\" part? And it would be nice to make role/project names unique as well, for example role \u0027sysadmin\u0027 and project \u0027administration\u0027 just to not interfere with the \u0027admin\u0027 user name and make everything 100% clear.","commit_id":"15d0c07fd8d1b3cacc669f64f21e696a10636b7c"},{"author":{"_account_id":9983,"name":"Richard Megginson","email":"rmeggins@redhat.com","username":"rmeggins"},"change_message_id":"3002bce15bcf8cf85d39968c2439597da710dbe9","unresolved":false,"context_lines":[{"line_number":84,"context_line":"  keystone_user_role { \"admin::admin_domain@::users\": roles \u003d\u003e [\u0027admin\u0027]}"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"This would assign the admin user to the admin role in the project"},{"line_number":87,"context_line":"\"admin\" in the services domain.  The last one would assign the the \"admin\" user"},{"line_number":88,"context_line":"the role of \"admin\" in the domain \"users\".  The \"::\" needs to be specified in"},{"line_number":89,"context_line":"order to differentiate a legacy project name from a domain name."},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"fa32b979_870d3d39","line":87,"in_reply_to":"fa32b979_054e1b6f","updated":"2015-06-16 14:34:17.000000000","message":"Done","commit_id":"15d0c07fd8d1b3cacc669f64f21e696a10636b7c"},{"author":{"_account_id":6926,"name":"Bogdan Dobrelya","email":"bdobreli@redhat.com","username":"bogdando"},"change_message_id":"945e15cb6979e4c69f62493cf998504f408ef17b","unresolved":false,"context_lines":[{"line_number":124,"context_line":"  keystone_user_role works is that everything before the **last** \"@\" is part"},{"line_number":125,"context_line":"  of the username, and everything after the **last** \"@\" is part of the"},{"line_number":126,"context_line":"  project name.  So \"user@domain.com@project\" has a username of"},{"line_number":127,"context_line":"  \"user@domain.com\" and a project name of \"project\"."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"For legacy applications, there are two cases:"},{"line_number":130,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"fa32b979_05385b9f","line":127,"updated":"2015-06-16 08:15:33.000000000","message":"Does this also mean that \u0027@\u0027 is not acceptable in project names? This should be strictly specified perhaps.\n\nReturning to the \"admin::admin_domain@administration::services\" example, is it correct that \"@\" is only allowed for the \u0027admin\u0027 part and is prohibited elsewhere of \u0027admin_domain\u0027, \u0027administration\u0027, \u0027services\u0027?","commit_id":"15d0c07fd8d1b3cacc669f64f21e696a10636b7c"},{"author":{"_account_id":9983,"name":"Richard Megginson","email":"rmeggins@redhat.com","username":"rmeggins"},"change_message_id":"3002bce15bcf8cf85d39968c2439597da710dbe9","unresolved":false,"context_lines":[{"line_number":124,"context_line":"  keystone_user_role works is that everything before the **last** \"@\" is part"},{"line_number":125,"context_line":"  of the username, and everything after the **last** \"@\" is part of the"},{"line_number":126,"context_line":"  project name.  So \"user@domain.com@project\" has a username of"},{"line_number":127,"context_line":"  \"user@domain.com\" and a project name of \"project\"."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"For legacy applications, there are two cases:"},{"line_number":130,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"fa32b979_c72a657e","line":127,"in_reply_to":"fa32b979_05385b9f","updated":"2015-06-16 14:34:17.000000000","message":"Done","commit_id":"15d0c07fd8d1b3cacc669f64f21e696a10636b7c"},{"author":{"_account_id":6926,"name":"Bogdan Dobrelya","email":"bdobreli@redhat.com","username":"bogdando"},"change_message_id":"ccbc26f713875e1c6d7c9ee15f6058f52fe1847b","unresolved":false,"context_lines":[{"line_number":180,"context_line":"For trust support, a **keystone_trust** resource will be added.  This resource"},{"line_number":181,"context_line":"will be used to manage trusts."},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"Keystone requires a v3 policy file.  The Keystone package provides a base v3"},{"line_number":184,"context_line":"policy file.  The puppet-keystone code will install and configure this file."},{"line_number":185,"context_line":"The Keystone v3 policy has a concept of a **cloud_admin** user which exists in"},{"line_number":186,"context_line":"the **cloud admin_domain**.  