Use graduated oslo.policy instead of oslo-incubator code

Bug #1458945 reported by Samuel de Medeiros Queiroz on 2015-05-26
14
This bug affects 3 people
Affects Status Importance Assigned to Milestone
Barbican
Fix Released
Medium
Juan Antonio Osorio Robles
Ceilometer
Undecided
Unassigned
Cinder
Medium
Ivan Kolodyazhny
Glance
Undecided
Unassigned
Ironic
Fix Released
Undecided
Unassigned
MagnetoDB
Medium
Unassigned
Magnum
Fix Released
Undecided
Unassigned
Manila
Undecided
Unassigned
Mistral
Undecided
Unassigned
Murano
High
Ekaterina Chernova
OpenStack Compute (nova)
Undecided
Jeffrey Zhang
OpenStack DBaaS (Trove)
Undecided
Unassigned
OpenStack Dashboard (Horizon)
Undecided
Unassigned
OpenStack Heat
Fix Released
Medium
Unassigned
OpenStack Identity (keystone)
Undecided
Unassigned
OpenStack Object Storage (swift)
Undecided
Unassigned
Rally
Undecided
Unassigned
Sahara
Fix Released
Medium
Sergey Lukjanov
congress
Medium
Peter Balland
neutron
Undecided
Ihar Hrachyshka

Bug Description

The Policy code is now be managed as a library, named oslo.policy.

If there is a CVE level defect, deploying a fix should require deploying a new version of the library, not syncing each individual project.

All the projects in the OpenStack ecosystem that are using the policy code from oslo-incubator should use the new library.

affects: keystone → nova
Changed in nova:
assignee: nobody → Samuel de Medeiros Queiroz (samueldmq)
affects: nova → keystone
no longer affects: keystone
no longer affects: swift
Ruby Loo (rloo) on 2015-05-26
no longer affects: ironic
Changed in rally:
status: New → Invalid
Thomas Herve (therve) on 2015-05-26
no longer affects: heat
zouyee (zoues) on 2015-05-27
Changed in trove:
status: New → Invalid
no longer affects: sahara
no longer affects: manila
Tim Simmons (timsim) on 2015-05-27
no longer affects: designate
Lin Hua Cheng (lin-hua-cheng) wrote :
Changed in horizon:
status: New → In Progress

Thanks Lin, the change is now merged.

"Use graduated version of oslo.policy"
https://review.openstack.org/#/c/164420/

Changed in horizon:
status: In Progress → Fix Released

The change on Glance side is already merged.

"Use graduated oslo.policy"
https://review.openstack.org/#/c/162368/

Changed in glance:
status: New → Fix Released

Fix released on Keystone side.

"Use oslo.policy instead of incubated version"
https://review.openstack.org/#/c/148624/

Changed in keystone:
status: New → Fix Released
Changed in murano:
importance: Undecided → High
milestone: none → 2015.1.1
status: New → Confirmed
assignee: nobody → Ekaterina Chernova (efedorova)
tags: added: oslo
Ivan Kolodyazhny (e0ne) on 2015-06-02
Changed in cinder:
assignee: nobody → Ivan Kolodyazhny (e0ne)
Changed in cinder:
status: New → Confirmed
Changed in nova:
status: New → Confirmed
Lingxian Kong (kong) wrote :

currently, policy mechanism is not supported in Mistral

Changed in mistral:
status: New → Invalid
Changed in neutron:
assignee: nobody → shihanzhang (shihanzhang)
Changed in magnetodb:
importance: Undecided → Medium
milestone: none → liberty-1
status: New → Confirmed
Chris Dent (cdent) wrote :
Changed in ceilometer:
status: New → Fix Released

There is another neutron bug for that: https://bugs.launchpad.net/neutron/+bug/1426082 I take neutron component on me since I'm working on it.

