Unable to force delete a volume

[Ryan Beisner]

By default, a project user cannot force delete a cinder volume, as may be necessary if a volume is stuck in a bad state for whatever reason/malfunction of the underlying cloud or storage.

ex:

A volume is stuck in a 'creating' state.

| 7b3cbee8-fad5-4f35-8c81-c794cdcb494f | juju-404c2e-auto-osci-sv04-volume-1 | creating | 40 | |

ubuntu@osci-bastion:~/git/charm-test-infra$ openstack volume delete --force 9efe89e2-6d2e-474d-b570-0657944af8de
Failed to delete volume with name or ID '9efe89e2-6d2e-474d-b570-0657944af8de': Policy doesn't allow volume_extension:volume_admin_actions:force_delete to be performed. (HTTP 403) (Request-ID: req-b97d3bf7-aac9-42a7-89e0-c3e1306b3b04)
1 of 1 volumes failed to delete.

Force deleting as admin succeeds.

[Ryan Beisner (1chb1n)]

https://review.openstack.org/#/c/583139/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/583139
Committed: https://git.openstack.org/cgit/openstack/charm-cinder/commit/?id=4ddea990d0fb142313b10bf87ebcb554b20ec37c
Submitter: Zuul
Branch: master

commit 4ddea990d0fb142313b10bf87ebcb554b20ec37c
Author: Chris MacNaughton <email address hidden>
Date: Tue Jul 17 10:06:52 2018 +0200

    Add policy.json to allow owner to force delete volumes

    The default in cinder is to only allow the admin to
    force delete a volume; this change allows the
    admin_or_owner to force delete a volume.

    Change-Id: I703a21b68186059a63f0d06d88cd2528e821f3d3
    Closes-Bug: #1782008

[Ryan Beisner (1chb1n)]

For clarity, the above referenced change landed, but was reverted due to a regression. This bug is still open.

https://review.openstack.org/#/c/583139/

[David Ames (thedac)]

Suggest we add gate >= Queens

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/635616

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/635616
Committed: https://git.openstack.org/cgit/openstack/charm-cinder/commit/?id=26c0dec5f325c2117ff878c8052a6014771055ec
Submitter: Zuul
Branch: master

commit 26c0dec5f325c2117ff878c8052a6014771055ec
Author: Chris MacNaughton <email address hidden>
Date: Tue Jul 17 10:06:52 2018 +0200

    Add policy to allow owner to force delete volumes

    The default in cinder is to only allow the admin to
    force delete a volume; this change allows the
    admin_or_owner to force delete a volume.

    This was previously authored by Chris MacNaughton in change
    I703a21b68186059a63f0d06d88cd2528e821f3d3
    And then reverted in change
    I77f9351da8516e5af40fea57400101e6dd16b528

    This change includes gating on the OpenStack version.

    Change-Id: I35599bae8a94724869a36c555ebfc6bf94384bd4
    Co-Authored-By: Chris MacNaughton <email address hidden>
    Closes-Bug: #1782008

[Ryan Beisner (1chb1n)]

Marking as NEW because I believe the committed fix was reverted. Please consider utilizing the custom policy.d framework instead.

[James Page (james-page)]

The original change was reverted and then a new version was landed so marking 'Fix Released'.

Would have made a nice example for the policyd support!

[Peter Matulis (petermatulis)]

I see this in /etc/cinder/policy.json:

{
    "volume_extension:volume_admin_actions:force_delete": "rule:admin_or_owner"
}

Is that what fixed this? Wouldn't this constitute an override of the default? Don't we want to actually fix the default?