Neutron quotas for firewall params fail to update

[Kobi Samoray]

While attempting to change the FWaaS quota params on a FWaaSv2 environment, the update operation fails.

See outputs below:
$ neutron quota-show
neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead.
+-----------------------+-------+
| Field | Value |
+-----------------------+-------+
| endpoint_group | -1 |
| firewall_group | -1 |
| firewall_policy | 10 |
| firewall_rule | 100 |
| floatingip | 50 |
| healthmonitor | -1 |
| housekeeper | -1 |
| ikepolicy | -1 |
| ipsec_site_connection | -1 |
| ipsecpolicy | -1 |
| l2-gateway-connection | -1 |
| l7policy | -1 |
| listener | -1 |
| loadbalancer | 10 |
| member | -1 |
| network | 100 |
| pool | 10 |
| port | 500 |
| rbac_policy | 10 |
| router | 10 |
| security_group | 10 |
| security_group_rule | 100 |
| subnet | 100 |
| subnetpool | -1 |
| vpnservice | -1 |
+-----------------------+-------+

$ neutron quota-update --tenant-id 8c2d97bf3d0047959ff4cf57dc5ac410 --firewall-rule 200
neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead.
Must specify a valid resource with new quota value

$ neutron quota-update --tenant-id 8c2d97bf3d0047959ff4cf57dc5ac410 --firewall-policy 100
neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead.
Must specify a valid resource with new quota value

$ neutron quota-update --tenant-id 8c2d97bf3d0047959ff4cf57dc5ac410 --firewall_group 200
neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead.
Must specify a valid resource with new quota value

[Slawek Kaplonski (slaweq)]

Can You do those calls with "--debug" option and provide output which You will have there?
It looks for me that it is more likely OSC issue instead of Neutron bug but if Your requests are reaching neutron server, can You also put here error which You got there?

[Kobi Samoray (ksamoray)]

Indeed the request doesn't reach Neutron backend. Client debug output below:
$ neutron quota-update --firewall-rule 200 --debug
neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead.
DEBUG: stevedore.extension found extension EntryPoint.parse('v1password = swiftclient.authv1:PasswordLoader')
DEBUG: stevedore.extension found extension EntryPoint.parse('token_endpoint = openstackclient.api.auth_plugin:TokenEndpoint')
DEBUG: stevedore.extension found extension EntryPoint.parse('noauth = cinderclient.contrib.noauth:CinderNoAuthLoader')
DEBUG: stevedore.extension found extension EntryPoint.parse('v2token = keystoneauth1.loading._plugins.identity.v2:Token')
DEBUG: stevedore.extension found extension EntryPoint.parse('none = keystoneauth1.loading._plugins.noauth:NoAuth')
DEBUG: stevedore.extension found extension EntryPoint.parse('v3oauth1 = keystoneauth1.extras.oauth1._loading:V3OAuth1')
DEBUG: stevedore.extension found extension EntryPoint.parse('admin_token = keystoneauth1.loading._plugins.admin_token:AdminToken')
DEBUG: stevedore.extension found extension EntryPoint.parse('v3oidcauthcode = keystoneauth1.loading._plugins.identity.v3:OpenIDConnectAuthorizationCode')
DEBUG: stevedore.extension found extension EntryPoint.parse('v2password = keystoneauth1.loading._plugins.identity.v2:Password')
DEBUG: stevedore.extension found extension EntryPoint.parse('v3samlpassword = keystoneauth1.extras._saml2._loading:Saml2Password')
DEBUG: stevedore.extension found extension EntryPoint.parse('v3password = keystoneauth1.loading._plugins.identity.v3:Password')
DEBUG: stevedore.extension found extension EntryPoint.parse('v3adfspassword = keystoneauth1.extras._saml2._loading:ADFSPassword')
DEBUG: stevedore.extension found extension EntryPoint.parse('v3oidcaccesstoken = keystoneauth1.loading._plugins.identity.v3:OpenIDConnectAccessToken')
DEBUG: stevedore.extension found extension EntryPoint.parse('v3oidcpassword = keystoneauth1.loading._plugins.identity.v3:OpenIDConnectPassword')
DEBUG: stevedore.extension found extension EntryPoint.parse('v3kerberos = keystoneauth1.extras.kerberos._loading:Kerberos')
DEBUG: stevedore.extension found extension EntryPoint.parse('token = keystoneauth1.loading._plugins.identity.generic:Token')
DEBUG: stevedore.extension found extension EntryPoint.parse('v3oidcclientcredentials = keystoneauth1.loading._plugins.identity.v3:OpenIDConnectClientCredentials')
DEBUG: stevedore.extension found extension EntryPoint.parse('v3tokenlessauth = keystoneauth1.loading._plugins.identity.v3:TokenlessAuth')
DEBUG: stevedore.extension found extension EntryPoint.parse('v3token = keystoneauth1.loading._plugins.identity.v3:Token')
DEBUG: stevedore.extension found extension EntryPoint.parse('v3totp = keystoneauth1.loading._plugins.identity.v3:TOTP')
DEBUG: stevedore.extension found extension EntryPoint.parse('v3applicationcredential = keystoneauth1.loading._plugins.identity.v3:ApplicationCredential')
DEBUG: stevedore.extension found extension EntryPoint.parse('password = keystoneauth1.loading._plugins.identity.generic:Password')
DEBUG: stevedore.extension found extension EntryPoint.parse('v3fedkerb = keystoneauth1.extras.ker...

[Akihiro Motoki (amotoki)]

I don't see any reason that it is related to security. Moving it back to the normal bug type "Security".