Manila driver issues kerberos-config-info API against SVM management LIF

Bug #2073766 reported by Jonathan Williams
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Shared File Systems Service (Manila)
Triaged
Medium
Gireesh Awasthi

Bug Description

We've found an additional issue that is not addressed in https://bugs.launchpad.net/manila/+bug/2069125

In this issue, when creating access for a share, the following behavior is seen with a SVM scoped user.

1. A net-interface-get-iter call is issued to ONTAP. This fetches both data LIFs and the management LIF

2. If the SVM management LIF is at the top of the returned net-interface-get-iter list, Manila will select that management LIF and run kerberos-config-get-iter against it. From that, Manila will deduce that Kerberos is *not* enabled which could be incorrect.

A management LIF will not have a Kerberos configuration. A Data LIF might have Kerberos enabled.

An example of the kerberos-config-get-iter response when issued against a data LIF...versus when issued against a management LIF (which returns a null response):

data lif:

<?xml version='1.0' encoding='UTF-8' ?>
<netapp version='1.221' xmlns='http://www.netapp.com/filer/admin'>

    <!-- Output of kerberos-config-get-iter [Execution Time: 56 ms] -->
     <results status='passed'>
          <attributes-list>
               <kerberos-config-info>
                    <interface-name>manila-nfs-data-01</interface-name>
                    <is-kerberos-enabled>true</is-kerberos-enabled>
                    <vserver>demo-manila-svm</vserver>
               </kerberos-config-info>
          </attributes-list>
          <num-records>1</num-records>
     </results>
</netapp>

mgmt lif:

<?xml version='1.0' encoding='UTF-8' ?>
<netapp version='1.221' xmlns='http://www.netapp.com/filer/admin'>

    <!-- Output of kerberos-config-get-iter [Execution Time: 48 ms] -->
     <results status='passed'>
          <num-records>0</num-records>
     </results>
</netapp>

There needs to be some logic in place so that the kerberos-config-get-iter check is only issued against data LIFS. Never against SVM management LIFs.

Tags: driver
Vida Haririan (vhariria)
tags: added: driver
Changed in manila:
assignee: nobody → Gireesh Awasthi (agireesh)
Vida Haririan (vhariria)
Changed in manila:
importance: Undecided → Medium
Revision history for this message
Vida Haririan (vhariria) wrote :
Changed in manila:
status: New → Triaged
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.