Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions caso/extract/openstack/base.py
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@ def __init__(self, project, vo):
super(BaseOpenStackExtractor, self).__init__(project)

self.keystone = self._get_keystone_client()
self.keystone_unscoped = self._get_keystone_client(project_scoped=False)
self.project_id = self._get_project_id()

self.vo = vo
Expand Down Expand Up @@ -90,10 +91,10 @@ def _get_keystone_session(self):
session = keystone_client.get_session(CONF, self.project)
return session

def _get_keystone_client(self):
def _get_keystone_client(self, project_scoped=True):
"""Get a Keystone Client for the configured project in the object."""
client = keystone_client.get_client(
CONF, project=self.project, system_scope="all"
CONF, project=self.project if project_scoped else None, system_scope="all"
)
return client

Expand Down Expand Up @@ -125,7 +126,7 @@ def _get_project_id(self):
def _get_keystone_user(self, uuid):
"""Get the Keystone username for a given uuid."""
try:
user = self.keystone.users.get(user=uuid)
user = self.keystone_unscoped.users.get(user=uuid)
Comment on lines 58 to +129
Copy link

Copilot AI Feb 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new keystone_unscoped client attribute and its usage in _get_keystone_user lack test coverage. While the existing tests mock BaseOpenStackExtractor.__init__ (which prevents breaking existing tests), consider adding tests that verify:

  1. The unscoped client is created with project=None and system_scope="all"
  2. The _get_keystone_user method correctly uses the unscoped client to fetch user information
  3. Error handling works as expected when the unscoped client lacks permissions

This is important because the change addresses what appears to be an OpenStack permissions issue that should be validated through testing.

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Feb 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider adding a comment explaining why an unscoped Keystone client is needed here. The change from using self.keystone to self.keystone_unscoped suggests this addresses an OpenStack permissions issue where project-scoped tokens may not have permission to query user information. A brief comment would help future maintainers understand the reasoning, for example:

"Use unscoped client with system scope to query user information, as project-scoped tokens may lack permissions to access users across all projects."

Copilot uses AI. Check for mistakes.
return user.name
except keystoneauth1.exceptions.http.Forbidden as e:
LOG.error(f"Unauthorized to get user {uuid}")
Expand Down
Loading