openstack project list can not list the project which is domain.

[liuxiuli]

version:mitaka
question:
In project table of keystone database, there are following projects:
+----------------------------------+--------------------------+-------+-----------------------------------------------+---------+--------------------------+-----------+-----------+
| id | name | extra | description | enabled | domain_id | parent_id | is_domain |
+----------------------------------+--------------------------+-------+-----------------------------------------------+---------+--------------------------+-----------+-----------+
| 1e424dd1844b4a7d81d5b167f188192d | heat | {} | Owns users and projects created by heat | 1 | <<keystone.domain.root>> | NULL | 1 |
| 388ba5efe7c24cd6b4762b9c6f60a5d5 | magnum | {} | Owns users and projects created by magnum | 1 | <<keystone.domain.root>> | NULL | 1 |
| 4d6e4e79ea1f4ec392475308e11a895d | admin | {} | Bootstrap project for initializing the cloud. | 1 | default | default | 0 |
| 749e9ebce1d24c4aa5463382c6d2c526 | demo | {} | | 1 | default | default | 0 |
| 9314197e00bc43e197995681cff786cc | alt_demo | {} | | 1 | default | default | 0 |
| <<keystone.domain.root>> | <<keystone.domain.root>> | {} | | 0 | <<keystone.domain.root>> | NULL | 1 |
| b79ace1760194778916e18cfb053a6d1 | service | {} | | 1 | default | default | 0 |
| cf443a4f9b9749c9a172915ce48d7989 | project_a | {} | | 1 | default | default | 0 |
| d076df0e55d24881a61325cd6bb7f6f4 | project_b | {} | | 1 | default | default | 0 |
| d90353b3872749719e2a5c9343f9acce | invisible_to_admin | {} | | 1 | default | default | 0 |
| default | Default | {} | The default domain | 1 | <<keystone.domain.root>> | NULL | 1 |
+----------------------------------+--------------------------+-------+-----------------------------------------------+---------+--------------------------+-----------+-----------+

But when I execute openstack project list, I got following result:
+----------------------------------+--------------------+
| ID | Name |
+----------------------------------+--------------------+
| 4d6e4e79ea1f4ec392475308e11a895d | admin |
| 749e9ebce1d24c4aa5463382c6d2c526 | demo |
| 9314197e00bc43e197995681cff786cc | alt_demo |
| b79ace1760194778916e18cfb053a6d1 | service |
| cf443a4f9b9749c9a172915ce48d7989 | project_a |
| d076df0e55d24881a61325cd6bb7f6f4 | project_b |
| d90353b3872749719e2a5c9343f9acce | invisible_to_admin |
+----------------------------------+--------------------+

The project which is domain can not list, such as heat, magnum, <<keystone.domain.root>>, Default.

[Henry Nash (henry-nash)]

Ah, looks to me that the documentation update for how to do this. The project list API can be specified with "is_domain" as a query parameter, e.g.:

GET /projects?is_domain

...which should list the project acting as the root domain. We chose to enforce having to explicitly specify this so as not to surprise people with extra entries in their listing when they upgraded to Mitaka. [As an aside, the parent_id of the project acting as a domain will be reported in the above listing as "null", not "<<keystone.domain.root>>" - which is an internal-only value to keystone to allow us to use sql referential integrity for our tables].

Let me know if this works for.

I'll fix the documentation for this.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/322010

[liuxiuli (liu-lixiu)]

Can you tell me how to specify with "is_domain" as a query parameter in "openstack project list" cmd. I use following cmd and it report error.
[root@SBCJSlot5Rack2Centos7 /]# openstack project list -C "is_domain"
No recognized column names in ['is_domain']

[Henry Nash (henry-nash)]

Ah, damn! Looks like the openstackclient has not been updated either! OK, I'll have to fix that. What I would expect you to be able to do (once I've fixed, which I will do asap), will be to issue a command like:

openstack project list --is_domain

In the meantime, if you want to experiment, you could fire the raw http command at your keystone server (using curl of whatever), e.g.:

curl -s \
 -H "X-Auth-Token: $OS_TOKEN" \
 http://localhost:5000/v3/projects?is_domain | python -mjson.tool

where OS_TOKEN contains your project scoped token ID and localhost is replaced by the IP address of your keystone server.

Alternatively, you can use the python-keystoneclient library to write a little python example.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/322010
Committed: https://git.openstack.org/cgit/openstack/keystone-specs/commit/?id=4cdd66da2b77cd04fed1da8a41d617a3f4a21934
Submitter: Jenkins
Branch: master

commit 4cdd66da2b77cd04fed1da8a41d617a3f4a21934
Author: Henry Nash <email address hidden>
Date: Fri May 27 09:50:06 2016 +0100

    Document supported query option for list projects

    The option to list all projects acting as a domain had been
    missed from the GET /projects API specification.

    Change-Id: Icdd4b9a9a9806bfa4b742eabb54acc07609d835a
    Partial-Bug: #1586289

[Deepa (dpaclt)]

Is this fixed in any release ?

[Raghuram (krishraghuram)]

I dont think it is fixed.

user@controller:~$ openstack project list
+----------------------------------+---------+
| ID | Name |
+----------------------------------+---------+
| 9120311bc9e24827813399acc2777425 | user |
| aecce721ce1c44ff888ba9e147cee902 | service |
| dadc2c84f4fe4403966b4757f7f341d8 | admin |
| e8d692f31cdf479490404560ea37a4b8 | stud |
+----------------------------------+---------+
user@controller:~$ openstack project list --is_domain
usage: openstack project list [-h] [-f {csv,json,table,value,yaml}]
                              [-c COLUMN] [--max-width <integer>] [--noindent]
                              [--quote {all,minimal,none,nonnumeric}]
                              [--domain <domain>] [--user <user>] [--long]
openstack project list: error: unrecognized arguments: --is_domain
user@controller:~$ keystone-manage --version
9.2.0
user@controller:~$

[Lance Bragstad (lbragstad)]

This issues is fixed in keystone server [0], and it returns the `is_domain` attribute when listing projects and when using the `is_domain` query parameter. I was able to recreate this using using master 6b2deb6414b9440e14e9a0b7b4b253ee95dbf984.

I think the issue here is actually in the client code (i.e. python-openstackclient or python-keystoneclinet) since it probably doesn't know how to interpret the `is_domain` logic from the server or the user.

For what it's worth, the `keystone-manage` command returns the server version, not the client version.

[0] http://paste.openstack.org/show/610658/