Users in this domain, which have the role"}],"source_content_type":"text/x-rst","patch_set":19,"id":"fa32b979_963b9c38","line":183,"updated":"2015-06-19 09:48:01.000000000","message":"Why did you decide to remove this? I can\u0027t found related discussion from meetings logs, sorry for being not aware.","commit_id":"5d8f4183c20cc9f30e1e584ae3219f559c6896b3"},{"author":{"_account_id":9983,"name":"Richard Megginson","email":"rmeggins@redhat.com","username":"rmeggins"},"change_message_id":"ac9c8c58b0d24fb59ba079714912ae2b94a56b3a","unresolved":false,"context_lines":[{"line_number":180,"context_line":"For trust support, a **keystone_trust** resource will be added.  This resource"},{"line_number":181,"context_line":"will be used to manage trusts."},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"Keystone requires a v3 policy file.  The Keystone package provides a base v3"},{"line_number":184,"context_line":"policy file.  The puppet-keystone code will install and configure this file."},{"line_number":185,"context_line":"The Keystone v3 policy has a concept of a **cloud_admin** user which exists in"},{"line_number":186,"context_line":"the **cloud admin_domain**.  Users in this domain, which have the role"}],"source_content_type":"text/x-rst","patch_set":19,"id":"fa32b979_584d3ac3","line":183,"in_reply_to":"fa32b979_963b9c38","updated":"2015-06-19 13:23:29.000000000","message":"The Keystone developers informed me that Keystone does _not_ require a v3 policy file.  The existing policy file works.  A user with the role \"admin\" can create domains, create users/projects within domains, assign roles to users and projects within domains, etc.\n\nThe other reason is that it was proving to be extremely difficult to figure out a way to make the v3 policy work with puppet-keystone, which by default requires the use of token based auth, which the v3 policy disables.  It would require breaking manifests or workflow in order to support password based auth for puppet-keystone, which we have decided to do at a later time.","commit_id":"5d8f4183c20cc9f30e1e584ae3219f559c6896b3"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"4d74ee30e19c4526680633ba475ce41829254d38","unresolved":false,"context_lines":[{"line_number":147,"context_line":"  keystone_user_role resources.  The puppet-keystone code will determine if"},{"line_number":148,"context_line":"  there is only one user named glance among all domains, and will know that if"},{"line_number":149,"context_line":"  you just specify `glance` it means the unique user named glance in whatever"},{"line_number":150,"context_line":"  domain it happens to be in.  However, if the resource name is **not** unique,"},{"line_number":151,"context_line":"  you **must** specify the \u0027::domainname\u0027 part in the resource name."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Puppet resource declarations that have a name with \"::\" and a domain part will"}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba3cc151_686577df","line":150,"updated":"2015-06-30 20:55:25.000000000","message":"The spec doesn\u0027t seem to cover how it will determine if there is only one unique user across all domains, which I think is something that should be mentioned.\n\nIs it going to look in each domain? That sounds potentially very performance inhibiting. Could it instead search a couple of likely domains and then give up? e.g. if it\u0027s not in the Default domain or the services domain then it probably isn\u0027t there.","commit_id":"45fe5693c0bada0b2fb60925cc71e82d969fe652"},{"author":{"_account_id":9983,"name":"Richard Megginson","email":"rmeggins@redhat.com","username":"rmeggins"},"change_message_id":"c9c2bddd70844dc34d5d3d469cd73154433c16b7","unresolved":false,"context_lines":[{"line_number":147,"context_line":"  keystone_user_role resources.  The puppet-keystone code will determine if"},{"line_number":148,"context_line":"  there is only one user named glance among all domains, and will know that if"},{"line_number":149,"context_line":"  you just specify `glance` it means the unique user named glance in whatever"},{"line_number":150,"context_line":"  domain it happens to be in.  However, if the resource name is **not** unique,"},{"line_number":151,"context_line":"  you **must** specify the \u0027::domainname\u0027 part in the resource name."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Puppet resource declarations that have a name with \"::\" and a domain part will"}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba3cc151_3e3ec2b8","line":150,"in_reply_to":"ba3cc151_5b3cf8e1","updated":"2015-06-30 22:37:26.000000000","message":"At one point, my implementation of keystone_user.self.instances did search through each domain separately, before I figured out how to use openstack user list correctly with v3.","commit_id":"45fe5693c0bada0b2fb60925cc71e82d969fe652"},{"author":{"_account_id":9983,"name":"Richard Megginson","email":"rmeggins@redhat.com","username":"rmeggins"},"change_message_id":"37d8b209ec26fbf9bd7d9fb5aa814c3ceeca286b","unresolved":false,"context_lines":[{"line_number":147,"context_line":"  keystone_user_role resources.  