the “admin”tenant can't show the server-group which created by common tenants

[Jinquan Ni]

virsion： icehouse

I have two tenants , admin tenant and common tenant called test .
I created a server-group called antiaffinitygroup under the test tenant.
but there is nothing when i login the admin tenant and list the server-group.

ex:
[root@njq002 ~(keystone_test)]# nova server-group-list
+--------------------------------------+-------------------+--------------------+---------+----------+
| Id | Name | Policies | Members | Metadata |
+--------------------------------------+-------------------+--------------------+---------+----------+
| 059bf32e-f416-4a27-b653-d78a147add80 | antiaffinitygroup | [u'anti-affinity'] | [] | {} |
+--------------------------------------+-------------------+--------------------+---------+----------+

[root@njq002 ~(keystone_admin)]# nova server-group-list
+----+------+----------+---------+----------+
| Id | Name | Policies | Members | Metadata |
+----+------+----------+---------+----------+
+----+------+----------+---------+----------+

This can lead to a problem:
In the admin tenant, the action will ignore any policys of server group when you resize or migrate the VM which belong to a common tenant

[zhaobo (zhaobo6)]

version ： juno
I had repro this issue on juno release. And I agree with you .

[Rui Chen (kiwik-chenrui)]

1. admin can't list the other tenant's server group in novaclient, because the novaclient don't support the 'all_projects' parameter,
    you can try GET /v2/${tenant_id}/os-server-groups?all_projects again, use curl.

2. I can't reproduce the issue about the resize/migrate broken group policy in the master, I think this issue had been fixed in BP https://blueprints.launchpad.net/nova/+spec/anti-affinity-on-migration.

code base:
stack@devstack:/opt/stack/nova$ [master]$ git log -1
commit 621c09595d2bf8b886b672f626d0da717098abf4

[jichenjc (jichenjc)]

I think current devstack head fixed this problem ? can we close this problem or only focus on Juno please? Thanks

jichen@devstack:~$ export OS_USERNAME=demo
jichen@devstack:~$ nova server-group-create sgc2 affinity
+--------------------------------------+------+---------------+---------+----------+
| Id | Name | Policies | Members | Metadata |
+--------------------------------------+------+---------------+---------+----------+
| 8b0d99f5-645b-427f-998a-c6f47745a425 | sgc2 | [u'affinity'] | [] | {} |
+--------------------------------------+------+---------------+---------+----------+
jichen@devstack:~$ nova server-group-list
+--------------------------------------+------+---------------+---------+----------+
| Id | Name | Policies | Members | Metadata |
+--------------------------------------+------+---------------+---------+----------+
| 69531647-8987-4872-a5cd-06b9a21b7fe6 | sgc1 | [u'affinity'] | [] | {} |
| 8b0d99f5-645b-427f-998a-c6f47745a425 | sgc2 | [u'affinity'] | [] | {} |
+--------------------------------------+------+---------------+---------+----------+
jichen@devstack:~$ export OS_USERNAME=admin
jichen@devstack:~$ nova server-group-list
+--------------------------------------+------+---------------+---------+----------+
| Id | Name | Policies | Members | Metadata |
+--------------------------------------+------+---------------+---------+----------+
| 69531647-8987-4872-a5cd-06b9a21b7fe6 | sgc1 | [u'affinity'] | [] | {} |
| 8b0d99f5-645b-427f-998a-c6f47745a425 | sgc2 | [u'affinity'] | [] | {} |
+--------------------------------------+------+---------------+---------+----------+

[John Garbutt (johngarbutt)]

So you need the admin user in the same tenant to see the same list of server-groups

The fact this list shows server groups is unrelated to migrate and other admin actions respecting the users selected server groups. The work to support those use cases better is still ongoing.

Please can we check this still reproduces on master?

[Launchpad Janitor (janitor)]

[Expired for OpenStack Compute (nova) because there has been no activity for 60 days.]