Comment 1 for bug 2051831
Revision history for this message
| Rodolfo Alonso (rodolfo-alonso-hernandez) wrote | #1 |
© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
1b1ed1a
(Get the code!)
Hello:
The issue was triggered by [1], one of the patches for OVN GW multihoming, but this patch is not the cause of it.
Since [1], if the router has a GW port and FIP is distributed, we update the local router port [2]. This method is retrieving the subnet of the external network. If this operation is done by a non-admin user, it will fail as reported. How to reproduce it:
* As admin, create an external network.
* As non-admin, in other project, create a router.
* Assign the external GW to the router (this step should be done first)
* Create a private network and subnet, and assign the subnet to the router --> that will trigger the error.
This error is due to the way we handle the subnet RBACs. The subnet object inherits the network RBACs. In the network query, we add an extra query hook filter [3] that add the following condition:
rbac_model.action == rbac_db_
That means external networks are also retrieved as "shared" networks. But this is not happening with the subnet query, leading to the reported error.
Because it is needed an urgent fix, I'll propose raising the context in the ``_get_
[1]https:/
[2]https:/
[3]https:/