Bug 1815029

Summary:	[OSP] Adding instances to an external network fails with 403 error
Product:	OpenShift Container Platform	Reporter:	Mike Fedosin <mfedosin>
Component:	Cloud Compute	Assignee:	Mike Fedosin <mfedosin>
Cloud Compute sub component:	BareMetal Provider	QA Contact:	sunzhaohua <zhsun>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	urgent
Priority:	urgent	CC:	stbenjam
Version:	4.4
Target Milestone:	---
Target Release:	4.5.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-08-27 22:35:08 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mike Fedosin 2020-03-19 10:49:45 UTC

When I'm trying to add machines to an external network (that doesn't belong to my tenant) I see the next error from cluster-api-provider-openstack:

W0318 22:10:59.996899       1 controller.go:321] Failed to create machine "mfedosin-tw4hb-worker-trmkx": error creating Openstack instance: Failed to create port err: Create port for server err: Request forbidden: [POST https://rhos-d.infra.prod.upshift.rdu2.redhat.com:13696/v2.0/ports], error message: {"NeutronError": {"message": "(rule:create_port and (rule:create_port:allowed_address_pairs and (rule:create_port:allowed_address_pairs:ip_address and rule:create_port:allowed_address_pairs:ip_address and rule:create_port:allowed_address_pairs:ip_address))) is disallowed by policy", "type": "PolicyNotAuthorized", "detail": ""}}

This happens because CAPO doesn't differentiate between private and external networks and always tries to set allowed_address_pairs for ports.

Comment 3 sunzhaohua 2020-03-25 09:51:31 UTC

postpone it until https://github.com/openshift/installer/pull/3291 is merged

Comment 5 Luke Meyer 2020-08-27 22:35:08 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:2409'