skyline-apiserver — Interactions

Interactions — skyline-apiserver — branch stable/2026.2

Branch stable/2026.2 @ 4af72bfd4577 — repository https://opendev.org/openstack/skyline-apiserver — analysed on 2026-10-28

skyline-apiserver has no message bus and no cache server. It talks to Keystone (a lot), to Nova, Cinder, Glance, Neutron and Prometheus over HTTP, and to its own small SQL database. The sequences below were recorded by running the real application against a fake OpenStack (_rewrite/tools/outbound_capture.py, results in _rewrite/outbound-calls_stable-2026.2.md): they are exact in order, method, path, query and headers; response bodies of real services are [inferred] from the client libraries.

1. Keystone sessions and tokens

Three kinds of credentials are used. Which one a call uses matters for the rewrite: it decides whose permissions apply.

Common to all sessions: TLS CA = default.cafile (empty means the system store), timeout 30 s (skyline_apiserver/types/constants.py:43), no retry configured in Skyline (keystoneauth defaults: no retry on HTTP errors, connection retries 0) [inferred], endpoint interface openstack.interface_type (default public, skyline_apiserver/config/openstack.py:83).

Endpoint discovery. Every service endpoint is taken from the system session's catalog filtered by region and interface (skyline_apiserver/client/utils.py:111), even when the call is then made with the user session. An empty answer raises ValueError("Endpoint not found"). Note that keystone_url is only used for the system password authentication; all other identity calls go to the identity endpoint of the catalog for the session's region.

Version discovery. Each keystoneclient.Client(...) creation runs a GET <identity endpoint> (version document) before the real call (skyline_apiserver/client/utils.py:131); openstacksdk runs a GET <image endpoint> without token before listing images (skyline_apiserver/client/utils.py:147). Nova, Cinder and Neutron clients are given endpoint_override and do no discovery.

Request headers (recorded):

The user-facing Keystone requests carry no OpenStack-API-Version; KEYSTONE_API_VERSION = "3.13" (skyline_apiserver/types/constants.py:19) only selects the client class.

Sample frames (recorded)

System password authentication (first call of a worker):

POST /identity/v3/auth/tokens HTTP/1.1
Content-Type: application/json
Forwarded: for=10.0.0.7;by=keystoneauth1/5.17.0 python-requests/2.34.2 CPython/3.13.0

{"auth": {"identity": {"methods": ["password"], "password": {"user": {"name": "skyline", "domain": {"name": "Default"}, "password": "***"}}},
          "scope": {"project": {"name": "service", "domain": {"name": "Default"}}}}}

Validation of the user's token on every authenticated request (skyline_apiserver/core/security.py:66):

GET /identity/v3/auth/tokens HTTP/1.1
X-Auth-Token: <system token>
X-Subject-Token: <user token from the JWT or X-Auth-Token>

Re-scoping (user session, switch_project, login):

POST /identity/v3/auth/tokens HTTP/1.1
Content-Type: application/json

{"auth": {"identity": {"methods": ["token"], "token": {"id": "<user token>"}}, "scope": {"project": {"id": "<project id>"}}}}

TOTP second step (skyline_apiserver/api/v1/login.py:215):

POST /identity/v3/auth/tokens HTTP/1.1
Openstack-Auth-Receipt: <receipt>

{"auth": {"identity": {"methods": ["totp"], "totp": {"user": {"name": "mfa", "domain": {"name": "Default"}, "passcode": "123456"}}}}}

The first step answered 401 with header Openstack-Auth-Receipt and body {"receipt": {...}, "required_auth_methods": [["password", "totp"]]}; keystoneauth raises MissingAuthMethods from it (skyline_apiserver/api/v1/login.py:287).

2. Outbound REST per endpoint

Paths are relative to the catalog endpoint of each service. Session: S = system, U = user (re-scoped), L = login (unscoped or being scoped). Every authenticated endpoint starts with the middleware's validation pair GET /identity/v3 (S) + GET /v3/auth/tokens (S), not repeated below. Counts are the totals of the recorded scenarios, validation pair included; each keystoneclient call is preceded by a GET /identity/v3 discovery (not always repeated below).

