Bug 1660885

Summary:	Octavia lb SG rules are modified when namespace isolation is not used
Product:	Red Hat OpenStack	Reporter:	Luis Tomas Bolivar <ltomasbo>
Component:	openstack-kuryr-kubernetes	Assignee:	Luis Tomas Bolivar <ltomasbo>
Status:	CLOSED ERRATA	QA Contact:	Itzik Brown <itbrown>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	14.0 (Rocky)	CC:	asegurap
Target Milestone:	z1	Keywords:	Triaged, ZStream
Target Release:	14.0 (Rocky)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openstack-kuryr-kubernetes-0.5.3-0.20190121111334	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-03-18 13:04:08 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Luis Tomas Bolivar 2018-12-19 14:11:06 UTC

When using the kuryr namespace isolation there is a need for modifying the rules created by Octavia at the LoadBalancer SG. However, in the case namespace isolation is not enabled there is no need to try to change them. And by default, a normal tenant is not able to modify them (for the amphora driver), leading to the next error:

2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 [-] Failed when creating security group rule to enable routes for listener test/demo:TCP:80.: NotFound: Security group 8a6d6559-ada4-4df0-abb0-b6780161378b does not exist
Neutron server returns request_ids: ['req-09e62506-87f8-4f8d-9328-c9ef8d39a773']
2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 Traceback (most recent call last):
2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 File "/usr/lib/python2.7/site-packages/kuryr_kubernetes/controller/drivers/lbaasv2.py", line 228, in _extend_lb_security_group_rules
2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 'description': listener.name,
2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 989, in create_security_group_rule
2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 return self.post(self.security_group_rules_path, body=body)
2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 359, in post
2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 headers=headers, params=params)
2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 294, in do_request
2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 self._handle_fault_response(status_code, replybody, resp)
2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 269, in _handle_fault_response
2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 exception_handler_v20(status_code, error_body)
2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 93, in exception_handler_v20
2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 request_ids=request_ids)
2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 NotFound: Security group 8a6d6559-ada4-4df0-abb0-b6780161378b does not exist
2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 Neutron server returns request_ids: ['req-09e62506-87f8-4f8d-9328-c9ef8d39a773']
2018-12-19 11:32:52.765 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2

Comment 6 Itzik Brown 2019-03-04 11:45:32 UTC

Will verify when we have the proper image (https://bugzilla.redhat.com/show_bug.cgi?id=1673799)

Comment 9 Itzik Brown 2019-03-07 00:43:35 UTC

Checked with:
openstack-kuryr-kubernetes-controller-0.5.3-0.20190121111334.a895113.el7ost.noarch

Comment 11 errata-xmlrpc 2019-03-18 13:04:08 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0591