Changed in neutron:
assignee: shihanzhang (shihanzhang) → Ihar Hrachyshka (ihar-hrachyshka)
Changed in neutron:
status: New → Confirmed

There was another bug in Neutron for this. See https://bugs.launchpad.net/neutron/+bug/1426082, which is now marked as duplicate. Thanks Ihar Hrachyshka

I am re-adding the projects which were marked as 'no longer affects' and then invalidating them, so that we can keep track of the status of this change for the whole OpenStack ecosystem.

People who marked as 'no longer affects' and respective projects are:

Samuel Merritt (torgomatic) on swift
Ruby Loo (rloo) on ironic
Thomas Herve (therve) on heat
Sergey Reshetnyak (sreshetniak) on sahara
Valeriy Ponomaryov (vponomaryov) on manila
Tim Simmons (tim-simmons-t) on designate

Thomas Herve (therve) on 2015-06-02
Changed in heat:
status: New → Fix Committed
Sergey Lukjanov (slukjanov) wrote :

Unable to edit status, but it was released as part of Kilo release - https://github.com/openstack/sahara/commit/5b35bdffb5b452332e2d616222e14e879cdf8bdc

Graham Hayes (grahamhayes) wrote :

LP won't let me edit the designate status - but it is invalid (we already removed it as it was not an issue for us)

Heat change 'Switch to oslo.policy'

 https://review.openstack.org/#/c/171527/

Kiall Mac Innes (kiall) on 2015-06-02
no longer affects: designate
no longer affects: swift

Ironic change 'Use oslo_policy package'

https://review.openstack.org/#/c/162501/

Ruby Loo (rloo) wrote :
Changed in ironic:
status: New → Fix Released
Changed in sahara:
status: New → Fix Released
assignee: nobody → Sergey Lukjanov (slukjanov)
importance: Undecided → Medium

Manila change 'Use oslo_policy lib instead of oslo-incubator code'

https://github.com/openstack/manila/commit/a4a60b1328443f6a1d5a85884f029e3fa683c142

Peter Balland (pballand) on 2015-06-02
Changed in congress:
assignee: nobody → Peter Balland (pballand)
importance: Undecided → Medium
milestone: none → liberty-1
status: New → Confirmed
John Dickinson (notmyname) wrote :

Swift doesn't yet use oslo policy (incubated or library), so this bug doesn't apply

Changed in swift:
status: New → Invalid
Jay Bryant (jsbryant) on 2015-06-02
Changed in cinder:
importance: Undecided → Medium
Changed in heat:
importance: Undecided → Medium

Fix proposed to branch: master
Review: https://review.openstack.org/188088

Changed in murano:
status: Confirmed → In Progress

Reviewed: https://review.openstack.org/188088
Committed: https://git.openstack.org/cgit/openstack/murano/commit/?id=8d4f7c0aa88b81505d2ad07c4979c929eecb4c0a
Submitter: Jenkins
Branch: master

commit 8d4f7c0aa88b81505d2ad07c4979c929eecb4c0a
Author: Ekaterina Chernova <email address hidden>
Date: Wed Jun 3 18:25:41 2015 +0300

    Use oslo.policy instead of incubated version

    Corresponding changes were made in murano common policy file
    and in requirements.

    Change-Id: Ic7c4f61db0bb2655c4c0041500bd74e8890ea038
    Closes-Bug: #1458945

Changed in murano:
status: In Progress → Fix Committed
Changed in neutron:
status: Confirmed → In Progress
Peter Balland (pballand) wrote :
Changed in congress:
status: Confirmed → In Progress

Reviewed: https://review.openstack.org/188552
Committed: https://git.openstack.org/cgit/openstack/congress/commit/?id=6da0511be3d886e8377e3882be663423e38f8865
Submitter: Jenkins
Branch: master

commit 6da0511be3d886e8377e3882be663423e38f8865
Author: Peter Balland <email address hidden>
Date: Tue Jun 2 16:45:39 2015 -0700

    Use graduated oslo.policy

    - Add oslo.policy to requirements.txt
    - Update Enforcer constructor to account for new config parameter
    - Update policy_file references to account for new config section
    - Remove in-tree copy of oslo.policy

