[Security Groups] When using neutron CLI, if non-existing project is given when listing the SGs, a default SG is created

[Rodolfo Alonso]

When using the Neutron CLI, if the SGs are listed and a project is passed (as filter), even if the project does not exist, a default SG is created for this project.

This is happening when the user has admin permissions.

Example: http://paste.openstack.org/show/798194/

This is not happening with the OSC because the filter parameters are tested. Example:
  stack@dev18:/opt/stack$ openstack security group list --project wrong_project_2
  No project with a name or ID of 'wrong_project_2' exists.

Checking if the project exists, when this argument is passed, is expensive (a call to keystone must be done). This is also happening only when using the deprecated Neutron CLI. Instead of making this check inline, I would propose an api-paste method to check, in any API call, the existence of the project if the argument is passed. This check can be disabled only removing this filter from the api-paste config.

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/754390

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 18.0.0.0rc1 release candidate.

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Slawek Kaplonski <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/754390
Reason: This review is > 4 weeks without comment, and failed Zuul jobs the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[Brian Haley (brian-haley)]

Related to https://bugs.launchpad.net/neutron/+bug/1988026 ? Perhaps this can be closed.