Subusers cannot delete stacks with software config

Bug #1531606 reported by Drago
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Heat
Fix Released
Undecided
Drago

Bug Description

Subusers which cannot create or delete Keystone users cannot delete stacks that have Nova servers with their user_data_format set to SOFTWARE_CONFIG even though no stack users are created. User deletion should be skipped if no user has been created (based upon the existence of a user_id in the resource's data [1]), but because a user ID is *always* returned [2], Heat always attempts to delete a user through Keystone. When this call to Keystone 403s, the stack deletion fails.

To reproduce:
- Create a subuser that cannot create users itself
- Create a stack using a template like [3]
- Delete the stack using the subuser
Expected behavior:
- Stack creates and deletes successfully
Actual behavior:
- Stack creates successfully
- Stack deletion results in DELETE_FAILED

[1] https://github.com/openstack/heat/blob/208d2debd0459ad5ce27884f8f4bbc3c1979ab18/heat/engine/resources/stack_user.py#L91-L93
[2] https://github.com/openstack/heat/blob/208d2debd0459ad5ce27884f8f4bbc3c1979ab18/heat/engine/resources/stack_user.py#L75-L83
[3]
heat_template_version: 2013-05-23

parameters:
  flavor:
    type: string
    description: Flavor for the server to be created
    default: m1.small
    constraints:
      - custom_constraint: nova.flavor
  image:
    type: string
    description: Image ID or image name to use for the server
    constraints:
      - custom_constraint: glance.image

resources:
  server:
    type: OS::Nova::Server
    properties:
      image: { get_param: image }
      flavor: { get_param: flavor }
      user_data_format: SOFTWARE_CONFIG
      user_data: { get_resource: config }

  config:
    type: OS::Heat::SoftwareConfig
    config: |
      #!/bin/bash
      echo foo

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to heat (master)

Fix proposed to branch: master
Review: https://review.openstack.org/264351

Changed in heat:
assignee: nobody → Drago (dragorosson)
status: New → In Progress
Revision history for this message
Sergey Kraynev (skraynev) wrote :
Changed in heat:
milestone: none → mitaka-2
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.