5:30 a.m.
Now that Accounts is getting taken out, how is the agent to determine its tenant ID?
The agent needs to know its tenant ID when inserting data into Hawkular Metrics.
Right now, the agent makes an explicit http call to the Accounts URL to obtain the tenant
of its user. If Accounts goes away, the only thing left that I can see is to make required
the agent attribute "tenantId" in standalone.xml configuraiton of the agent
subsystem.
Is that correct? There is no other way to get the tenant ID of a user now, I guess.
(for what its worth, tenant IDs are important in the Open Shift use-case)
6:09 a.m.
On 06.05.2016 12:30, John Mazzitelli wrote:
... is to make required the agent attribute "tenantId" in
standalone.xml configuraiton of the agent subsystem.
Is that correct? There is no other way to get the tenant ID of a user now, I guess.
Yes, that's also my understanding. Multi tenancy is to be managed
outside of Hawkular, by the consuming "platform" (MiQ or OpenShift).
- Juca.
6:55 a.m.
Can't you just consider the tenantId the same as the feedId? Or use some
fixed word, like 'global'? Please don't use the slashes, equal symbols and
others :)
As for the inventory, currently the tenant is auto-created with the very
first call to the rest api. There is no dedicated endpoint to create the
tenant. The tenant id is obtained from the accounts component. Probably,
this will be changed to get the tenant id from the http header. So all you
need to do is to start inserting the data with the correctly set tenant id
header.
jk
On Fri, May 6, 2016 at 12:30 PM, John Mazzitelli <mazz(a)redhat.com> wrote:
Now that Accounts is getting taken out, how is the agent to determine
its
tenant ID?
The agent needs to know its tenant ID when inserting data into Hawkular
Metrics.
Right now, the agent makes an explicit http call to the Accounts URL to
obtain the tenant of its user. If Accounts goes away, the only thing left
that I can see is to make required the agent attribute "tenantId" in
standalone.xml configuraiton of the agent subsystem.
Is that correct? There is no other way to get the tenant ID of a user now,
I guess.
(for what its worth, tenant IDs are important in the Open Shift use-case)
_______________________________________________
hawkular-dev mailing list
hawkular-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/hawkular-dev
7:21 a.m.
Can't you just consider the tenantId the same as the feedId? Or
use some
fixed word, like 'global'? Please don't use the slashes, equal symbols and
others :)
That's what I was thinking of doing to avoid requiring people to set the tenantId.
They can still set tenantId if they want something different, but, I think I will default
to the feed ID.
As for the inventory, currently the tenant is auto-created with the
very
first call to the rest api. There is no dedicated endpoint to create the
tenant. The tenant id is obtained from the accounts component. Probably,
this will be changed to get the tenant id from the http header. So all you
need to do is to start inserting the data with the correctly set tenant id
header.
Right. I would have to add that. Right now the agent only sends tenant ID header to
metrics. Looks like I will need to send it to inventory as well.
I wonder if we need to start passing tenant ID around in the websocket commands too?
Peter/Juca - with all the work you are doing in cmdgw stuff - do you know if we need to
add tenant ID to all the commands?
8:21 a.m.
I always thought tenants were more akin to grouping associated data,
like everything for datacenter-1, or company-x, and so users would have
their queries limited to their relevant data. If every feed has a
different tenantid by default, then wouldn't it be difficult to
consolidate data in a view? I know in H Alerting that tenantId is used
more in the fashion I discussed, and multi-tenant queries are not
efficient. It seems to me we'd be better off using a single default,
like "global-tenant".
On 5/6/2016 8:21 AM, John Mazzitelli wrote:
> Can't you just consider the tenantId the same as the feedId?
Or use some
> fixed word, like 'global'? Please don't use the slashes, equal symbols
and
> others :)
That's what I was thinking of doing to avoid requiring people to set the tenantId.
They can still set tenantId if they want something different, but, I think I will default
to the feed ID.
> As for the inventory, currently the tenant is auto-created with the very
> first call to the rest api. There is no dedicated endpoint to create the
> tenant. The tenant id is obtained from the accounts component. Probably,
> this will be changed to get the tenant id from the http header. So all you
> need to do is to start inserting the data with the correctly set tenant id
> header.
