Project deleted (with resources left orphaned)

[Josue Palmerin]

Detailed bug description:

Customer reported an issue where he was able to delete a project with the admin account even with the project still having an instance and a network. The instance and the network are now orphaned and do not have a project assigned. Additionally, the owner of the project can no longer manage the instance via horizon or CLI.

Steps to reproduce:

1. Create test user with admin account
2. Create test project and assign test user as admin
3. Log into test project with test user account
4. Create test network and subnet
5. Launch test instance
6. Log out of test project
7. Log in as admin user to admin project
8. Delete test project - Project deletes successfully.
9. Try to log in as test user to Horizon gets "You are not authorized for any projects." Error as expected.
10. Try nova list with test user via CLI gets:
root@node-1:~# nova list
ERROR (Unauthorized): The request you have made requires authentication. (HTTP 401) (Request-ID: req-a77e5e5c-e919-4f6b-ad0f-99e44771d8da)
11. Do nova show <Instance_ID> with admin user and project and instance is active showing test project as its project.

Expected result:
Project should not be able to be deleted if the Project still has resources (Instances, networks, etc).

Actual result:
Project can be deleted regardless of whether it houses resources.

Reproducibility:
100% in MOS 7.0

Workaround:
None that I know.

Impact:
Project owner can no longer manage their resources.

Description of the environment:
[root@fuel ~]# cat /etc/fuel/version.yaml
VERSION:
  feature_groups:
    - mirantis
  production: "docker"
  release: "7.0"
  openstack_version: "2015.1.0-7.0"
  api: "1.0"
  build_number: "301"
  build_id: "301"
  nailgun_sha: "4162b0c15adb425b37608c787944d1983f543aa8"
  python-fuelclient_sha: "486bde57cda1badb68f915f66c61b544108606f3"
  fuel-agent_sha: "50e90af6e3d560e9085ff71d2950cfbcca91af67"
  fuel-nailgun-agent_sha: "d7027952870a35db8dc52f185bb1158cdd3d1ebd"
  astute_sha: "6c5b73f93e24cc781c809db9159927655ced5012"
  fuel-library_sha: "5d50055aeca1dd0dc53b43825dc4c8f7780be9dd"
  fuel-ostf_sha: "2cd967dccd66cfc3a0abd6af9f31e5b4d150a11c"
  fuelmain_sha: "a65d453215edb0284a2e4761be7a156bb5627677"

Network model:
VLANS

[Javier Diaz Jr (javierdiazcharles)]

I was able to reproduce this on my own as well. There are more than just instances and networks being orphaned here. You also have volumes, glance images, and essentially everything that can be assigned to a project.

I propose that keystone checks the tenants to see if there are any resources available in them. One idea would be to scan the database (i.e. select * from instances where project_id='tenant' and deleted=0;) if any of these select commands return an active resource keystone should send an error to the user both via Horizon and CLI that they need to delete the available resources or migrate them before deleting a tenant.

[Boris Bobrov (bbobrov)]

This is a known existing problem in OpenStack. Please see http://lists.openstack.org/pipermail/openstack-operators/2015-February/006118.html for discussion.

I am marking it as "Wishlist" because no resource cleanup now exists in OpenStack.

[Boris Bobrov (bbobrov)]

I am also removing "Assigned to", because keystone already emits notifications and all projects can listen to them.

[Roman Podoliaka (rpodolyaka)]

I agree with Boris'es take on this: it's essentially a feature request, that will require blueprints / specs in upstream for each OpenStack project.

[Roman Podoliaka (rpodolyaka)]

We can give it a try in upstream in Newton.

[Roman Podoliaka (rpodolyaka)]

^ at the same time it won't be backported to previous releases, thus, marking as Won't Fix.