keystoneauth/releasenotes/notes/retry-authenticated-discovery-19c4354ff983f507.yaml
Monty Taylor 26ad02db0f Fetch discovery documents with auth when needed
Some services, like Nova, default to requiring auth for their
versioned discovery documents. This means strict discovery
does not work on them, because discovery as it is now defaults
to not sending auth. Just changing the default would be a behavior
change resulting in sending unneeded data with *every* request.
Instead, respond to Unauthorized exceptions by retrying the request
with auth token. This way discovery will work for services that
are otherwise blocking unauthenticated access, and will get more
efficient over time as those services improve.

Depends-On: https://review.opendev.org/#/c/685999
Change-Id: I8a33e8a05bed0f18e4e42431f6d16b8a6a5270ef
2019-10-04 18:36:29 +02:00

15 lines
611 B
YAML

---
fixes:
- |
Retry version discovery with auth token when the initial request
throws 401 Unauthorized. There are some services that are erroneously
defaulting to authenticated discovery, and this allows discovery
to work properly on them.
upgrade:
- |
If keystoneauth and openstacksdk are both in use and keystoneauth
is upgraded to this release **before** upgrading openstacksdk to
``0.36.1`` or later, creation of ServerGroup objects with policies
and use of Ansible Inventory could be adversely affected. See
https://review.opendev.org/#/c/685999/ for more details.