February 2014 - openSUSE Public Cloud - openSUSE Mailing Lists

[opensuse-cloud] Re: [opensuse-buildservice] CI rights management
by Sascha Peilicke 28 Feb '14

28 Feb '14

On Sunday 23 February 2014 16:06:26 Jos Poortvliet wrote: > On Feb 19, 2014 5:32 PM, "Sascha Peilicke" <speilicke(a)suse.com> wrote: > > Hi guys, > > > > since more and more openSUSE projects start to make use of our CI > > infrastructure, we have to organize who's allowed to do what. In the past > > we > > > just added more and more people with rights to organize everything. So I > > tried > > > to reduce the global list of users with admin rights. Instead, we now > > have a > > > per-project (translates to Jenkins job) ACL matrix where each project can > > organize stuff themselves. In simple words, you now can configure per job > > who's allowed to change things. There should be no need to bug me again > : > :-) > : > > That said, the list of ci.o.o admins now is: > > coolo, jdsn, bmwiedemann and saschpe (me). > > > > The following openSUSE projects currently use ci.opensuse.org: > > - Open Build Service / osc > > - OpenStack > > - Yast / libyui > > > > The first two projects have per-job based access rules set already. If you > > have a ci.o.o job and want to grant somebody the right to modify it, just > > check "Enable project-based security" and add the (already registered) > > user in > > > question. > > > > And if you want to add your openSUSE-related project to our CI, please > > get in > > > touch with any of the guys mentioned above. That's it. > > I am guessing there is a wiki page where this is documented, perhaps it > would be possible to link to that page from http://ci.openSUSE.org? I have to admin that ci.opensuse.org is slightly under-documented. However, I'd like to avoid creating huge wiki pages that run out of sync. Instead, the CI boys already agreed to add/extend Jenkins job descriptions and similar things so that this is more obvious. I guess having a small wiki page about "how to get your stuff tested" wouldn't hurt... -- With kind regards, Sascha Peilicke SUSE Linux GmbH, Maxfeldstr. 5, D-90409 Nuernberg, Germany GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer HRB 16746 (AG Nürnberg) -- To unsubscribe, e-mail: opensuse-cloud+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-cloud+owner(a)opensuse.org

2 1

[opensuse-cloud] question keystone config [havana opensuse 13.1]
by Pavel Souček 27 Feb '14

27 Feb '14

Hi, trying to install havana on suse 13.1 (using guide http://docs.openstack.org/trunk/install-guide/install/zypper/content/index.… ) currently i have problem creating endpoint service in keystone (using mariadb as db) I can create service like keystone service-create --name=keystone --type=identity --description="Keystone Identity Service" WARNING: Bypassing authentication using a token & endpoint (authentication credentials are being ignored). +-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | Keystone Identity Service | | id | b2a8a8cb28c84a0e80ef2e71553d2929 | | name | keystone | | type | identity | +-------------+----------------------------------+ # my server hostname - control # if i follow guide and dont use --region switch then region is regionOne with lowercase r at begining - seems like error but not sure - tested both variants keystone endpoint-create --region RegionOne --service-id=$(keystone service-list | awk '/ identity / {print $2}') --publicurl=http://control:5000/v2.0 --internalurl=http://control:5000/v2.0 --adminurl=http://control:35357/v2.0 WARNING: Bypassing authentication using a token & endpoint (authentication credentials are being ignored). +-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | adminurl | http://control:35357/v2.0 | | id | b3df8778a97a4286be05de6b3714cf07 | | internalurl | http://control:5000/v2.0 | | publicurl | http://control:5000/v2.0 | | region | RegionOne | | service_id | b2a8a8cb28c84a0e80ef2e71553d2929 | +-------------+----------------------------------+ #verify keystone endpoint-list WARNING: Bypassing authentication using a token & endpoint (authentication credentials are being ignored). +----------------------------------+-----------+--------------------------+--------------------------+---------------------------+----------------------------------+ | id | region | publicurl | internalurl | adminurl | service_id | +----------------------------------+-----------+--------------------------+--------------------------+---------------------------+----------------------------------+ | b3df8778a97a4286be05de6b3714cf07 | RegionOne | http://control:5000/v2.0 | http://control:5000/v2.0 | http://control:35357/v2.0 | b2a8a8cb28c84a0e80ef2e71553d2929 | +----------------------------------+-----------+--------------------------+--------------------------+---------------------------+----------------------------------+ seems ok but tests keystone --os-username=admin --os-password=linux --os-auth-url=http://control:35357/v2.0 token-get //works and return value keystone --os-username=admin --os-password=xxxx --os-tenant-name=admin --os-auth-url=http://control:35357/v2.0 token-get Authorization Failed: Malformed endpoint URL (http://%SERVICE_HOST%:8774/v2/$(tenant_id)s), see ERROR log for details. (HTTP 500) # and if i restart keystone process then service and endpoint disapear / users , roles and other values persists control:~ # service openstack-keystone stop control:~ # service openstack-keystone start control:~ # keystone endpoint-list WARNING: Bypassing authentication using a token & endpoint (authentication credentials are being ignored). control:~ # keystone service-list WARNING: Bypassing authentication using a token & endpoint (authentication credentials are being ignored). Getting empty lists and nothing in mysql db tables Any idea what can be wrong ? Also missed one step in guide i have to do in begining cd /etc/keystone cp default_catalog.templates.sample default_catalog.templates Thank you Pavel -- To unsubscribe, e-mail: opensuse-cloud+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-cloud+owner(a)opensuse.org

