Wrong DVR and HA properties reported to non-admin users

[Tom Verdaat]

Our routers are HA-DVR by default. Executing "openstack router list" as user with admin privileges correctly returns Distributed=True, HA=True. The same command executed as a regular user returns Distributed=False, HA=False which is factually incorrect.

Seems to me that regular users are being misinformed about the properties of their routers. Is this by design or is it a bug? If it is by design, what reason would we have to lie to our users?

[Assaf Muller (amuller)]

Last time I tried using the neutron client, the server did not return the 'ha' and 'distributed' fields and the CLI did not list them. This may be a regression of the openstack CLI.

[Tom Verdaat (tom-verdaat)]

I guess it could be a regression, or a version incompatibility? These are the versions used when I encountered this behavior:

Neutron-server: Mitaka 8.4.0
Openstackclient: 3.9.0
Neutronclient: 6.1.0

[Brian Haley (brian-haley)]

I just tried this on master, 'openstack router show $router' for user and admin showed different results for distributed and ha fields.

The reason is that they are marked as admin-only in policy.json, probably to keep info about actual deployment information private.

[Tom Verdaat (tom-verdaat)]

Thanks for confirming Brian.

I can understand the reason. However, would it not make more sense to display the correct information by default? Operators could always, for security reasons, tighten the policy to admin-only.

Also, if you want to hide this from users then it would also make more sense to have the API not output these fields to regular users when the policy is admin-only in stead of knowingly providing wrong information.

Just my 2 cents as both an OpenStack operator and user.

[Brian Haley (brian-haley)]

So this is a bug in openstacksdk and/or python-openstackclient code, by default it is showing both "distributed" and "ha" values (with defaults to False), even if they are not in the JSON body returned from neutron-server. I don't know of an easy way to fix that by specifying not to show it in that case.

The python-neutronclient doesn't show the values unless they are in the JSON body, but of course it's being deprecated...

I'll re-assign and maybe someone else has a thought on how to fix it.

[Slawek Kaplonski (slaweq)]

I agreed with Brian here and I removed neutron from affected projects for now. This should be fixed on openstacksdk and openstackclient

[Slawek Kaplonski (slaweq)]

Oh, and I proposed patches to fix it:
https://review.openstack.org/567606/ and https://review.openstack.org/567620

[Dr. Jens Harbott (j-harbott)]

sdk and OSC are now using storyboard, you should create a story at http://storyboard.openstack.org/ instead.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstacksdk 0.14.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/python-openstackclient 3.18.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/python-openstackclient 3.16.3 release.