Private flavor update with horizon will cause access issue of existed instances

[Wei T]

How to reproduce

1. create a private flavor "private-flavor"
2. add a tenant access to "private-flavor"
3. use regular user to create instance "XXX" with "private-flavor"
4. add/remove tenant access to the "private-flavor" via horizon
5. nova show XXX, will be end with error message say do not have access to the flavor

Root cause,

add/remove tenant access to the "private-flavor" via horizon. will do delete old one which will also delete the access to the old flavor, create new one with the same configuration, and add accesses back to the new flavor.

The version before H3, horizon will pass flavor uuid to backend then will create new flavor with the same uuid, that's why it didn't cause problem, but it also cause another bug https://bugs.launchpad.net/horizon/+bug/1276371

one quick solution is mark deleted flavor as public in nova

[Wei T (nuaafe)]

Related to https://bugs.launchpad.net/nova/+bug/1366168

[Wei T (nuaafe)]

If https://bugs.launchpad.net/nova/+bug/1366168 got fixed, this bug can be closed

[Gary W. Smith (gary-w-smith)]

Closing per comment 2

[Julie Pichon (jpichon)]

The Nova patch is currently -2d and I have a Horizon patch ready for this, so I'm reopening and assigning to myself.

There are 3 issues once this problem occurs:

1. The Instance details page become inaccessible. This is particularly problematic because of the Console tab, as it means end-users cannot access the console anymore
2. The Resize screen doesn't open anymore, so users can't even switch the instance to use another flavor that is accessible to them
3. For operations that requires updates for "in progress" operations, the instance row disappears from the table because of the failure to get the flavor

Even if the Nova patch merges soon, I think the Horizon one remains useful because it lets us handle failures on retrieving flavor information more gracefully. Even if that API call fails and we can't tell what's the size of the instance, we shouldn't bar the user from using the console or accessing other information.

The problem can also be reproduced in Juno and Icehouse.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/136306

[Julie Pichon (jpichon)]

Another way to reproduce is simply to edit the flavor in step 4. Because update is a delete + recreate operation, the flavor id changes and regular users cannot get information about their instance flavor anymore, as non-admin are not allowed to access deleted data from Nova in general. The flavor_get() call returns a 404.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/136306
Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=b50413ca0afa456dbbbb6ec554db0de67bb7b3ff
Submitter: Jenkins
Branch: master

commit b50413ca0afa456dbbbb6ec554db0de67bb7b3ff
Author: Julie Pichon <email address hidden>
Date: Thu Nov 20 15:24:14 2014 +0000

    Gracefully handle failures to retrieve a flavor

    In some cases, a flavor in use can become unaccessible, for instance
    after deleting a flavor with access restrictions.

     * On the Instance details page, make the try/except blocks for API
       calls more fine-grained. Some specific failures shouldn't cause the
       whole page to fail to load (and e.g. prevent Console access).

     * Fix the Resize Instance form to display even if information about
       the current flavor cannot be retrieved.

     * Gracefully handle failures to retrieve flavor information on AJAX
       calls for row update, so that the row doesn't disappear from the
       table.

    Change-Id: I011b6e01eca3e04e5ef2528732b9bde3782b4eba
    Closes-Bug: #1366166

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/137420

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/juno
Review: https://review.openstack.org/137667

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/137420
Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=38d117532dc2586e6947fafca7a86dfb63607e0a
Submitter: Jenkins
Branch: master

commit 38d117532dc2586e6947fafca7a86dfb63607e0a
Author: Julie Pichon <email address hidden>
Date: Wed Nov 26 17:28:31 2014 +0000

    Include instance name in errors on Instance Details

    Change-Id: Ib54f5f34b007a6a9f91097ed290e51c54b0f517b
    Related-Bug: #1366166

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/137667
Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=bcac1a89b991b41c34f011b7578fceac7320cf80
Submitter: Jenkins
Branch: stable/juno

commit bcac1a89b991b41c34f011b7578fceac7320cf80
Author: Julie Pichon <email address hidden>
Date: Thu Nov 20 15:24:14 2014 +0000

    Gracefully handle failures to retrieve a flavor

    In some cases, a flavor in use can become unaccessible, for instance
    after deleting a flavor with access restrictions.

     * On the Instance details page, make the try/except blocks for API
       calls more fine-grained. Some specific failures shouldn't cause the
       whole page to fail to load (and e.g. prevent Console access).

     * Fix the Resize Instance form to display even if information about
       the current flavor cannot be retrieved.

     * Gracefully handle failures to retrieve flavor information on AJAX
       calls for row update, so that the row doesn't disappear from the
       table.

    Conflicts:
     openstack_dashboard/dashboards/project/instances/tests.py

    Change-Id: I011b6e01eca3e04e5ef2528732b9bde3782b4eba
    Closes-Bug: #1366166
    (cherry picked from commit b50413ca0afa456dbbbb6ec554db0de67bb7b3ff)