    Partial-Bug: #1458945
    Change-Id: Ifad815a98d6d8efc9c84bd03cb31a40bbfeff948

Peter Balland (pballand) on 2015-06-05
Changed in congress:
status: In Progress → Fix Committed

Fix proposed to branch: master
Review: https://review.openstack.org/189660

Changed in cinder:
status: Confirmed → In Progress

Reviewed: https://review.openstack.org/176711
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=9143ce10e422bd17c4817dfe08163879e0e5a4ca
Submitter: Jenkins
Branch: master

commit 9143ce10e422bd17c4817dfe08163879e0e5a4ca
Author: Ihar Hrachyshka <email address hidden>
Date: Thu Apr 23 12:12:52 2015 +0200

    Consume oslo.policy

    Some non intrusive changes to tests are needed, so that we don't rely on
    library symbols that are now private (f.e. parse_rule).

    Closes-Bug: #1458945
    Change-Id: I90326479e908042fec9ecb25fa19a8dd5b15e7d8

Changed in neutron:
status: In Progress → Fix Committed

Change abandoned by Ivan Kolodyazhny (<email address hidden>) on branch: master
Review: https://review.openstack.org/189660
Reason: Fixed in https://review.openstack.org/#/c/165688

This commit was merged in Barbican here https://review.openstack.org/#/c/172071/

Changed in barbican:
status: New → Fix Committed
assignee: nobody → Juan Antonio Osorio Robles (juan-osorio-robles)
Changed in barbican:
importance: Undecided → Medium
milestone: none → liberty-1
Thierry Carrez (ttx) on 2015-06-24
Changed in heat:
milestone: none → liberty-1
status: Fix Committed → Fix Released
Thierry Carrez (ttx) on 2015-06-24
Changed in neutron:
milestone: none → liberty-1
status: Fix Committed → Fix Released
Changed in barbican:
status: Fix Committed → Fix Released
Download full text (93.9 KiB)

Reviewed: https://review.openstack.org/196097
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=1cfed745d54a6ce9cb3dd4e6f454666d9e6676c2
Submitter: Jenkins
Branch: feature/qos

commit ba7d673d1ddd5bfa5aa1be5b26a59e9a8cd78a9f
Author: Kevin Benton <email address hidden>
Date: Thu Jun 25 18:31:38 2015 -0700

    Remove duplicated call to setup_coreplugin

    The test case for vlan_transparent was calling setup_coreplugin
    before calling the super setUp method which already calls
    setup_coreplugin. This was causing duplicate core plugin fixtures
    which resulted in patching the dhcp periodic check twice.

    Change-Id: Ide4efad42748e799d8e9c815480c8ffa94b27b38
    Partial-Bug: #1468998

commit e64062efa3b793f7c4ce4ab9e62918af4f1bfcc9
Author: Kevin Benton <email address hidden>
Date: Thu Jun 25 18:29:37 2015 -0700

    Remove double mock of dhcp agent periodic check

    The test case for the periodic check was patching a target
    that the core plugin fixture already patched out. This removes
    that and exposes the mock from the fixture so the test case
    can reference it.

    Change-Id: I3adee6a875c497e070db4198567b52aa16b81ce8
    Partial-Bug: #1468998

commit 25ae0429a713143d42f626dd59ed4514ba25820c
Author: Kevin Benton <email address hidden>
Date: Thu Jun 25 18:24:10 2015 -0700

    Remove double fanout mock

    The test_mech_driver was duplicating a fanout mock already setup
    in the setUp routine.

    Change-Id: I5b88dff13113d55c72241d3d5025791a76672ac2
    Partial-Bug: #1468998

commit 993771556332d9b6bbf7eb3f0300cf9d8a2cb464
Author: Kevin Benton <email address hidden>
Date: Thu Jun 25 17:55:16 2015 -0700

    Remove double callback manager mocks

    setup_test_registry_instance() in the base test case class gives
    each test its own registry by mocking out the get_callback_manager.
    The L3 agent test cases were duplicating this.

