Access rules visibility and deletion locks lookup should be performed using elevated context
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| OpenStack Shared File Systems Service (Manila) |
Fix Released
|
Undecided
|
Unassigned | ||
Bug Description
Description
===========
Access rules details should be hidden from users when a visibility lock has been placed, as well as the deletion should be prevented when a deletion lock is in place. Currently, we are not looking up for existing resource locks within all projects when listing or deleting access rules.
Steps to reproduce
==================
With the demo user:
- create a share
- create a VM
- attach the share to the VM via the nova API
- nova-compute uses nova's service token to create an access to the user provided share
- list the access for their share and see the access created by the nova service user
Expected result
===============
The IP of the access rule should be redacted and not displayed to the demo user.
Actual result
=============
The IP is not being redacted and it is being displayed.
Environment
===========
1. Devstack in the master branch, Ubuntu 22.04
2. VirtioFS series applied
| summary: |
- Access rules visibility and deletion should look for locks in all - projects + Access rules visibility and deletion locks lookup should be performed by + elevated context |
| summary: |
- Access rules visibility and deletion locks lookup should be performed by - elevated context + Access rules visibility and deletion locks lookup should be performed + using elevated context |
| description: | updated |

Fix proposed to branch: master /review. opendev. org/c/openstack /manila/ +/935732
Review: https:/