Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1486027

Summary: 'gnocchi metric list' shows metrics from other projects
Product: Red Hat OpenStack Reporter: Chris Fields <cfields>
Component: openstack-gnocchiAssignee: Julien Danjou <jdanjou>
Status: CLOSED NOTABUG QA Contact: Sasha Smolyak <ssmolyak>
Severity: medium Docs Contact:
Priority: low    
Version: 10.0 (Newton)CC: apevec, cfields, jdanjou, jschluet, lhh, pkilambi
Target Milestone: ---Keywords: Triaged, ZStream
Target Release: 10.0 (Newton)   
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1489773 (view as bug list) Environment:
Last Closed: 2017-10-10 07:29:44 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1489773    
Attachments:
Description Flags
gnocchi command example none

Description Chris Fields 2017-08-28 19:04:29 UTC 
Description of problem:
When scoped to a particular OSP project (OS_PROJECT_NAME=demo2
,OS_USERNAME=demo2) a 'gnocchi metric list' shows metrics from the current project and from other projects.  

Version-Release number of selected component (if applicable):
OSP 10

How reproducible:
100%

Steps to Reproduce:
1. gnocchi metric list
2. gnocchi metric show (on the returned list and look at the' resource/project_id.'  


Actual results:
gnocchi shows the metrics from the current project and other projects.  

Expected results:
'metric list' should only return metrics from the current project

Additional info:
OSP 11 - if you 'gnocchi metric show <metric id>' on a metric that is not in the current project then you get 'Forbidden (HTTP 403)'
Comment 1 Julien Danjou 2017-09-07 16:03:31 UTC 
> When scoped to a particular OSP project (OS_PROJECT_NAME=demo2
,OS_USERNAME=demo2) a 'gnocchi metric list' shows metrics from the current project and from other projects.  

It should not unless the user is admin. Can you provide more information on what you do exactly? What command you types and what the output is?
Comment 2 Chris Fields 2017-09-07 20:10:56 UTC 
Created attachment 1323452 [details]
gnocchi command example

The attachment shows a series of commands that demonstrate that you can see metrics from a project that you are not currently scoped to.  This was done on OSP 11.  It does mimic the behavior that my customer is seeing in OSP 10, however.  

The customer expects to see only the metrics for the current project when doing a 'gnocchi metric list.'
Comment 3 Julien Danjou 2017-09-08 08:30:58 UTC 
Thanks Chris for the detailled output. There is indeed an ACL matching problem on this request where the user is not used correctly as a filter.

I've pushed a fix upstrean and will backport it to OSP10 and OSP11.
Comment 4 Julien Danjou 2017-09-14 13:35:37 UTC 
Chris,

I've been able to reproduce the bug on master (OSP13), Gnocchi 4.0 (OSP12) and Gnocchi 3.1 (OSP11) and pushed a fix upsream for those version. However, I was unable to reproduce it on Gnocchi 3.0 (OSP10).

Your log being based on OSP11, can you provide me an identical log on OSP10?
Maybe it's just me missing a corner case or something, but it does not jump at my face.
Comment 5 Chris Fields 2017-09-14 22:07:46 UTC 
Julien, I'm spinning up OSP10 to try it myself.  If I can't reproduce it I'll get back in touch w/my customer who originally reported this to try to re-produce.  Should have some results by the beginning of next week.
Comment 6 Julien Danjou 2017-09-15 07:02:51 UTC 
Thanks Chris, you rock.
Comment 7 Chris Fields 2017-10-10 03:15:04 UTC 
I could not duplicate this in OSP 10 either.  It does look like I'm running into this instead: https://bugzilla.redhat.com/show_bug.cgi?id=1487619.  

My customer says they saw this (1486027) bug, but it does not look like they will be running gnocchi on OSP 10 now so I don't have a place w/the customer to re-produce.
Comment 8 Julien Danjou 2017-10-10 07:29:44 UTC 
Thanks Chris, that confirms what I thought! Closing in favor of the other BZ.