    Partial-Bug: #1468998
    Change-Id: I7356daa846524611e9f92365939e8ad15d1e1cd8

commit 0be1efad93734f11cd63fb3b7bd2983442ce1268
Author: Kevin Benton <email address hidden>
Date: Thu Jun 25 16:57:30 2015 -0700

    Remove ensure_dirs double-patch

    test_spawn_radvd called mock.patch on ensure_dirs after the
    setup method already patched it out. This causes issues when
    mock.patch.stopall() is called because the mocks are stored
    as a set and are unwound in a non-deterministic fashion.[1]
    So some of the time they will be undone correctly, but others
    will leave a monkey-patched in mock, causing the ensure_dir
    test to fail.

    1. http://bugs.python.org/issue21239

    Closes-Bug: #1467908
    Change-Id: I321b5fed71dc73bd19b5099311c6f43640726cd4

commit 0a2238e34e72c17ca8a75e36b1f56e41a3ece74e
Author: Sukhdev Kapur <email address hidden>
Date: Thu Jun 25 15:11:28 2015 -0700

    Fix tenant-id in Arista ML2 driver to support HA router

    When HA router is created, the framework creates a network and does
    not specify the tenant-id. This casuse Arista ML2 driver to fail.
    This patch sets the tenant-id when it is not passed explicitly by
    by the network_create() call from the HA r...

tags: added: in-feature-qos
Changed in murano:
status: Fix Committed → Fix Released

Change abandoned by Kyle Mestery (<email address hidden>) on branch: feature/pecan
Review: https://review.openstack.org/196701
Reason: This is lacking the functional fix [1], so I'll propose a new merge commit which includes that one.

[1] https://review.openstack.org/#/c/196711/

Download full text (171.5 KiB)

Reviewed: https://review.openstack.org/196920
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=7f759c077f8f860c13db92d2ea6b353ef6b70900
Submitter: Jenkins
Branch: feature/pecan

commit 8123144fadd7c5d5e6e56a76ea860512619a2cf6
Author: Moshe Levi <email address hidden>
Date: Sun Jun 28 14:37:14 2015 +0300

    Fix Consolidate sriov agent and driver code

    This patch add mising __init to mech_sriov/mech_driver/
    and update the setup.cfg to the new agent entrypoint

    Trivial Fix

    Change-Id: I53a527081feb78472f496675bbb3c5121d38a14a

commit 8942fccf02e6e179d47582fdb2792a1ca972da21
Author: Assaf Muller <email address hidden>
Date: Mon Jun 29 11:38:51 2015 -0400

    Remove failing SafeFixture tests

    The fixtures 1.3 release attempted to fix the fixtures resource
    leak issue, but failed to do so completely. Our own SafeFixture
    is still needed: The 1.3 release broke our SafeFixture tests,
    but not the usage of SafeFixture itself. This patch removes
    those failing tests for now to unbreak the gate. Jakub reported
    a bug on fixtures 1.3:
    https://bugs.launchpad.net/python-fixtures/+bug/1469759

    We will continue to use SafeFixture until that bug is fixed
    in fixtures, at which point we will be able to require
    fixtures > 1.3.

    Change-Id: I59457c3bb198ff86d5ad55a1e623d008f0034b8f
    Closes-Bug: #1469734

commit 71dffb0a2c1720cd8233a329d32958a0160dd6f5
Author: Kevin Benton <email address hidden>
Date: Mon Jun 29 08:27:41 2015 +0000

    Revert "Removed test_lib module"

    This reverts commit 9a6536de6e1a7fe9b2552adc142e254426b82b6f.

    We pulled all of the plugins out of the tree, many of which still inherit
    from neutron test classes. This change then stated that we no longer
    support testing other plugins. I think this is a bit premature and should
    have been discussed under the subject
    "Neutron plugins can't use neutron plugin unit tests" or something
    similar.

