Comment 6 for bug 1760822

Revision history for this message
Graham Hayes (grahamhayes) wrote :

Not all project IDs are UUIDs unfortunately - in the past I have worked on clouds were they were ints, The keystone validator is very loose [1]

There is work happening on storing quota limit information in keystone, that will ensure the ID is attached to a real project, so my thoughts would be to wait for that work to complete.

If this is required in the meantime, we would need to do vaildation in the quota object [2].
This would need to be off by default, and enabled by a config value, and it should override the the objects validate() method and call keystone to see if the ID is actually a project.

1 - https://github.com/openstack/keystone/blob/b9dee7332374d9a382c8403d646909e0c70a90ac/keystone/common/validation/parameter_types.py#L38-L45
2 - https://github.com/openstack/designate/blob/master/designate/objects/quota.py