Manually assign --device and --device-owner to a port does NOT binds the port inmediatly

[Rodolfo Alonso]

This could be considered as a documentation bug.

When a VM is created (there is a device ID), a user can create a port and assign the port device_id to the VM ID and the device_owner="compute:nova". That makes this port visible when executing:
  $ openstack port list --server serverID

The port is not bound, of course. But when the VM is rebooted (hard reboot), the port is assigned and bound to this VM.

There is another related issue from the administrator point of view. A user can assign (by mistake or coincidence) the device ID of another project VM ID. This non-admin user can't see the other project VM. But the administrator, when executing the previous command, will see a VM assigned to a project with a port from another. This scenario:
* Is difficult to reproduce: the non-admin user must guess the VM ID of another project without having access.
* Affect only to the admin view, who can access to both projects.

[Rodolfo Alonso (rodolfo-alonso-hernandez)]

NOTE: terraform [1] also allows to define the device_id of a port. In any case, that should be commented in this tool (or disallowed).

[1]https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs/resources/networking_port_v2#device_id

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/854553

[Lajos Katona (lajos-katona)]

We discussed this during the drivers meeting (see the logs: [1]) and agreed the from Neutron perspective we have to document that this kind of bind is not working, and change the default policy of device-id.

[1]: https://meetings.opendev.org/meetings/neutron_drivers/2022/neutron_drivers.2022-08-26-14.00.log.html#l-149

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Arnaud Morin <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/854553
Reason: we will not do that, we will do a policy change instead

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron-lib/+/861167

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/861169

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/stein
Review: https://review.opendev.org/c/openstack/neutron-lib/+/861372

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Pierre Libeau <email address hidden>" on branch: stable/stein
Review: https://review.opendev.org/c/openstack/neutron-lib/+/861372
Reason: wrong gerrit

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron-lib/+/861167
Committed: https://opendev.org/openstack/neutron-lib/commit/a09d23b2dd8fb825028e342d7341314643cd49ef
Submitter: "Zuul (22348)"
Branch: master

commit a09d23b2dd8fb825028e342d7341314643cd49ef
Author: Pierre Libeau <email address hidden>
Date: Thu Oct 13 13:30:58 2022 +0200

    Add enforce_policy on device_id parameter

    Add enforce_policy=True on port for device_id parameter to build a new
    policy. The target is to authorize only admin to use this parameter.

    Related-Bug: #1986969

    Change-Id: I3d1c0ec074a5475091ee89f4f177b107fa61b264