Page MenuHomePhabricator
Create Task
Maniphest T295234

Add keystone auth for dynamicproxy api
Closed, ResolvedPublic
Actions

Description

Right now the project-proxy API is secured with firewall rules. It should check Keystone tokens like any other openstack service.

Details

ProjectBranchLines +/-Subject
operations/puppetproduction+58 -7dynamicproxy: enforce project permissions
operations/puppetproduction+55 -41opentack: add keystone auth to remaining proxy api users
operations/puppetproduction+102 -20dynamicproxy: add keystone token verification
openstack/horizon/deploymain+1 -1Update wmf-proxy-dashboard submodule: use Keystone auth for proxy editing
openstack/horizon/wmf-proxy-dashboardmain+45 -21views: use keystone for proxy requests
openstack/horizon/wmf-proxy-dashboardmaster+45 -21views: use keystone for proxy requests
operations/puppetproduction+5 -0Keystone policy: add support for the keystonevalidate role
operations/puppetproduction+1 -0aptrepo: add component for rackspace openstack debs
Customize query in gerrit

Related Objects
Search...

Event Timeline

• taavi created this task.Nov 6 2021, 6:52 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptNov 6 2021, 6:52 PM
• taavi added a comment.Nov 6 2021, 6:55 PM

We need to package https://github.com/Rackspace-DOT/flask_keystone (and its dependency https://github.com/Rackspace-DOT/flask_oslolog) as Debian packages for this to work easily.

• taavi moved this task from Backlog to Dynamicproxy on the Cloud-VPS board.Nov 7 2021, 9:04 AM
• taavi added a parent task: T295246: Dynamicproxy API should be useful without the Horizon dashboard.Nov 7 2021, 9:41 AM
• taavi changed the status of subtask T295235: Update project-proxy proxies to Debian Bullseye from Open to In Progress.Nov 9 2021, 10:52 AM
gerritbot added a comment.Nov 10 2021, 9:42 AM

Change 737856 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] aptrepo: add component for rackspace openstack debs

https://gerrit.wikimedia.org/r/737856

gerritbot added a project: Patch-For-Review.Nov 10 2021, 9:42 AM
gerritbot added a comment.Nov 17 2021, 5:19 PM

Change 739577 had a related patch set uploaded (by Majavah; author: Majavah):

[openstack/horizon/wmf-proxy-dashboard@master] views: use keystone for proxy requests

https://gerrit.wikimedia.org/r/739577

gerritbot added a comment.Nov 18 2021, 11:05 AM

Change 737856 abandoned by Majavah:

[operations/puppet@production] aptrepo: add component for rackspace openstack debs

Reason:

https://gerrit.wikimedia.org/r/737856

Stashbot added a comment.Nov 18 2021, 11:07 AM

Mentioned in SAL (#wikimedia-operations) [2021-11-18T11:07:09Z] <arturo> added python-flask-oslolog_0.1~git20201012.7803a46-1 to bullseye-wikimedia (T295234)

Stashbot added a comment.Nov 18 2021, 11:26 AM

Mentioned in SAL (#wikimedia-operations) [2021-11-18T11:26:10Z] <arturo> aborrero@apt1001:~$ sudo -i reprepro processincoming default /srv/wikimedia/incoming/python-flask-keystone_0.2~git20201012.b5cd4da-1_amd64.changes (T295234)

gerritbot added a comment.Nov 18 2021, 6:08 PM

Change 739902 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[operations/puppet@production] Keystone policy: add support for the keystonevalidate role

https://gerrit.wikimedia.org/r/739902

gerritbot added a comment.Nov 19 2021, 9:46 AM

Change 739902 merged by Arturo Borrero Gonzalez:

[operations/puppet@production] Keystone policy: add support for the keystonevalidate role

https://gerrit.wikimedia.org/r/739902

gerritbot added a comment.Nov 19 2021, 6:00 PM

Change 739577 merged by Andrew Bogott:

