I may be naive here, but the fix seems rather trivial. In rebuild_instance in conductor manager, in the rebuild case (where host is not None), we could call _schedule_instances and assert that the provided host must be in the returned list, else we can't rebuild the instance on that host with that image.
I may be naive here, but the fix seems rather trivial. In rebuild_instance in conductor manager, in the rebuild case (where host is not None), we could call _schedule_instances and assert that the provided host must be in the returned list, else we can't rebuild the instance on that host with that image.