Merge ~gabriel-samfira/simplestreams:use-region-name into simplestreams:master

[Gabriel Samfira]

When using a multi-region shared keystone, we must pass in the region or at least an endpoint overide to the glance and keystone clients, otherwise the wrong region can be selected from the shared keystone session, as the same keystone is responsible for multiple regions.

[Erlon R. Cruz (sombrafam)]

How did you test this change? I would expect code to add, parse, and store --region, but I don't see any.

review: Needs Fixing

[Gabriel Samfira (gabriel-samfira)]

Hi Erlon,

The code to add, parse and store region is already there:

https://git.launchpad.net/simplestreams/tree/bin/sstream-mirror-glance#n65

I tested it by deploying it and having it work as intended. In a multi-region shared keystone environment, with this patch, simplestreams uploaded the glance image to the correct region. Without it, it always attempted to connect to the glance endpoint from a different region.

Same for swift.

[Gabriel Samfira (gabriel-samfira)]

As a general rule, we must always either specify the region name, or filter endpoints based on region name, for any OpenStack client.

We cannot assume that there will always be only one region per cloud. We have 3 in the same keystone catalog, with more to follow.

The only (potential) exception to this rule is keystone itself. However, there are setups in which the keystone which serves as the authentication and authorization endpoint, may be different from the one we fetch the endpoints/catalog from.

So we must always specify the region name when instantiating OpenStack clients.

Unmerged commits

d3315c1... by Gabriel Samfira on 2023-09-27

Set region in swift and glance clients

When using a multi-region shared keystone, we must pass in the region or
at least an endpoint overide to the glance and keystone clients,
otherwise the wrong region can be selected from the shared keystone
session.

Signed-off-by: Gabriel Adrian Samfira <email address hidden>

diff --git a/simplestreams/mirrors/glance.py b/simplestreams/mirrors/glance.py
index b96f8eb..0e6f00c 100644
--- a/simplestreams/mirrors/glance.py
+++ b/simplestreams/mirrors/glance.py
@@ -39,7 +39,7 @@ def get_glanceclient(version='1', **kwargs):
     kskw = {k: kwargs.get(k) for k in pt if k in kwargs}
     if kwargs.get('session'):
         sess = kwargs.get('session')
-        return glanceclient.Client(version, session=sess)
+        return glanceclient.Client(version, session=sess, endpoint=kwargs.get('endpoint', None))
     else:
         return glanceclient.Client(version, **kskw)
 
diff --git a/simplestreams/objectstores/swift.py b/simplestreams/objectstores/swift.py
index f2c0d5b..f05cd80 100644
--- a/simplestreams/objectstores/swift.py
+++ b/simplestreams/objectstores/swift.py
@@ -31,6 +31,11 @@ def get_swiftclient(**kwargs):
     nmap = {'endpoint': 'preauthurl', 'token': 'preauthtoken'}
     pt = ('insecure', 'cacert')
 
+    region = kwargs.get("region", None)
+    os_opts = {
+        "region_name": region,
+        "endpoint": kwargs.get("endpoint", None),
+    }
     connargs = {v: kwargs.get(k) for k, v in nmap.items() if k in kwargs}
     connargs.update({k: kwargs.get(k) for k in pt if k in kwargs})
     if kwargs.get('session'):
@@ -38,12 +43,13 @@ def get_swiftclient(**kwargs):
         try:
             # If session is available try it
             return Connection(session=sess,
-                              cacert=kwargs.get('cacert'))
+                              cacert=kwargs.get('cacert'),
+                              os_options=os_opts)
         except TypeError:
             # The edge case where session is availble but swiftclient is
             # < 3.3.0. Use the old style method for Connection.
             pass
-    return Connection(**connargs)
+    return Connection(**connargs, os_options=os_opts)
 
 
 class SwiftContentSource(cs.IteratorContentSource):
@@ -71,7 +77,7 @@ class SwiftObjectStore(objectstores.ObjectStore):
 
         conn_info = openstack.get_service_conn_info('object-store',
                                                     **self.keystone_creds)
-        self.swiftclient = get_swiftclient(**conn_info)
+        self.swiftclient = get_swiftclient(**conn_info, region=region)
 
         # http://docs.openstack.org/developer/swift/misc.html#acls
         self.swiftclient.put_container(self.container,