v2.0/extensions API exposes v3-only APIs

[Lance Bragstad]

The v2.0 API has an /extensions path that helps discoverability of extensions for v2.0 enabled for that deployment. When asking for v2.0 enabled extensions, you actually get APIs that are meant only for v3.

To recreate, just ask v2.0 for it's extensions, something like:

$ curl -X GET -H "Content-Type: application/json" http://192.168.122.160:35357/v2.0/extensions

Which gives you something like this:

http://paste.openstack.org/show/658357/

[Lance Bragstad (lbragstad)]

The following APIs are only accessible via the v3 path:

Oauth1: https://github.com/openstack/keystone/blob/d3818f05e31729ac86415d6f114f658d98a704ab/keystone/oauth1/routers.py#L66

Federation: https://github.com/openstack/keystone/blob/d3818f05e31729ac86415d6f114f658d98a704ab/keystone/federation/routers.py#L111

S3Token: https://github.com/openstack/keystone/blob/d3818f05e31729ac86415d6f114f658d98a704ab/keystone/contrib/s3/core.py#L58
https://github.com/openstack/keystone/blob/d3818f05e31729ac86415d6f114f658d98a704ab/keystone/contrib/s3/core.py#L70

The s3token routers extend of the v3 controller and router objects.

OS-REVOKE: https://github.com/openstack/keystone/blob/d3818f05e31729ac86415d6f114f658d98a704ab/keystone/revoke/routers.py#L22

OS-SIMPLE-CERT:
https://github.com/openstack/keystone/blob/d3818f05e31729ac86415d6f114f658d98a704ab/keystone/token/_simple_cert.py#L56
https://github.com/openstack/keystone/blob/d3818f05e31729ac86415d6f114f658d98a704ab/keystone/token/_simple_cert.py#L71

EC2 is the only API that should be accessible via the v2.0 path, at least until we can formally remove it in T:
https://github.com/openstack/keystone/blob/d3818f05e31729ac86415d6f114f658d98a704ab/keystone/contrib/ec2/routers.py#L27-L57

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/540141

[Lance Bragstad (lbragstad)]

The following specification, which landed in Kilo, does contain some information on the removal of the extensions model, but it doesn't really say anything about dealing with them in v2.0 [0].

[0] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/kilo/replace_extensions.html

[Adam Young (ayoung)]

Extensions should go away. They were not v2.0 or v3 specific.

[Lance Bragstad (lbragstad)]

Thanks for the follow up, Adam. I've removed them in the latest patch set. I think that also makes sense because we're only supporting the ec2tokens API on the v2.0 path until T, which doesn't mean we have to support the extensions API.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/540141
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=d5e9c0b4fe814ba6e6d36a7d1ea676914c79e5eb
Submitter: Zuul
Branch: master

commit d5e9c0b4fe814ba6e6d36a7d1ea676914c79e5eb
Author: Lance Bragstad <email address hidden>
Date: Thu Feb 1 21:14:50 2018 +0000

    Remove all v2.0 APIs except the ec2tokens API

    The only API we're supporting on the v2.0 path until the T release is
    the ec2tokens API. This commit removes all routers from the public
    and admin v2.0 applications. This includes the extensions API. This
    commit also removes unused v2.0 controller logic.

    Change-Id: I523c1215899ac9ee605df6bf717643c0ba87c761
    Closes-Bug: 1746798

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone 13.0.0.0rc1 release candidate.