3 3

[opensuse-cloud] Removal of openstack- prefix of created usernames/groups in openstack- packages
by Dirk Müller 19 Feb '14

19 Feb '14

Hi, As part of converging our packaging to a Triple-O compatible filesystem layout, we're going to rename the users/groups that are created by the openstack- packages to the upstream naming, which is without the openstack- prefix. This only affects the usernames and groups a daemon is running under, the package names remain the way they are. Also none of the init script names are going to be changed. You're only affected if you use custom devops tools or chef recipes for deploying our packages, or if you manually su to one of those service users (which is normally not necessary). For example: old packages (Havana and older): openstack-keystone creates a user called "openstack-keystone". new packages (Icehouse and newer): openstack-keystone creates a user called "keystone". If an old user called "openstack-keystone" exists, it is being deleted and its UID/GID is getting reused. The migration was painless in my local experiments because the old UID/GID is being reused, so no files on the filesytem need to be converted, not even any of the daemons need to be restarted. We plan to do the user renaming during setting up the Cloud:OpenStack:Icehouse project, which is scheduled for 2nd week of March. The few packages that are Master-only (and probably not used by many people) have already been converted. Please let us know if that is an issue for you timing wise. Thanks, Dirk -- To unsubscribe, e-mail: opensuse-cloud+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-cloud+owner(a)opensuse.org

2 2

[opensuse-cloud] CI rights management
by Sascha Peilicke 19 Feb '14

19 Feb '14

Hi guys, since more and more openSUSE projects start to make use of our CI infrastructure, we have to organize who's allowed to do what. In the past we just added more and more people with rights to organize everything. So I tried to reduce the global list of users with admin rights. Instead, we now have a per-project (translates to Jenkins job) ACL matrix where each project can organize stuff themselves. In simple words, you now can configure per job who's allowed to change things. There should be no need to bug me again :-) That said, the list of ci.o.o admins now is: coolo, jdsn, bmwiedemann and saschpe (me). The following openSUSE projects currently use ci.opensuse.org: - Open Build Service / osc - OpenStack - Yast / libyui The first two projects have per-job based access rules set already. If you have a ci.o.o job and want to grant somebody the right to modify it, just check "Enable project-based security" and add the (already registered) user in question. And if you want to add your openSUSE-related project to our CI, please get in touch with any of the guys mentioned above. That's it. -- With kind regards, Sascha Peilicke SUSE Linux GmbH, Maxfeldstr. 5, D-90409 Nuernberg, Germany GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer HRB 16746 (AG Nürnberg) -- To unsubscribe, e-mail: opensuse-cloud+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-cloud+owner(a)opensuse.org

1 0

[opensuse-cloud] missing requirement in openstack-nova: python-ceilometer
by Christian Berendt 14 Feb '14

14 Feb '14

Looks like python-nova requires python-ceilometer. 2014-02-14 14:57:13.757 30600 TRACE nova.openstack.common.notifier.api __import__(import_str) 2014-02-14 14:57:13.757 30600 TRACE nova.openstack.common.notifier.api ImportError: No module named ceilometer.compute.nova_notifier Christian. -- Christian Berendt Cloud Computing Solution Architect Tel.: +49-171-5542175 Mail: berendt(a)b1-systems.de B1 Systems GmbH Osterfeldstraße 7 / 85088 Vohburg / http://www.b1-systems.de GF: Ralph Dehner / Unternehmenssitz: Vohburg / AG: Ingolstadt,HRB 3537 -- To unsubscribe, e-mail: opensuse-cloud+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-cloud+owner(a)opensuse.org

2 2

[opensuse-cloud] Switch Factory over to Icehouse packages?
by Dirk Müller 13 Feb '14

13 Feb '14

Hi, its this time of the year again ... :-) Pretty soon there will be release candidates of Icehouse. Do we want to switch over to a Cloud:OpenStack:Master snapshot for Factory? Thanks, Dirk -- To unsubscribe, e-mail: opensuse-cloud+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-cloud+owner(a)opensuse.org

2 3