Project tags is too restrictive

[jessegler]

Currently, when querying project tags it only matches projects that have exactly the parameters given and no additional parameters. This is out of alignment with both the project tags spec and nova.

This is best explained by example:

Consider two projects: p1 and p2
p1 has tags [blue, green, red]
p2 has tag [blue]

tags=blue is only returning p1. It should return both p1 and p2.
tags=blue,green is returning no projects. This should return p1.
tags-any=blue is returning p1 and p2. This should continue to return both p1 and p2.
tags-any=blue,yellow is returning both p1 and p2. This should continue to return both.

This also applies to not-tags and not-tags-any.

not-tags=blue is returning p1 and it should not.
not-tags=blue,green currently returning both p1 and p2. It should not return p1.
not-tags-any=blue should continue to not return both p1 and p2.
not-tags-any=blue,yellow should continue not to return either p1 or p2.

In other words, tags is currently returning projects that have an exact set of it's parameters. It should return projects that have a superset of it's parameters -- or all the parameters and maybe some other stuff.

tags should logically AND it's parameters
tags-any should logically OR it's parameters

This will bring us into alignment with the tags spec (although perhaps the tags spec could be updated to be clearer?) and also with Nova's server tags implementation.

[Gage Hugo (gagehugo)]

This follows with the API-WG spec[0]'s example on combining tags, the example given is currently not possible with "exact" matching vs subset.

GET /servers?tags=red,blue&tags-any=green,orange

The above example returns any servers that have the “red” and “blue” tags, plus at least one of “green” and “orange”.

[0] https://specs.openstack.org/openstack/api-wg/guidelines/tags.html#filtering-and-searching-by-tags

[Rajat Sharma (tajar29)]

I have reproduced this bug, on my env, for "not-tags-any=blue" it is still return both p1 and p2.

[Nicolas Helgeson (nhelgeson)]

Hi Rajat, this bug should be fixed once patch https://review.openstack.org/#/c/523499/ has been merged.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/554327

[Gage Hugo (gagehugo)]

This may affect KSC as well, see [0].

[0] https://review.openstack.org/#/c/553108/3/keystone/resource/backends/sql.py@182

[Gage Hugo (gagehugo)]

jessegler noticed that Lance's example when testing the keystone fix was passing in a list of tags as opposed to a comma-delimited string of tags into KSC, which currently is not supported.

However, this use case seems valid and perhaps KSC should support a list of tag strings as input.

In [26]: ks.projects.list(tags_any=['blue', 'yellow'])
Out[26]: []

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/553108
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=4b572e564dcd5d9f8f608caba922f844f24cbc00
Submitter: Zuul
Branch: master

commit 4b572e564dcd5d9f8f608caba922f844f24cbc00
Author: Gage Hugo <email address hidden>
Date: Wed Mar 14 18:32:57 2018 -0500

    Make tags filter match subset rather than exact

    Currently when using the "tags" filter to search projects by tag names,
    the filter only matches projects that have an exact match. Projects that
    contain the exact tags given, but with additional tags are excluded.
    This behavior is not compatible with the use cases defined in both the
    keystone[0] and api-wg[1] specs, notibly with the "tags" and "tags-any"
    interaction.

    This change makes it so that "tags" filtering will be performed by
    matching a subset containing given tags against projects, rather than
    exact matching. This allows the "tags" and "tags-any" filters to work as
    described in both [0] and [1].

    [0] https://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/project-tags.html
    [1] https://specs.openstack.org/openstack/api-wg/guidelines/tags.html#filtering-and-searching-by-tags

    Co-Authored By: Nicolas Helgeson <email address hidden>

    Closes-Bug: #1756190
    Change-Id: I632efdf0af2969be0a59dc5928a6c036eeca6051

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone 14.0.0.0b1 development milestone.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Nicolas Helgeson (<email address hidden>) on branch: master
Review: https://review.openstack.org/554327

[Colleen Murphy (krinkle)]

I tested this and I believe ksc/osc is not affected by this, the server-side changes were enough to return the correct result.