Instance delete causing port leak

[Chuck Carmack]

Nova can cause a neutron port leak after deleting an instance.

If neutron has the port binding extension installed, then nova uses admin credentials to create the port during instance create:
https://github.com/openstack/nova/blob/master/nova/network/neutronv2/api.py#L537

However, during instance delete, nova always uses the user creds:
https://github.com/openstack/nova/blob/master/nova/network/neutronv2/api.py#L739

Depending on the neutron policy settings, this can leak ports in neutron.

Can someone explain this behavior?

We are running on nova kilo.

[Sean M. Collins (scollins)]

What are your policy settings for the following in your neutron policy.json?

    "create_port:binding:host_id": ,
    "create_port:binding:profile":
    "get_port:binding:vif_type":
    "get_port:binding:vif_details":
    "get_port:binding:host_id":
    "get_port:binding:profile":
    "update_port:binding:host_id":
    "update_port:binding:profile":

[Chuck Carmack (chuckcarmack75)]

Sean, thanks for the info in the channel. Marking the bug invalid.

[Chuck Carmack (chuckcarmack75)]

I think the problem we are having is that we added "VMAdmin" to the delete port rule.

We have this:

    "owner": "tenant_id:%(tenant_id)s",
    "admin_or_vm_admin_owner": "role:admin or (tenant_id:%(tenant_id)s and role:VMAdmin)",
    "admin_or_vm_admin_network_owner": "role:admin or (tenant_id:%(network:tenant_id)s and role:VMAdmin)",
    "vm_admin_owner_or_vm_admin_network_owner": "rule:admin_or_vm_admin_network_owner or rule:admin_or_vm_admin_owner",

    ...

    "delete_port": "rule:vm_admin_owner_or_vm_admin_network_owner or rule:context_is_advsvc",

So it takes VMAdmin to delete a port, but the user in this case did not have that role when deleting an instance.

I'm going to reopen this bug to see if nova can change to use admin to delete the port, if the neutron port binding extension is enabled.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/280017

[OpenStack Infra (hudson-openstack)]

Change abandoned by Chuck Carmack (<email address hidden>) on branch: master
Review: https://review.openstack.org/280017
Reason: I'm abadoning this because our operator agreed to change the neutron policy.