    Change-Id: I68318589f010b731574ea3bfa8df98492bab31fc

commit b20fd81dbd497e058384a0af065dd0f1fdc4c728
Author: Jakub Libosvar <email address hidden>
Date: Fri Jun 5 14:32:51 2015 +0000

    Refactor NetcatTester class

    Following capabilities were added:
       - used transport protocol is passed as a constant instead of bool
       - src port for testing was added
       - connection can be established explicitly
       - change constructor parameters of NetcatTester

    As a part of removing bool for protocol definition
    get_free_namespace_port() was also modified to match the behavior.

    Change-Id: Id2ec322e7f731c05a3754a65411c9a5d8b258126

commit 83e37980dcd0b2bad6d64dd2cb23bcd2891cafca
Author: jingliuqing <email address hidden>
Date: Sat Jun 27 13:41:54 2015 +0800

    Use REST rather than ReST

    Change-Id: I06c9deaab58c5ec13bfeec39fb8fd4b1fe21f42d

commit 1b60df85ba3ad442c2e4e7e52538e1b9a1bf9378
Author: Kevin Benton <email address hidden>
Date: Thu Jun 25 18:34:38 2015 -0700

    Add a double-mock guard to the base test case

    Use mock to patch mock with a check to prevent multiple active
    patches to the...

tags: added: in-feature-pecan
Changed in nova:
assignee: nobody → Jeffrey Zhang (jeffrey4l)
Changed in nova:
status: Confirmed → In Progress
Changed in manila:
status: New → Invalid
Changed in magnum:
assignee: nobody → Akash Gangil (akashg1611)
Adrian Otto (aotto) on 2015-08-10
Changed in magnum:
importance: Undecided → Wishlist
status: New → Fix Committed
Changed in magnum:
assignee: Akash Gangil (akashg1611) → nobody
Adrian Otto (aotto) on 2015-08-10
Changed in magnum:
importance: Wishlist → Undecided
Changed in cinder:
status: In Progress → Fix Committed
Thierry Carrez (ttx) on 2015-09-03
Changed in cinder:
milestone: none → liberty-3
status: Fix Committed → Fix Released
Thierry Carrez (ttx) on 2015-10-15
Changed in barbican:
milestone: liberty-1 → 1.0.0
Thierry Carrez (ttx) on 2015-10-15
Changed in heat:
milestone: liberty-1 → 5.0.0
Thierry Carrez (ttx) on 2015-10-15
Changed in cinder:
milestone: liberty-3 → 7.0.0
Thierry Carrez (ttx) on 2015-10-15
Changed in neutron:
milestone: liberty-1 → 7.0.0
Adrian Otto (aotto) on 2015-11-24
Changed in magnum:
milestone: none → mitaka-1
status: Fix Committed → Fix Released

Reviewed: https://review.openstack.org/198065
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=a4b2ade4794d5952527181abf1ee482dd16b8295
Submitter: Jenkins
Branch: master

commit a4b2ade4794d5952527181abf1ee482dd16b8295
Author: Jeffrey Zhang <email address hidden>
Date: Thu Jul 2 23:58:10 2015 +0800

    use graduated oslo.policy

    - Add oslo.policy to requirements.txt
    - Remove in-tree copy of oslo.policy

    Change-Id: Ia6fef939cfe0df33476ccee365934a5d2878f90d
    Partial-Bug: #1458945

It looks like commit [1] resolved this bug completely. The command:

    grep -R "from nova.openstack.common import policy"

didn't bring any result in the current nova code base (commit 5bef6fbc0).
It's already available in:

    git tag --contains a4b2ade4794d5952527181abf1ee482dd16b8295
    13.0.0.0b2
    13.0.0.0b3

References:
[1] https://git.openstack.org/cgit/openstack/nova/commit/?id=a4b2ade4794d5952527181abf1ee482dd16b8295

Changed in nova:
status: In Progress → Fix Committed

For some reason Launchpad times out when I try to set the status to "Fix Released" (which is the correct one).

Matt Riedemann (mriedem) on 2016-03-22
Changed in nova:
status: Fix Committed → Fix Released
Tim Hinrichs (thinrichs) on 2016-04-22
Changed in congress:
milestone: liberty-1 → newton-1
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.