Hi David, admin_domain_name is used at the moment to fill in the domain when missing in a few cases. The get_credentials method is one of them. Another two are setting the default domain for the users in tempest.conf [0], and setting the domain for credentials loaded from a YAML file [1].
[0] http://git.openstack.org/cgit/openstack/tempest/tree/tempest/config.py#n1246 [1] http://git.openstack.org/cgit/openstack/tempest/tree/tempest/common/accounts.py#n219 There is also a tenant_isolation_domain_name, which is used when provisioning v3 isolated credentials. Because tenant_isolation and pre-provisioned credentials are mutually exclusive, and to avoid having too many config options, I would suggest to rename tenant_isolation_domain_name to default_credentials_domain_name (or something similar), and to use it in [0], [1] and in the code you quoted. The admin_domain_name would then become fully optional, and it should be assumed == default_credentials_domain_name unless configured otherwise. andrea On Tue, Jul 14, 2015 at 8:49 PM David Kranz <dkr...@redhat.com> wrote: > Now that the tempest periodic jobs are back (thanks infra!), I was > looking into the real failures. It seems the main one is caused by the > fact that the v3 check for primary creds fails if 'admin_domain_name' in > the identity section is None, which it is when devstack configures > tempest for non-admin. > > The problem is with this code and there is even a comment related to > this issue. There are various ways to fix this but I'm not sure what the > value should be for the non-admin case. Andrea, any ideas? > > -David > > def get_credentials(fill_in=True, identity_version=None, **kwargs): > params = dict(DEFAULT_PARAMS, **kwargs) > identity_version = identity_version or CONF.identity.auth_version > # In case of "v3" add the domain from config if not specified > if identity_version == 'v3': > domain_fields = set(x for x in > auth.KeystoneV3Credentials.ATTRIBUTES > if 'domain' in x) > if not domain_fields.intersection(kwargs.keys()): > # TODO(andreaf) It might be better here to use a dedicated > config > # option such as CONF.auth.tenant_isolation_domain_name > params['user_domain_name'] = CONF.identity.admin_domain_name > auth_url = CONF.identity.uri_v3 > else: > auth_url = CONF.identity.uri > return auth.get_credentials(auth_url, > fill_in=fill_in, > identity_version=identity_version, > **params) > > > __________________________________________________________________________ > OpenStack Development Mailing List (not for usage questions) > Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe > http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev >
__________________________________________________________________________ OpenStack Development Mailing List (not for usage questions) Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
