ugh, nasty little bug. We were using project checking in the db as an added level of access control, but it does lead to problems when we are trying to do administrative commands across tenants.
Can you see if the following change fixes the issue?
diff --git a/nova/api/openstack/compute/contrib/cloudpipe.py b/nova/api/openstack/compute/contrib/cloudpipe.py
index b5d8747..115dc70 100644
--- a/nova/api/openstack/compute/contrib/cloudpipe.py
+++ b/nova/api/openstack/compute/contrib/cloudpipe.py
@@ -85,6 +85,7 @@ class CloudpipeController(object):
ugh, nasty little bug. We were using project checking in the db as an added level of access control, but it does lead to problems when we are trying to do administrative commands across tenants.
Can you see if the following change fixes the issue?
diff --git a/nova/ api/openstack/ compute/ contrib/ cloudpipe. py b/nova/ api/openstack/ compute/ contrib/ cloudpipe. py api/openstack/ compute/ contrib/ cloudpipe. py api/openstack/ compute/ contrib/ cloudpipe. py ller(object) :
index b5d8747..115dc70 100644
--- a/nova/
+++ b/nova/
@@ -85,6 +85,7 @@ class CloudpipeContro
def _vpn_dict(self, context, project_id, instance):
rv[ 'state' ] = 'pending'
elevated = context.elevated()
+ elevated.project_id = project_id
rv = {'project_id': project_id}
if not instance:
This fakes the context to be for the project. should only need to make the change on the api host.