Right. I would have to add that. Right now the agent only sends tenant ID header to
metrics. Looks like I will need to send it to inventory as well.
I wonder if we need to start passing tenant ID around in the websocket commands too?
Peter/Juca - with all the work you are doing in cmdgw stuff - do you know if we need to
add tenant ID to all the commands?
_______________________________________________
hawkular-dev mailing list
hawkular-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/hawkular-dev
9:31 a.m.
----- Original Message -----
From: "Jay Shaughnessy" <jshaughn(a)redhat.com>
To: hawkular-dev(a)lists.jboss.org
Sent: Friday, May 6, 2016 9:21:59 AM
Subject: Re: [Hawkular-dev] accounts, tenants, the agent
I always thought tenants were more akin to grouping associated data, like
everything for datacenter-1, or company-x, and so users would have their
queries limited to their relevant data. If every feed has a different
tenantid by default, then wouldn't it be difficult to consolidate data in a
view? I know in H Alerting that tenantId is used more in the fashion I
discussed, and multi-tenant queries are not efficient. It seems to me we'd
be better off using a single default, like "global-tenant".
I always view tenants as being more of a user concern. As a user I can rent one or more
units in an apartment building and I control the keys to these apartments. I can only be
in one apartment at a time, but I can leave and go to another apartment I own if I want.
Other users can also rent one or more units in the building as well. There may be a
landlord (admin) who also has a key to all units as well.
I think we need to keep one default tenant for everything (eg 'hawkular' or
something generic) and not have a per feed tenant. You can't query or aggregate data
across tenants in Hawkular Metrics, and I would assume most users would want to have one
tenant by default rather than one tenant per feed. I assume that users will probably want
to perform aggregates across a cluster of similar machines, which you can't do if each
machine has a separate tenant id.
Tenants are also used for access control. In OpenShift they have projects (aka namespaces)
which we use as the tenant id. A user in OpenShift needs to specify that project they are
using when they perform any action, and access control is configured on a per project
basis. For metrics, when someone tries to access one of the endpoints, we verify that they
have access to the corresponding project in OpenShift before granting them access to the
corresponding metrics in Hawkular Metrics.
On 5/6/2016 8:21 AM, John Mazzitelli wrote:
Can't you just consider the tenantId the same as the feedId? Or use some
fixed word, like 'global'? Please don't use the slashes, equal symbols and
others :)
That's what I was thinking of doing to avoid requiring people to set the
tenantId. They can still set tenantId if they want something different, but,
I think I will default to the feed ID.
As for the inventory, currently the tenant is auto-created with the very
first call to the rest api. There is no dedicated endpoint to create the
tenant. The tenant id is obtained from the accounts component. Probably,
this will be changed to get the tenant id from the http header. So all you
need to do is to start inserting the data with the correctly set tenant id
header.
Right. I would have to add that. Right now the agent only sends tenant ID
header to metrics. Looks like I will need to send it to inventory as well.
I wonder if we need to start passing tenant ID around in the websocket
commands too?
Peter/Juca - with all the work you are doing in cmdgw stuff - do you know if
we need to add tenant ID to all the commands?
_______________________________________________
hawkular-dev mailing list hawkular-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/hawkular-dev
_______________________________________________
hawkular-dev mailing list
hawkular-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/hawkular-dev
3:58 a.m.
On 6 May 2016, at 16:31, Matt Wringe wrote:
I always view tenants as being more of a user concern. As a user I
can
rent one or more units in an apartment building and I control the keys
to these apartments. I can only be in one apartment at a time, but I
can leave and go to another apartment I own if I want. Other users can
also rent one or more
units in the building as well. There may be a landlord (admin) who
also has a key to all units as well.
This is a perfect analogy. Also the keys I have only allow me to go to
my apartments and prevent other users from entering in mine.
I think we need to keep one default tenant for everything (eg
'hawkular' or
Yes
something generic) and not have a per feed tenant. You can't
query or
Per feed is not the right granularity. A feed would be a single
apartment or
even a room within the apartment, while the tenant applies to all
apartments
I rented.
