Admin credentials are setup on both controllers after swact

Bug #1797422 reported by Jose Perez Carranza on 2018-10-11
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
StarlingX
Low
Brent Rowsell

Bug Description

Title
-----
Controller remains with admin credentials after swact

Brief Description
-----------------
When establishing a SSH connection to an active controller and load the admin credentials (source /etc/nova/openrc) the controller remain with the admin credentials after a swact when is in StandBy and not in Active.

Severity
--------
Provide the severity of the defect.
Major

Steps to Reproduce
------------------
1. Login SSH to Active Controller (controller-x)
2. Load admin credentials
  source /etc/nova/openrc
3. Perform a swact
  system host-swact controller-x
4. Verify that swact is OK
5. Login SSH to Active Controller (controller-y)
6. Load admin credentials
  source /etc/nova/openrc
7 Verify that controller-x is StandBy
  system host-show controller-x |grep capabilities
8. On Controller-x session verify that admin rights commands cannot be executed
  system show

Expected Behavior
------------------
Controller in StandBy cannot run admin commands

Actual Behavior
----------------
Admin commands can be executed on StandBy controller and also in Active controller, both controllers have the admin credentials loaded.

Reproducibility
---------------
Reproducible
100%

System Configuration
--------------------
Duplex Bare-Metal --> Two node system

Branch/Pull Time/Commit
-----------------------
r-2018.10

Timestamp/Logs
--------------

Elio Martinez (elio1979) wrote :

The same issue is observed on multinode configuration, the only way to complete the "full swacting" operation is to log off from the previous active controller, and log in again, causing that the keystone admin credentials pass 100% to the new active controller.

Ada Cabrales (acabrale) on 2018-10-11
tags: added: stx.2018.10
Brent Rowsell (brent-rowsell) wrote :

There is no bug here.
On the initial controller you get a token. That token is still valid until it expires.

Changed in starlingx:
status: New → Invalid
Ghada Khalil (gkhalil) on 2018-10-12
Changed in starlingx:
importance: Undecided → Low
Ghada Khalil (gkhalil) on 2018-10-12
tags: added: stx.ha
Jose Perez Carranza (jgperezc) wrote :

Ok got it.... but this behavior does not represent a security issue, having a controller that can perform admin actions even when is not active?

Ghada Khalil (gkhalil) on 2018-10-27
Changed in starlingx:
assignee: nobody → Brent Rowsell (brent-rowsell)
Ken Young (kenyis) on 2019-04-06
tags: added: stx.1.0
removed: stx.2018.10
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers