Using keypair name on clusters and templates breaks with multiple users

[Corey O'Brien]

When UserA creates a cluster template and/or a cluster, they specify a keypair.

However, that keypair does not exist for all users. When UserB tries to create a cluster with a cluster template, a keypair with a matching name likely won't exist resulting in an error.

Furthermore, if UserA creates a cluster and then UserB updates the node_count (and happens to have a matching keypair name), the result is destructive because the keypair data for UserB is different so the Nova server has to be recreated.

In order to have multiple users manage Magnum clusters, Magnum may need to control the public key data and make it available to any account acting on the cluster.

[Anandprakash (atandale)]

Hi, Corey, can you give an example of this scenario?
Can you please tell me steps to reproduce?

[Corey O'Brien (coreypobrien)]

Hi, I'm not working on Magnum anymore, so I can't give you exact commands, but there are two examples to work with in the original bug description. Here's my rough guess at the commands from docs.

Example:

1. As UserA, create a template with `--name SharedTemplate --keypair UserA`
1. As UserA, create a cluster with `--name SharedCluster --cluster-template SharedTemplate --node-count=1`
1. As UserB, resize the cluster with `SharedCluster replace node_count=3`

Since UserB has no access to the keypair named "UserA", Heat re-creates all of the servers.