Bug 2182005

Summary:	Policy-related errors in /var/log/containers/horizon/horizon.log
Product:	Red Hat OpenStack	Reporter:	Alex Stupnikov <astupnik>
Component:	openstack-heat-ui	Assignee:	Radomir Dopieralski <rdopiera>
Status:	ASSIGNED ---	QA Contact:	Ronnie Rasouli <rrasouli>
Severity:	low	Docs Contact:
Priority:	low
Version:	17.0 (Wallaby)	CC:	rdopiera, tkajinam, tovchinn
Target Milestone:	---	Keywords:	Triaged
Target Release:	---
Hardware:	All
OS:	All
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Alex Stupnikov 2023-03-27 08:31:54 UTC

Description of problem:

While investigating different problem I have found the following errors in /var/log/containers/horizon/horizon.log:

2023-03-22 14:45:16,844 34 ERROR openstack_auth.policy Failed to open the policy file for orchestration /etc/openstack-dashboard/default_policies/heat.yaml: [Errno 2] No such file or directory: '/etc/openstack-dashboard/default_policies/heat.yaml'
2023-03-22 14:45:16,844 34 WARNING openstack_auth.policy No policy rules for service 'orchestration' in /etc/openstack-dashboard/heat_policy.yaml

2023-03-22 14:47:24,541 35 ERROR openstack_auth.policy Failed to open the policy file for share /etc/openstack-dashboard/default_policies/manila.yaml: [Errno 2] No such file or directory: 
'/etc/openstack-dashboard/default_policies/manila.yaml'
2023-03-22 14:47:24,541 35 WARNING openstack_auth.policy No policy rules for service 'share' in /etc/openstack-dashboard/manila_policy.yaml

I am not sure how serious this bug is (customer reported different horizon problem), so setting severity to high. Please feel free to reduce if this is cosmetic issue logged as a problem.

sosreports are attached to case.


Version-Release number of selected component (if applicable):
rhosp-rhel9/openstack-horizon 17.0 sha256:eb812bc67454c14b9368bef793cce840257ede27a6379a8240268a96a3552c74  a2d890e9e81e

How reproducible:
Error is logged by Horizon when handling other requests


Expected results:
No Error is logged if everything working properly.

Comment 1 Takashi Kajinami 2023-03-27 08:45:57 UTC

These are caused by the fact that heat-dashboard package and manila-ui package does not install the policy files
while we added DEFAULT_POLICY_FILES/POLICY_FILES settings as part of dashboard options support. 
 https://review.opendev.org/c/openstack/puppet-horizon/+/795208

However these are just warnings and horizon should ignore these errors. The only "downsite" of this is that
any policy checks at horizon level does not work for heat/octavia/manila.

https://github.com/openstack/horizon/blob/stable/wallaby/openstack_auth/policy.py#L94
https://github.com/openstack/horizon/blob/stable/wallaby/openstack_auth/policy.py#L138-L139

If we want to remove these warnings completely then we have to backport the changes to install default policy
files such as
 https://review.opendev.org/q/8e7914fce24d2c9d94a83795983aaa0fb05f020c
 https://github.com/rdo-packages/heat-dashboard-distgit/commit/d0d38a3c2fea6aea2d3b202950b00a12062f69a3