can't get instances from different tenants even if policy.json is set properly for that

Bug #1464381 reported by Slawek Kaplonski
20
This bug affects 3 people
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Fix Released
Medium
Davanum Srinivas (DIMS)

Bug Description

As was said in http://lists.openstack.org/pipermail/openstack-operators/2015-June/007354.html even if policy.json is set to allow some user with special role to see instances from different tenant this settings are ignored and admin context is required.

Tags: api
Changed in nova:
status: New → Confirmed
importance: Undecided → Medium
assignee: nobody → Davanum Srinivas (DIMS) (dims-v)
Changed in nova:
assignee: Davanum Srinivas (DIMS) (dims-v) → nobody
Revision history for this message
George Shuklin (george-shuklin) wrote :

Steps to reproduce:

1. Add some user or tenant in nova's policy.json:

compute:get_all: "rule:admin or tenant:tenant_uuid_here"

2. Restart api

Ask from non-admin user in that tenant nova list --all-tenants

Expected result: list of all instances
Actual result: empty list without error

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to nova (master)

Fix proposed to branch: master
Review: https://review.openstack.org/191095

Changed in nova:
assignee: nobody → Davanum Srinivas (DIMS) (dims-v)
status: Confirmed → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on nova (master)

Change abandoned by Davanum Srinivas (dims) (<email address hidden>) on branch: master
Review: https://review.openstack.org/191095
Reason: will restore if/when blueprint gets approved

Matt Riedemann (mriedem)
tags: added: api
Changed in nova:
status: In Progress → Fix Committed
Thierry Carrez (ttx)
Changed in nova:
milestone: none → liberty-1
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in nova:
milestone: liberty-1 → 12.0.0
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.