[openstack/horizon/wmf-proxy-dashboard@master] views: use keystone for proxy requests

https://gerrit.wikimedia.org/r/739577

gerritbot added a comment.Nov 19 2021, 6:02 PM

Change 740225 had a related patch set uploaded (by Andrew Bogott; author: Majavah):

[openstack/horizon/wmf-proxy-dashboard@main] views: use keystone for proxy requests

https://gerrit.wikimedia.org/r/740225

gerritbot added a comment.Nov 19 2021, 6:03 PM

Change 740226 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] dynamicproxy: add keystone authentication

https://gerrit.wikimedia.org/r/740226

gerritbot added a comment.Nov 19 2021, 6:03 PM

Change 740225 merged by Andrew Bogott:

[openstack/horizon/wmf-proxy-dashboard@main] views: use keystone for proxy requests

https://gerrit.wikimedia.org/r/740225

gerritbot added a comment.Nov 19 2021, 6:04 PM

Change 740227 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[openstack/horizon/deploy@main] Update wmf-proxy-dashboard submodule: use Keystone auth for proxy editing

https://gerrit.wikimedia.org/r/740227

gerritbot added a comment.Nov 19 2021, 6:05 PM

Change 740227 merged by Andrew Bogott:

[openstack/horizon/deploy@main] Update wmf-proxy-dashboard submodule: use Keystone auth for proxy editing

https://gerrit.wikimedia.org/r/740227

• taavi closed subtask T296105: Support keystone auth for openstack-browser when accessing the dynamic proxy api as Resolved.Nov 19 2021, 6:32 PM
gerritbot added a comment.Nov 19 2021, 6:50 PM

Change 740226 merged by Andrew Bogott:

[operations/puppet@production] dynamicproxy: add keystone token verification

https://gerrit.wikimedia.org/r/740226

• taavi reopened subtask T296105: Support keystone auth for openstack-browser when accessing the dynamic proxy api as Open.Nov 19 2021, 7:08 PM
• taavi closed subtask T295235: Update project-proxy proxies to Debian Bullseye as Resolved.Nov 19 2021, 7:24 PM
• taavi closed subtask T296105: Support keystone auth for openstack-browser when accessing the dynamic proxy api as Resolved.Nov 19 2021, 9:35 PM
• taavi added a comment.Nov 19 2021, 9:38 PM

Keystone tokens are now being verified. Next step is to add support for per-project RBAC policy.

gerritbot added a comment.Nov 20 2021, 4:40 PM

Change 740306 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] opentack: add keystone auth to remaining proxy api users

https://gerrit.wikimedia.org/r/740306

gerritbot added a comment.Nov 22 2021, 2:39 PM

Change 740306 merged by Andrew Bogott:

[operations/puppet@production] opentack: add keystone auth to remaining proxy api users

https://gerrit.wikimedia.org/r/740306

• taavi mentioned this in T296192: Requesting access to wmcs-roots, labtest-roots for Taavi Väänänen (Majavah).Nov 22 2021, 2:40 PM
gerritbot added a comment.Dec 17 2021, 5:33 PM

Change 748171 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] dynamicproxy: enforce project permissions

https://gerrit.wikimedia.org/r/748171

gerritbot added a comment.Dec 17 2021, 5:52 PM

Change 748171 merged by Andrew Bogott:

[operations/puppet@production] dynamicproxy: enforce project permissions

https://gerrit.wikimedia.org/r/748171

• taavi closed this task as Resolved.Jan 22 2022, 3:36 PM

Closing, this is done now. Remaining steps for opening up the API access are tracked in T295246.

• taavi mentioned this in T305414: Q4:(Need By: TBD) rack/setup/install cloudweb100[34].Apr 5 2022, 8:58 AM
Content licensed under Creative Commons Attribution-ShareAlike 3.0 (CC-BY-SA) unless otherwise noted; code licensed under GNU General Public License (GPL) or other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL