The issue was triggered by [1], one of the patches for OVN GW multihoming, but this patch is not the cause of it.
Since [1], if the router has a GW port and FIP is distributed, we update the local router port [2]. This method is retrieving the subnet of the external network. If this operation is done by a non-admin user, it will fail as reported. How to reproduce it:
* As admin, create an external network.
* As non-admin, in other project, create a router.
* Assign the external GW to the router (this step should be done first)
* Create a private network and subnet, and assign the subnet to the router --> that will trigger the error.
This error is due to the way we handle the subnet RBACs. The subnet object inherits the network RBACs. In the network query, we add an extra query hook filter [3] that add the following condition:
rbac_model.action == rbac_db_models.ACCESS_EXTERNAL
That means external networks are also retrieved as "shared" networks. But this is not happening with the subnet query, leading to the reported error.
Because it is needed an urgent fix, I'll propose raising the context in the ``_get_nets_and_ipv6_ra_confs_for_router_port`` method. A proper fix handling the subnet RBACs should be proposed later.
Hello:
The issue was triggered by [1], one of the patches for OVN GW multihoming, but this patch is not the cause of it.
Since [1], if the router has a GW port and FIP is distributed, we update the local router port [2]. This method is retrieving the subnet of the external network. If this operation is done by a non-admin user, it will fail as reported. How to reproduce it:
* As admin, create an external network.
* As non-admin, in other project, create a router.
* Assign the external GW to the router (this step should be done first)
* Create a private network and subnet, and assign the subnet to the router --> that will trigger the error.
This error is due to the way we handle the subnet RBACs. The subnet object inherits the network RBACs. In the network query, we add an extra query hook filter [3] that add the following condition: models. ACCESS_ EXTERNAL
rbac_model.action == rbac_db_
That means external networks are also retrieved as "shared" networks. But this is not happening with the subnet query, leading to the reported error.
Because it is needed an urgent fix, I'll propose raising the context in the ``_get_ nets_and_ ipv6_ra_ confs_for_ router_ port`` method. A proper fix handling the subnet RBACs should be proposed later.
[1]https:/ /review. opendev. org/c/openstack /neutron/ +/874199 /github. com/openstack/ neutron/ blob/ca8e5b62e8 f093a1d1ceb37a9 88e76d0a7ecd42f /neutron/ plugins/ ml2/drivers/ ovn/mech_ driver/ ovsdb/ovn_ client. py#L1755 /github. com/openstack/ neutron/ blob/ca8e5b62e8 f093a1d1ceb37a9 88e76d0a7ecd42f /neutron/ db/external_ net_db. py#L41- L57
[2]https:/
[3]https:/