Bug 1470134
| Summary: | Unprivileged user can't access to its Gnocchi resources created by Ceilometer | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Mehdi ABAAKOUK <mabaakou> |
| Component: | openstack-aodh | Assignee: | Mehdi ABAAKOUK <mabaakou> |
| Status: | CLOSED ERRATA | QA Contact: | Sasha Smolyak <ssmolyak> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 10.0 (Newton) | CC: | apevec, david.costakos, dlamotta, fbaudin, jschluet, jthomas, lhh, mabaakou, mlamouri, nalmond, rlopez, samccann, sgordon, ssigwald |
| Target Milestone: | z4 | Keywords: | Triaged, ZStream |
| Target Release: | 10.0 (Newton) | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | openstack-aodh-3.0.3-1.el7ost | Doc Type: | Bug Fix |
| Doc Text: |
Alarm created with unprivileged user cannot retrieve statistics from Gnocchi. This version fixes that. Any alarms created before this release must be updated or recreated to pick up this fix.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-09-06 17:06:29 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Mehdi ABAAKOUK
2017-07-12 12:33:03 UTC
When an unprivileged user want to access to Gnocchi resources created by Ceilometer, that doesn't work because the filter scope the Gnocchi query to resource owner to the user. This break Heat + Aodh with trust. Heat creates Aodh alarm with the user project. Ceilometer creates resources and metrics in Gnocchi with the service users. Aodh can't access to the resource of the user to evaluate the alarm. *** Bug 1470167 has been marked as a duplicate of this bug. *** *** Bug 1471234 has been marked as a duplicate of this bug. *** We have also added your use case in upstream testing: https://review.openstack.org/#/c/459659/ A first pass indicates that this is successful. We have been able to create a Heat stack on OSP10 with OCP3.4 which scales both up and down when the load on the OCP app nodes is added and removed. For the openshift-heat-templates, the update has been tested with the hotfix using OCP3.4 on OSP10: https://github.com/redhat-openstack/openshift-on-openstack/pull/374 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2653 |