[Rdo-list] No /usr/share/keystone/keystone-paste.ini in openstack-keystone-2015.1.0-1.el7.noarch.rpm
4:25 p.m.
Hi all,
It's been pointed out to me that in our Kilo openstack-keystone package we ship a
/usr/share/keystone/keystone-dist-paste.ini file but no
/usr/share/keystone/keystone-paste.ini. Is this intentional? Asking in the context of
https://review.openstack.org/#/c/185120
Thanks,
Steve
8:40 a.m.
----- Original Message -----
From: "Steve Gordon" <sgordon(a)redhat.com>
To: "rdo-list" <rdo-list(a)redhat.com>
Hi all,
It's been pointed out to me that in our Kilo openstack-keystone package we
ship a /usr/share/keystone/keystone-dist-paste.ini file but no
/usr/share/keystone/keystone-paste.ini. Is this intentional? Asking in the
context of https://review.openstack.org/#/c/185120
Thanks,
Steve
Sorry, I meant there is no /etc/keystone/keystone-paste.ini.
Thanks,
Steve
3:10 a.m.
On Sat, May 23, 2015 at 09:40:36AM -0400, Steve Gordon wrote:
----- Original Message -----
> From: "Steve Gordon" <sgordon(a)redhat.com>
> To: "rdo-list" <rdo-list(a)redhat.com>
>
> Hi all,
>
> It's been pointed out to me that in our Kilo openstack-keystone package we
> ship a /usr/share/keystone/keystone-dist-paste.ini file but no
> /usr/share/keystone/keystone-paste.ini. Is this intentional? Asking in the
> context of https://review.openstack.org/#/c/185120
>
> Thanks,
>
> Steve
Sorry, I meant there is no /etc/keystone/keystone-paste.ini.
Extracting the Keystone SRPM, and looking at 'keystone-dist.conf', it is
referring to /usr/share:
$ cat keystone-dist.conf
[DEFAULT]
log_file=/var/log/keystone/keystone.log
use_stderr = False
[database]
connection=mysql://keystone:keystone@localhost/keystone
[paste_deploy]
config_file=/usr/share/keystone/keystone-dist-paste.ini
So, RDO just seems to be sticking with upstream behavior.
--
/kashyap
3:36 a.m.
So, RDO just seems to be sticking with upstream behavior.
dist.conf is not upstream, it was introduced in the initial Fedora
packaging specifically to enforce distribution defaults.
Regarding paste.ini, the thinking was that this is NOT an user
configurable file and should be treated as _code_ because it has full
code paths for filters which could change between releases so RPM
packaging is doing the right thing by keeping distro default out of
/etc and overwriting it on upgrades. There's still an option for users
to create paste.ini in /etc or wherever and point to it in
/etc/keystone.conf [paste_deploy] section but this is problematic from
the support perspective.
Keystone project could consider providing something more supportable
like Glance with paste_deploy.flavor instead of documenting editing of
paste.ini.
Cheers,
Alan
4 a.m.
On Mon, May 25, 2015 at 10:36:33AM +0200, Alan Pevec wrote:
> So, RDO just seems to be sticking with upstream behavior.
dist.conf is not upstream, it was introduced in the initial Fedora
packaging specifically to enforce distribution defaults.
Regarding paste.ini,
Ah, sorry -- was about to check Fedora's dist-git, but made the wrong
conclusion, thanks for correcting.
the thinking was that this is NOT an user configurable file and
should
be treated as _code_ because it has full code paths for filters which
could change between releases so RPM packaging is doing the right
thing by keeping distro default out of /etc and overwriting it on
upgrades.
Yep, that sounds sensible.
There's still an option for users to create paste.ini in /etc or
wherever and point to it in /etc/keystone.conf [paste_deploy] section
but this is problematic from the support perspective. Keystone
project could consider providing something more supportable like
Glance with paste_deploy.flavor instead of documenting editing of
paste.ini.
Cheers, Alan
--
/kashyap
7:29 a.m.
----- Original Message -----
From: "Alan Pevec" <apevec(a)gmail.com>
To: "Kashyap Chamarthy" <kchamart(a)redhat.com>, "Adam Young"
<ayoung(a)redhat.com>
> So, RDO just seems to be sticking with upstream behavior.
dist.conf is not upstream, it was introduced in the initial Fedora
packaging specifically to enforce distribution defaults.
Regarding paste.ini, the thinking was that this is NOT an user
configurable file and should be treated as _code_ because it has full
code paths for filters which could change between releases so RPM
packaging is doing the right thing by keeping distro default out of
/etc and overwriting it on upgrades. There's still an option for users
to create paste.ini in /etc or wherever and point to it in
/etc/keystone.conf [paste_deploy] section but this is problematic from
the support perspective.
Keystone project could consider providing something more supportable
like Glance with paste_deploy.flavor instead of documenting editing of
paste.ini.
Cheers,
Alan
OK, but in this case the keystone-paste.ini we are using in RDO includes the
admin_token_auth directives that the documentation patch is endeavoring to remove [1] and
the RHEL-OSP 7 beta packages I took a look at don't. Which is correct?
Thanks,
Steve
[1]
https://review.openstack.org/#/c/185120/1/doc/install-guide/section_keyst...
5:17 p.m.
2015-05-25 14:29 GMT+02:00 Steve Gordon <sgordon(a)redhat.com>:
OK, but in this case the keystone-paste.ini we are using in RDO
includes the admin_token_auth directives that the documentation patch is endeavoring to
remove [1] and the RHEL-OSP 7 beta packages I took a look at don't. Which is correct?
It is an upstream bug and potential security issue which should be
fixed instead of working around in documentation and deployment tools:
https://review.openstack.org/185464
Cheers,
Alan
5:31 p.m.
----- Original Message -----
From: "Alan Pevec" <apevec(a)gmail.com>
To: "Steve Gordon" <sgordon(a)redhat.com>, nkinder(a)redhat.com
2015-05-25 14:29 GMT+02:00 Steve Gordon <sgordon(a)redhat.com>:
> OK, but in this case the keystone-paste.ini we are using in RDO includes
> the admin_token_auth directives that the documentation patch is
> endeavoring to remove [1] and the RHEL-OSP 7 beta packages I took a look
> at don't. Which is correct?
It is an upstream bug and potential security issue which should be
fixed instead of working around in documentation and deployment tools:
https://review.openstack.org/185464
Cheers,
Alan
Thanks Alan,
Just to be explicit you are saying it is enough if the documentation is updated to set
admin_token = <None> in the /etc/keystone/keystone.conf and the fact that
/usr/share/keystone/keystone-dist-paste.ini contains admin_token_auth directives is
irrelevant if this is the case?
Thanks,
Steve
5:54 p.m.
Just to be explicit you are saying it is enough if the documentation
is updated to set admin_token = <None> in the /etc/keystone/keystone.conf and the
fact that /usr/share/keystone/keystone-dist-paste.ini contains admin_token_auth directives
is irrelevant if this is the case?
Once my proposed patch is merged it will be enough to remove or
comment out admin_token in keystone.conf to disable it and this will
be also default.
Right now, default admin_token is ADMIN and this is a security issue
which is worked around by the documentation you're pointing out.
Cheers,
Alan
3252
days inactive
3255
days old
8 comments
3 participants
participants (3)
-
Alan Pevec -
Kashyap Chamarthy -
Steve Gordon