@Thierry: I think both are good options, perhaps moving the DB call to work through a queue can allow for other services to subscribe to specific DB updates? While it looks like the easier option is to narrow the nova-compute DB user's permission the question is what is the better solution in the long term?
Yes, I do agree this should be bug should be made public.
@Thierry: I think both are good options, perhaps moving the DB call to work through a queue can allow for other services to subscribe to specific DB updates? While it looks like the easier option is to narrow the nova-compute DB user's permission the question is what is the better solution in the long term?
Yes, I do agree this should be bug should be made public.