The keystone folks have decided to deprecate project membership via ldap. This wasn't supposed to happen until M but in truth the v3 api is totally broken for this so we probably need to move sooner.
How, then, will pam/ssh determine project membership? I don't know.
the transition is described here:
https://openstack.nimeyo.com/29408/openstack-keystone-deprecation-assignment-project-assignment
And a tentative roadmap is here:
https://wikitech.wikimedia.org/wiki/Labs_keystone_roles#Steps
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T138150 Purge stale data from LDAP | |||
| Resolved | Andrew | T148781 Clean up ldap host entries and references | |||
| Resolved | Krenair | T108625 Remove reliance on ldap $::projectid from shinkengen | |||
| Resolved | Andrew | T42022 Add icinga checks for all nova, glance, and keystone related services | |||
| Open | None | T90784 Monitor nova-scheduler log for lost contact with compute nodes | |||
| Resolved | Andrew | T104575 Don't rely on wikitech API for production services | |||
| Resolved | Andrew | T104588 Give 'novaobserver' keystone account rights to read everything, everywhere, write or change nothing | |||
| Declined | None | T115026 Support a multi-domain model in keystone | |||
| Resolved | Andrew | T115027 switch to keystone api v3 | |||
| Resolved | Andrew | T115029 Move project membership/assignment from ldap to keystone mysql | |||
| Resolved | Andrew | T117610 Make designate able to pull the project name from a project ID | |||
| Resolved | Andrew | T126765 Lock down access for new keystone role model |
Change 267192 had a related patch set uploaded (by Andrew Bogott):
Define wgOpenStackManagerProject
Change 252615 had a related patch set uploaded (by Andrew Bogott):
WIP: get project and membership information via the keystone api
Change 267789 had a related patch set uploaded (by Andrew Bogott):
Add legacy ldap-based files for handline project information.
Change 268325 had a related patch set uploaded (by Andrew Bogott):
Switch keystone to mysql assignment from ldap.
Change 268832 had a related patch set uploaded (by Andrew Bogott):
Keep track of roleids as a separate thing from rolenames.
Change 268833 had a related patch set uploaded (by Andrew Bogott):
Attempt to distinguish between project names and project IDs.
Change 268834 had a related patch set uploaded (by Andrew Bogott):
Modify projects and roles using keystone calls.
Change 268835 had a related patch set uploaded (by Andrew Bogott):
Update OpenStackNovaUser to use proper OpenStackNovaProject calls.
Change 268836 had a related patch set uploaded (by Andrew Bogott):
Added migration tool to adopt keystone-based project assignment
Change 267789 merged by jenkins-bot:
Add legacy ldap-based files for handline project information.
Change 268927 had a related patch set uploaded (by Andrew Bogott):
Specify wgOpenStackManagerProjectId in WikitechPrivateSettings.php
Change 268927 merged by Andrew Bogott:
Specify wgOpenStackManagerProjectId in WikitechPrivateSettings.php
to revert, roll back all patches, reset all caches, and truncate keystone tables: assignment, project, role.
labtestwikitech.wikimedia.org now reflects the end of the above process (plus one additional patch that can be merged at any time, https://gerrit.wikimedia.org/r/#/c/269363/
Change 269564 had a related patch set uploaded (by Andrew Bogott):
Add a keystone v3 call to determine role membership.
Change 269565 had a related patch set uploaded (by Andrew Bogott):
Added a v3 call to get projects for a given user.
I'd like to be sure to have understood this: In the future, OpenStackManager will be a frontend for Keystone (which handles OpenStack users/projects). Keystone will sync changes to its data to the existing LDAP server. This LDAP server is queried (as before) by pam/ssh. Correct?
@scfc, that is almost correct. Certain ldap entries (the groups used by pam/ssh) will remain as before. Other ldap entries (those used only as the keystone backend, specifically roles and project membership) will no longer be updated, and will get pruned out eventually.
The complete story is here: https://wikitech.wikimedia.org/wiki/Labs_keystone_roles
Change 252615 merged by jenkins-bot:
Get projects and membership via the keystone api
Change 268832 merged by jenkins-bot:
Keep track of roleids as a separate thing from rolenames
Change 268833 merged by jenkins-bot:
Distinguish between project names and project IDs
Change 268835 merged by jenkins-bot:
Update OpenStackNovaUser to use proper OpenStackNovaProject calls
Change 270136 had a related patch set uploaded (by Andrew Bogott):
memberDNs should be based off the userid, not the username.
Change 268836 merged by jenkins-bot:
Added migration tool to adopt keystone-based projects and role assignment
Change 269564 merged by jenkins-bot:
Add a keystone v3 call to determine role membership.
Change 269565 merged by jenkins-bot:
Added a v3 call to get projects for a given user.
Change 270136 merged by jenkins-bot:
memberDNs should be based off the userid, not the username.
Change 270157 had a related patch set uploaded (by Andrew Bogott):
Get projects and membership via the keystone api
Change 270158 had a related patch set uploaded (by Andrew Bogott):
Keep track of roleids as a separate thing from rolenames
Change 270159 had a related patch set uploaded (by Andrew Bogott):
Distinguish between project names and project IDs
Change 270160 had a related patch set uploaded (by Andrew Bogott):
Update OpenStackNovaUser to use proper OpenStackNovaProject calls
Change 270161 had a related patch set uploaded (by Andrew Bogott):
memberDNs should be based off the userid, not the username.
Change 270162 had a related patch set uploaded (by Andrew Bogott):
Modify projects and roles using keystone calls
Change 270163 had a related patch set uploaded (by Andrew Bogott):
Added migration tool to adopt keystone-based projects and role assignment
Change 270164 had a related patch set uploaded (by Andrew Bogott):
Add a keystone v3 call to determine role membership.
Change 270165 had a related patch set uploaded (by Andrew Bogott):
Added a v3 call to get projects for a given user.
Change 270169 had a related patch set uploaded (by Andrew Bogott):
Update admin_project_id in the keystone config
Change 270157 merged by jenkins-bot:
Get projects and membership via the keystone api
Change 270158 merged by jenkins-bot:
Keep track of roleids as a separate thing from rolenames
Change 270159 merged by jenkins-bot:
Distinguish between project names and project IDs
Change 270160 merged by jenkins-bot:
Update OpenStackNovaUser to use proper OpenStackNovaProject calls
Change 270161 merged by jenkins-bot:
memberDNs should be based off the userid, not the username.
Change 270163 merged by jenkins-bot:
Added migration tool to adopt keystone-based projects and role assignment
Change 270164 merged by jenkins-bot:
Add a keystone v3 call to determine role membership.
Change 270165 merged by jenkins-bot:
Added a v3 call to get projects for a given user.
Change 268325 merged by Andrew Bogott:
Switch keystone to mysql assignment from ldap.
Change 270169 merged by Andrew Bogott:
Update admin_project_id in the keystone config
This migration is done, and was followed by half a dozen OSM patches to mop up bugs and improve performance.