Neutronclient failures throw unhelpful "Unexpected Exception"

[Augustina Ragwitz]

We are seeing some bug reports coming in where users experience an "Unexpected Exception" error when neutronclient fails. This is not particularly helpful for anyone experiencing this issue and it would be nice to have something more specific to aid in troubleshooting.

We could arguably blanket wrap all connection failures from neutronclient in nova.network.neutronv2.api and raise those up as something more specific. See cinderclient usage in nova, for example.

like https://github.com/openstack/python-neutronclient/blob/master/neutronclient/common/exceptions.py#L204 or https://github.com/openstack/python-neutronclient/blob/master/neutronclient/common/exceptions.py#L109

[Augustina Ragwitz (auggy)]

See this bug for an example of a reported issue - https://bugs.launchpad.net/nova/+bug/1563513

[Matt Riedemann (mriedem)]

Yeah, we should wrap neutronclient calls and handle 401/403 type errors with the appropriate NovaException which are handled in the REST API so we don't spew 500s for misconfiguration or auth issues.

[Matt Riedemann (mriedem)]

Bug 1567655 is also related to this. It turns out that the neutron security group driver in nova is doing direct calls to the python-neutronclient rather than using our network API abstraction in nova.network.neutronv2.api.API. The problem with this is if we added error handling to the neutron API wrapper that we have, the security group driver for neutron doesn't benefit from that.

[Matt Riedemann (mriedem)]

This gets a bit weird, at least for bug 1567655, because in that case the error comes from keystoneauth (the ConnectFailed exception) because the auth values in nova.conf for neutron are wrong, so the request connection fails.

python-neutronclient doesn't handle that error from keystoneauth so nova would have to handle both, if it's going to handle both.

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/309550

[Matt Riedemann (mriedem)]

sahid has a related change here: https://review.openstack.org/#/c/312014/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/312014
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=80d39a65062a424c9efe42257a38a09c6af2f3e9
Submitter: Jenkins
Branch: master

commit 80d39a65062a424c9efe42257a38a09c6af2f3e9
Author: Sahid Orentino Ferdjaoui <email address hidden>
Date: Tue May 3 06:54:21 2016 -0400

    network: handle unauthorized exception from neutron

    Neutron can raise an unauthorized exception for an expired or invalid
    token. In case of admin context we log a message to inform operators
    that the Neutron admin creadential are not well configured then return
    a 500 to user. In case of user context we return 401.

    Change-Id: I87c8b86373967639eb55b4cc3b7d6cbd9780f3ac
    Closes-Bug: #1571722

[OpenStack Infra (hudson-openstack)]

Change abandoned by Matt Riedemann (<email address hidden>) on branch: master
Review: https://review.openstack.org/309550

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/nova 14.0.0.0b3 development milestone.