The puppet-keystone code will determine if"},{"line_number":148,"context_line":"  there is only one user named glance among all domains, and will know that if"},{"line_number":149,"context_line":"  you just specify `glance` it means the unique user named glance in whatever"},{"line_number":150,"context_line":"  domain it happens to be in.  However, if the resource name is **not** unique,"},{"line_number":151,"context_line":"  you **must** specify the \u0027::domainname\u0027 part in the resource name."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Puppet resource declarations that have a name with \"::\" and a domain part will"}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba3cc151_be089292","line":150,"in_reply_to":"ba3cc151_686577df","updated":"2015-06-30 22:48:13.000000000","message":"Done","commit_id":"45fe5693c0bada0b2fb60925cc71e82d969fe652"},{"author":{"_account_id":9983,"name":"Richard Megginson","email":"rmeggins@redhat.com","username":"rmeggins"},"change_message_id":"43574d7c6fa91b77beb144dfb53ea664fcd7cd34","unresolved":false,"context_lines":[{"line_number":147,"context_line":"  keystone_user_role resources.  The puppet-keystone code will determine if"},{"line_number":148,"context_line":"  there is only one user named glance among all domains, and will know that if"},{"line_number":149,"context_line":"  you just specify `glance` it means the unique user named glance in whatever"},{"line_number":150,"context_line":"  domain it happens to be in.  However, if the resource name is **not** unique,"},{"line_number":151,"context_line":"  you **must** specify the \u0027::domainname\u0027 part in the resource name."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Puppet resource declarations that have a name with \"::\" and a domain part will"}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba3cc151_889a3b62","line":150,"in_reply_to":"ba3cc151_686577df","updated":"2015-06-30 21:03:45.000000000","message":"If starting from a completely blank slate, it will be up to the person designing the manifest/using the installer/however the user uses puppet-keystone from the composition/orchestration layer, to ensure that the users they specify are unique.\n\nIf starting from an existing deployment, the user will have to use the equivalent of::\n\n    # OS_IDENTITY_API_VERSION\u003d3 OS_TOKEN\u003dadmin_token OS_URL\u003dhttp://keystone.host:35357/v3 openstack user list --long\n\nto look for users (or grep for users) to make sure the users they want to specify in the installer are unique.\n\nAFAIK, the keystone_user self.instances method *has to search every single user in every single domain*, regardless of how the data will be used.  Since it has to do this anyway, it can keep a hash of the user name to see if a name is duplicated.  See https://review.openstack.org/#/c/174976/30/lib/puppet/provider/keystone_user/openstack.rb lines 216-248, and https://review.openstack.org/#/c/174468/34/lib/puppet/provider/keystone_tenant/openstack.rb lines 75-106","commit_id":"45fe5693c0bada0b2fb60925cc71e82d969fe652"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"61aaa6387c4f884dde97c414f173af054d840fb0","unresolved":false,"context_lines":[{"line_number":147,"context_line":"  keystone_user_role resources.  The puppet-keystone code will determine if"},{"line_number":148,"context_line":"  there is only one user named glance among all domains, and will know that if"},{"line_number":149,"context_line":"  you just specify `glance` it means the unique user named glance in whatever"},{"line_number":150,"context_line":"  domain it happens to be in.  However, if the resource name is **not** unique,"},{"line_number":151,"context_line":"  you **must** specify the \u0027::domainname\u0027 part in the resource name."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Puppet resource declarations that have a name with \"::\" and a domain part will"}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba3cc151_5b3cf8e1","line":150,"in_reply_to":"ba3cc151_889a3b62","updated":"2015-06-30 22:34:43.000000000","message":"Okay, this seems reasonable. I think I had it in my head that we might have to make multiple API calls if we were searching through different domains.","commit_id":"45fe5693c0bada0b2fb60925cc71e82d969fe652"}]}