API-based Domain config method could temporarily show partial update

[Henry Nash]

When using the API-based domain config method, the options are not updated atomically. The result is that for a "cache update period", someone else reading the options (i.e. the processing of a user/group API call in another keystone process) might see a partial update.

[Steve Martinelli (stevemar)]

no patch yet, so i'm bumping to mitaka-3 as mitaka-2 is due tomorrow

[Steve Martinelli (stevemar)]

unassigning due to inactivity

[Steve Martinelli (stevemar)]

removing milestone target, this is not a blocker for the release, if someone picks it up we can target that milestone

[Dolph Mathews (dolph)]

So domain configuration is being cached without any cache invalidation occurring?

[Henry Nash (henry-nash)]

So we do invalidate the cache...the problem is we only want reads to see changes at the boundaries of the sets of "atomic" changes....and it's that bit we don't support. I'm working on making the updates atomic.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/290223

[Steve Martinelli (stevemar)]

removing target since it's not critical to release and not already gating

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/290223
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=8ce8c99023c797be6ea36c4d7a2889cf633bf279
Submitter: Jenkins
Branch: master

commit 8ce8c99023c797be6ea36c4d7a2889cf633bf279
Author: Henry Nash <email address hidden>
Date: Tue Mar 8 22:25:35 2016 +0000

    Make modifications to domain config atomic

    Currently, since creating or updating a domain config is
    done as a sequence of option creates/updates, it is possible
    for other keystone threads/processes to see a partial update
    if the cache timeout occurs in the middle of such an update.

    This patch makes the creation/updating of a domain config
    atomic (by doing it all within a common sql session), hence
    avoiding this issue.

    This issue has not been reported in the field - and is extremely
    difficult to test, so we are relying on code inspection to
    convince ourselves we have solved this issue.

    Since the domain config API is still marked as experimental, we
    do not gurantee backward compatability for the driver. Hence,
    although this patch modifies the driver interface, it does not
    include a new versioned driver.

    Closes-bug: 1517038
    Change-Id: I16598051ca456cf1c036c412111426b4cd9241b8

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/keystone 10.0.0.0b1 development milestone.