Calls by target service

Wire details a re-implementation must reproduce:

• Cinder list filters id and snapshot_id are sent as the Python repr of a list: id=['a3e5…', 'b1c2…'] (python-cinderclient formats search_opts with str()). Cinder evaluates every filter value with ast.literal_eval (cinder:cinder/volume/api.py:2369), which turns it into an IN filter.
• Glance's id filter uses the in: operator: id=in:<id1>,<id2>.
• Neutron is mandatory for login. Every profile build calls Neutron GET /v2.0/extensions with the system session (skyline_apiserver/client/openstack/system.py:78). If the catalog has no network endpoint in the region, get_endpoint raises ValueError("Endpoint not found") (skyline_apiserver/client/utils.py:120), and _patch_profile turns it into a 401 (skyline_apiserver/api/v1/login.py:377): POST /login answers 401 {"detail": "Endpoint not found"} although Keystone has already issued the token. Checked in kind by the skyline-console reverse-spec session (reverse-spec-skyline-console/07-rewrite-pack_stable-2026.2.md § 3.1, § 6.3).
• Neutron list filters with several values are repeated keys (id=a&id=b); sort_key/sort_dir are repeated in pairs.
• Booleans to Cinder are sent as the strings True/False (skyline_apiserver/api/v1/extension.py:578).
• limit/marker are passed through to the service; Skyline fetches one page only (Nova and Neutron) and Cinder's count is the total.

Load per inbound call

The recorded counts give the cost model: every authenticated call = 2 Keystone calls (discovery + validation) + 1 SQL DELETE + 1 SQL SELECT (cookie path); every endpoint that builds a user session adds a re-scope POST /v3/auth/tokens; profile-returning endpoints add 6 more Keystone and 1 Neutron call. Nothing is cached between requests except the system token (per worker) and the policy files (by modification time). Keystone validation results are not cached (no keystonemiddleware, no memcached).

3. Database

• Engine: synchronous SQLAlchemy, database_url (default sqlite:////tmp/skyline.db; mysql://… for MariaDB, mapped to mysql+pymysql by Alembic only, skyline_apiserver/db/alembic/env.py:33); pool_pre_ping for non-SQLite (skyline_apiserver/db/base.py:71). The databases, aiomysql and aiosqlite requirements are not used by the code [inferred: leftovers of the former async layer].
• Transactions: none in practice. db.transaction() opens a session that no query uses (skyline_apiserver/db/base.py:36); each execute/fetch_* opens its own session and commits (skyline_apiserver/db/base.py:40). The SELECT … FOR UPDATE in update_setting is committed before the INSERT/UPDATE runs.
• Queries (reconstructed SQL):

-- every authenticated request
DELETE FROM revoked_token WHERE expire < :now_minus_1;
SELECT count(revoked_token.uuid) AS revoked_count FROM revoked_token WHERE revoked_token.uuid = :uuid;  -- cookie path only
-- logout
INSERT INTO revoked_token (uuid, expire) VALUES (:uuid, :exp);
-- settings
SELECT settings.key, settings.value FROM settings;
SELECT settings.key, settings.value FROM settings WHERE settings.key = :key;
SELECT settings.key, settings.value FROM settings WHERE settings.key = :key FOR UPDATE;  -- then
INSERT INTO settings (key, value) VALUES (:key, :value);  -- or UPDATE settings SET value=:value WHERE key=:key
DELETE FROM settings WHERE settings.key = :key;

• Migrations: Alembic 000 creates both tables with non-unique indexes; 001 replaces them with primary keys pk_revoked_token, pk_settings (skyline_apiserver/db/alembic/versions/001_add_primary_keys_to_skyline_tables.py:32). The migrated schema equals the model DDL except constraint names (_rewrite/schema-sqlite-migrated_stable-2026.2.sql).

4. nginx reverse proxy (deployment glue)

skyline-nginx-generator (skyline_apiserver/cmd/generate_nginx.py:230), run at container start, reads the full endpoint list from Keystone with the system account (GET /v3/endpoints?interface=<interface_type>, GET /v3/services, skyline_apiserver/cmd/generate_nginx.py:118) and renders skyline_apiserver/templates/nginx.conf.j2:

The paths in the profile's endpoints are exactly these locations (skyline_apiserver/client/openstack/system.py:76); the console prefixes its OpenStack calls with them (skyline-console:src/client/client/constants.js:46). Two endpoints of the same service type in one region make the generator fail (skyline_apiserver/cmd/generate_nginx.py:136). The proxy forwards the browser's X-Auth-Token unchanged: the OpenStack services authenticate the user themselves.

5. Files and other resources

No subprocess, no privileged operation, no outbound connection other than those listed.

Source: reverse-spec-skyline-apiserver/03-interactions_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.