Zun

Add security group failed with NotFound error

Bug #1742840 reported by hongbin
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Zun
Fix Released
High
hongbin

Bug Description

Description
===========
On processing the request to add a security group to a container, it failed with a NotFound error on performing a neutron API call:

  http://paste.openstack.org/show/643335/

This bug was introduced by: https://review.openstack.org/#/c/531561/ . That patch has a side effect that makes the context elevation ineffective. As a result, the neutron API call was made by a non-admin context thus failing to add the security group to the port.

Reproduce
=========
#### create container in demo tenant ####
$ source /opt/stack/devstack/openrc demo demo
$ openstack appcontainer run --name test nginx
$ CONTAINER_PORT=1709b046-44ae-4e89-b399-81f4c84221f4

#### populate neutron port in admin tenant ####
$ source /opt/stack/devstack/openrc admin admin
$ openstack security group create adminsg
$ openstack port set --security-group adminsg $CONTAINER_PORT

#### add security group in demo tenant ####
$ source /opt/stack/devstack/openrc demo demo
$ openstack security group create demosg
$ openstack appcontainer add security group test demosg

# check the log of devstack@zun-compute, it should fail

hongbin (hongbin034)
Changed in zun:
importance: Undecided → High
status: New → Triaged
Changed in zun:
assignee: nobody → hongbin (hongbin034)
status: Triaged → In Progress
hongbin (hongbin034)
description: updated
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to zun (master)

Reviewed: https://review.openstack.org/532962
Committed: https://git.openstack.org/cgit/openstack/zun/commit/?id=abd7e2b08f05383fb05c66f7bc57ffb7f7a2ab9e
Submitter: Zuul
Branch: master

commit abd7e2b08f05383fb05c66f7bc57ffb7f7a2ab9e
Author: Hongbin Lu <email address hidden>
Date: Thu Jan 11 20:09:29 2018 +0000

    Fix an issue on context elevation

    The issue was introduced by:
    https://review.openstack.org/#/c/531561/
    That patch above fixed an issue of creating volumes in a wrong
    tenant, but it made the context elevation ineffective. As a result,
    some neutron API calls (i.e. port update) was made by a non-admin
    context thus failing due to insufficient permission.

    This patch fixed it by using get_admin_context instead of
    context.elevated().

    Closes-Bug: #1742840
    Change-Id: Ia68729b90d059d7d88a00915582453d38420ab24

Changed in zun:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/zun 1.0.0

This issue was fixed in the openstack/zun 1.0.0 release.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.