9:34 a.m.
H-Metrics is in the same situation as H-Alerts. The tenant id is really only used to
partition data; however, it is not the only thing used to partition data. H-Metrics
currently does not have any APIs for querying across multiple tenants. There is no
technical restriction or limitation that prevents us from doing so. More fine-grained
tenants won’t make querying in H-Metrics any less efficient because we are querying across
multiple partitions either way. We always do those queries in parallel. More fine-grained
tenants would have some implications though on how we design background jobs like
computing rollups.
On May 6, 2016, at 9:21 AM, Jay Shaughnessy
<jshaughn(a)redhat.com> wrote:
I always thought tenants were more akin to grouping associated data, like everything for
datacenter-1, or company-x, and so users would have their queries limited to their
relevant data. If every feed has a different tenantid by default, then wouldn't it be
difficult to consolidate data in a view? I know in H Alerting that tenantId is used more
in the fashion I discussed, and multi-tenant queries are not efficient. It seems to me
we'd be better off using a single default, like "global-tenant".
On 5/6/2016 8:21 AM, John Mazzitelli wrote:
>> Can't you just consider the tenantId the same as the feedId? Or use some
>> fixed word, like 'global'? Please don't use the slashes, equal
symbols and
>> others :)
> That's what I was thinking of doing to avoid requiring people to set the
tenantId. They can still set tenantId if they want something different, but, I think I
will default to the feed ID.
>
>> As for the inventory, currently the tenant is auto-created with the very
>> first call to the rest api. There is no dedicated endpoint to create the
>> tenant. The tenant id is obtained from the accounts component. Probably,
>> this will be changed to get the tenant id from the http header. So all you
>> need to do is to start inserting the data with the correctly set tenant id
>> header.
> Right. I would have to add that. Right now the agent only sends tenant ID header to
metrics. Looks like I will need to send it to inventory as well.
>
> I wonder if we need to start passing tenant ID around in the websocket commands too?
>
> Peter/Juca - with all the work you are doing in cmdgw stuff - do you know if we need
to add tenant ID to all the commands?
> _______________________________________________
> hawkular-dev mailing list
> hawkular-dev(a)lists.jboss.org <mailto:hawkular-dev@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/hawkular-dev
<https://lists.jboss.org/mailman/listinfo/hawkular-dev>
>
_______________________________________________
hawkular-dev mailing list
hawkular-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/hawkular-dev
4:20 p.m.
ManageIQ has the notion of "Zone" which is also used to group servers.
I.e.: Zone "Default" has 1 EVM Server, 2 Providers, etc.
Sometimes when I'm cathing up with ManageIQ code I wonder if our tenant concept in
Hawkular maps with this Zone concept.
If it matches, also I wonder who is responsible to assign the tenant (the ownership of
tenant belongs to the agent? to hawkular server ? ManageIQ ?), how/when (at agent
installation? at hawkular installation? at ManageIQ provider registration ?).
It is still an open point but good to discuss about it to see possible and cascade
implications (i.e. mixed tenants are possible ? In which scenarios ?)
----- Mensaje original -----
De: "John Mazzitelli" <mazz(a)redhat.com>
Para: "Discussions around Hawkular development"
<hawkular-dev(a)lists.jboss.org>
Enviados: Viernes, 6 de Mayo 2016 23:08:26
Asunto: Re: [Hawkular-dev] accounts, tenants, the agent
> It seems to me we'd be better off using a single default, like
> "global-tenant".
Good point. I think we should just ship with a global "hawkular" tenant ID
pre-configured and just let the customer change it if he wants.
_______________________________________________
hawkular-dev mailing list
hawkular-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/hawkular-dev
3084
days inactive
3087
days old
9 comments
8 participants
participants (8)
-
Heiko W.Rupp -
Jay Shaughnessy -
Jiri Kremser -
John Mazzitelli -
John Sanda -
Juraci Paixão Kröhling -
Lucas Ponce -
Matt Wringe