tenants seem like they were able to detach admin enforced QoS policies from ports or networks

[Miguel Angel Ajo]

NOTE: Even if the API responds with "ok" to the port update, it's not really changing the admin enforced policy, we should just provide a better
error / response code.

If the CSP is using manually tagging specific tenant networks to follow specific qos profiles, a tenant could use

neutron port-update <port-id> --no-qos-policy

or

neutron net-update <net-id> --no-qos-policy

It will seem like if the port or net was correctly updated, but it isn't. We can lower the importance of this bug to low/medium.

[changzhi (changzhi)]

Even admin tenant can not update other tenant's resource?

[Miguel Angel Ajo (mangelajo)]

admin should be able to do it, but not tenants (when it's not their own policy).

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/217092

[OpenStack Infra (hudson-openstack)]

Change abandoned by Armando Migliaccio (<email address hidden>) on branch: master
Review: https://review.openstack.org/217092
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[Armando Migliaccio (armando-migliaccio)]

If you are still working on this please resume, or allow someone else to pick this up.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/217092
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=4ec6932c93764fd7731928f1faa24b6c88fa9493
Submitter: Jenkins
Branch: master

commit 4ec6932c93764fd7731928f1faa24b6c88fa9493
Author: Tong Li <email address hidden>
Date: Tue Sep 15 17:23:42 2015 -0400

    Respond negatively to tenant detachment of enforced QoS policies

    Currently when the tenant attempts to detach an enforced QoS policy
    for a port or network set by admin, the attempt fails but the API
    feedback indicates that it was successful. This change will
    fix the API response so the failure is accurately signalled
    to the tenant.

    Co-Authored-By: litong01 <email address hidden>
    Co-Authored-By: gong yong sheng <[e-mail]>
    Co-Authored-By: Nate Johnston <email address hidden>
    Co-Authored-By: Margaret Frances <email address hidden>

    Change-Id: I977feecc6cce378abc1e6092afbaf9f2681b2ec6
    Closes-bug: #1486607

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/neutron 9.0.0.0b2 development milestone.

[Ihar Hrachyshka (ihar-hrachyshka)]

Mitaka is now critical/CVE only.