Page MenuHomePhabricator
Create Task
Maniphest T295234

Add keystone auth for dynamicproxy api
Closed, ResolvedPublic
Actions

Description

Right now the project-proxy API is secured with firewall rules. It should check Keystone tokens like any other openstack service.

Details

SubjectRepoBranchLines +/-
dynamicproxy: enforce project permissionsoperations/puppetproduction+58 -7
opentack: add keystone auth to remaining proxy api usersoperations/puppetproduction+55 -41
dynamicproxy: add keystone token verificationoperations/puppetproduction+102 -20
Update wmf-proxy-dashboard submodule: use Keystone auth for proxy editingopenstack/horizon/deploymain+1 -1
views: use keystone for proxy requestsopenstack/horizon/wmf-proxy-dashboardmain+45 -21
views: use keystone for proxy requestsopenstack/horizon/wmf-proxy-dashboardmaster+45 -21
Keystone policy: add support for the keystonevalidate roleoperations/puppetproduction+5 -0
aptrepo: add component for rackspace openstack debsoperations/puppetproduction+1 -0
Customize query in gerrit

Related Objects
Search...

Event Timeline

taavi created this task.Nov 6 2021, 6:52 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptNov 6 2021, 6:52 PM
taavi added a comment.Nov 6 2021, 6:55 PM

We need to package https://github.com/Rackspace-DOT/flask_keystone (and its dependency https://github.com/Rackspace-DOT/flask_oslolog) as Debian packages for this to work easily.

taavi moved this task from Backlog to Dynamicproxy on the Cloud-VPS board.Nov 7 2021, 9:04 AM
taavi added a parent task: T295246: Dynamicproxy API should be useful without the Horizon dashboard.Nov 7 2021, 9:41 AM
taavi changed the status of subtask T295235: Update project-proxy proxies to Debian Bullseye from Open to In Progress.Nov 9 2021, 10:52 AM
gerritbot added a comment.Nov 10 2021, 9:42 AM

Change 737856 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] aptrepo: add component for rackspace openstack debs

https://gerrit.wikimedia.org/r/737856

gerritbot added a project: Patch-For-Review.Nov 10 2021, 9:42 AM
gerritbot added a comment.Nov 17 2021, 5:19 PM

Change 739577 had a related patch set uploaded (by Majavah; author: Majavah):

[openstack/horizon/wmf-proxy-dashboard@master] views: use keystone for proxy requests

https://gerrit.wikimedia.org/r/739577

gerritbot added a comment.Nov 18 2021, 11:05 AM

Change 737856 abandoned by Majavah:

[operations/puppet@production] aptrepo: add component for rackspace openstack debs

Reason:

https://gerrit.wikimedia.org/r/737856

Stashbot added a comment.Nov 18 2021, 11:07 AM

Mentioned in SAL (#wikimedia-operations) [2021-11-18T11:07:09Z] <arturo> added python-flask-oslolog_0.1~git20201012.7803a46-1 to bullseye-wikimedia (T295234)

Stashbot added a comment.Nov 18 2021, 11:26 AM

Mentioned in SAL (#wikimedia-operations) [2021-11-18T11:26:10Z] <arturo> aborrero@apt1001:~$ sudo -i reprepro processincoming default /srv/wikimedia/incoming/python-flask-keystone_0.2~git20201012.b5cd4da-1_amd64.changes (T295234)

gerritbot added a comment.Nov 18 2021, 6:08 PM

Change 739902 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[operations/puppet@production] Keystone policy: add support for the keystonevalidate role

https://gerrit.wikimedia.org/r/739902

gerritbot added a comment.Nov 19 2021, 9:46 AM

Change 739902 merged by Arturo Borrero Gonzalez:

[operations/puppet@production] Keystone policy: add support for the keystonevalidate role

https://gerrit.wikimedia.org/r/739902

gerritbot added a comment.Nov 19 2021, 6:00 PM

Change 739577 merged by Andrew Bogott:

[openstack/horizon/wmf-proxy-dashboard@master] views: use keystone for proxy requests

https://gerrit.wikimedia.org/r/739577

gerritbot added a comment.Nov 19 2021, 6:02 PM

Change 740225 had a related patch set uploaded (by Andrew Bogott; author: Majavah):

[openstack/horizon/wmf-proxy-dashboard@main] views: use keystone for proxy requests

https://gerrit.wikimedia.org/r/740225

gerritbot added a comment.Nov 19 2021, 6:03 PM

Change 740226 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] dynamicproxy: add keystone authentication

https://gerrit.wikimedia.org/r/740226

gerritbot added a comment.Nov 19 2021, 6:03 PM

Change 740225 merged by Andrew Bogott:

[openstack/horizon/wmf-proxy-dashboard@main] views: use keystone for proxy requests

https://gerrit.wikimedia.org/r/740225

gerritbot added a comment.Nov 19 2021, 6:04 PM

Change 740227 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[openstack/horizon/deploy@main] Update wmf-proxy-dashboard submodule: use Keystone auth for proxy editing

https://gerrit.wikimedia.org/r/740227

gerritbot added a comment.Nov 19 2021, 6:05 PM

Change 740227 merged by Andrew Bogott:

[openstack/horizon/deploy@main] Update wmf-proxy-dashboard submodule: use Keystone auth for proxy editing

https://gerrit.wikimedia.org/r/740227

taavi closed subtask T296105: Support keystone auth for openstack-browser when accessing the dynamic proxy api as Resolved.Nov 19 2021, 6:32 PM
gerritbot added a comment.Nov 19 2021, 6:50 PM

Change 740226 merged by Andrew Bogott:

[operations/puppet@production] dynamicproxy: add keystone token verification

https://gerrit.wikimedia.org/r/740226

taavi reopened subtask T296105: Support keystone auth for openstack-browser when accessing the dynamic proxy api as Open.Nov 19 2021, 7:08 PM
taavi closed subtask T295235: Update project-proxy proxies to Debian Bullseye as Resolved.Nov 19 2021, 7:24 PM
taavi closed subtask T296105: Support keystone auth for openstack-browser when accessing the dynamic proxy api as Resolved.Nov 19 2021, 9:35 PM
taavi added a comment.Nov 19 2021, 9:38 PM

Keystone tokens are now being verified. Next step is to add support for per-project RBAC policy.

gerritbot added a comment.Nov 20 2021, 4:40 PM

Change 740306 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] opentack: add keystone auth to remaining proxy api users

https://gerrit.wikimedia.org/r/740306

gerritbot added a comment.Nov 22 2021, 2:39 PM

Change 740306 merged by Andrew Bogott:

[operations/puppet@production] opentack: add keystone auth to remaining proxy api users

https://gerrit.wikimedia.org/r/740306

taavi mentioned this in T296192: Requesting access to wmcs-roots, labtest-roots for Taavi Väänänen (Majavah).Nov 22 2021, 2:40 PM
gerritbot added a comment.Dec 17 2021, 5:33 PM

Change 748171 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] dynamicproxy: enforce project permissions

https://gerrit.wikimedia.org/r/748171

gerritbot added a comment.Dec 17 2021, 5:52 PM

Change 748171 merged by Andrew Bogott:

[operations/puppet@production] dynamicproxy: enforce project permissions

https://gerrit.wikimedia.org/r/748171

taavi closed this task as Resolved.Jan 22 2022, 3:36 PM

Closing, this is done now. Remaining steps for opening up the API access are tracked in T295246.

taavi mentioned this in T305414: Q4:(Need By: TBD) rack/setup/install cloudweb100[34].Apr 5 2022, 8:58 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL