Cause & Consequence:
There are two issues
1) When "router_distributed=True" is set in neutron.conf, admin can't override with --distributed flag(can't create non-distributed router)
2) "openstack router create" for non-admin user failing, as openstack client is always passing "distributed" flag(with true/false) to server for even non-admin user.
Fix:
We allow centralized and distributed flags during router creation with this build. And also not passing "distributed" flag for non-admin user.
Result:
1) Admin can create distributed and non-distributed routers through CLI flags with this change.
2) Non-admin user can create router with openstack client.
Description of problem:
router creation permission issue - 'neutron router-create' vs 'openstack router create' - inconsistent for _member_ role
Version-Release number of selected component (if applicable):
RHEL OSP 9
How reproducible:
Everytime
Steps to Reproduce:
1. Able to create router using with default policy. Note : this is not a HA router.
[heat-admin@overcloud-controller-0 keystonerc]$ neutron router-create test
Created a new router:
+-------------------------+--------------------------------------+
| Field | Value |
+-------------------------+--------------------------------------+
| admin_state_up | True |
| availability_zone_hints | |
| availability_zones | |
| description | |
| external_gateway_info | |
| id | 3dadc0eb-dc5e-4203-a3d1-ace8c2bd6a75 |
| name | test |
| routes | |
| status | ACTIVE |
| tenant_id | 0ed641d527e042f6a9eec4e2db290293 |
+-------------------------+--------------------------------------+
2. Not able to create router as same tenant using "openstack" command.
[heat-admin@overcloud-controller-0 keystonerc]$ openstack router create test1
HttpException: Forbidden
3.
Actual results:
It's not allowing us to create router using openstack command.
Expected results:
It should allow us to create router using openstack command.
Additional info:
Seeing this behaviour with default policy.
~~~
[root@overcloud-controller-0 ~]# grep -i create_router /etc/neutron/policy.json
"create_router": "rule:regular_user",
"create_router:external_gateway_info:enable_snat": "rule:admin_only",
"create_router:distributed": "rule:admin_only",
"create_router:ha": "rule:admin_only",
"create_router:external_gateway_info:external_fixed_ips": "rule:admin_only",
~~~
@Ihar
In u/s, this backport https://review.openstack.org/#/c/433452/2 was not allowed with below reasons(i.e review comments),
1) The stable policy is even stricter for OSC than usual, critical bug fixes backported only.
2) That's definitely not a High impact issue. You always have access to neutronclient.
Do we follow the same for d/s also? i.e shall we go ahead and say we can't backport to osc and use neutronclient in this case?
or can we backport that to d/s osp9?
thanks
Anil
Description of problem: router creation permission issue - 'neutron router-create' vs 'openstack router create' - inconsistent for _member_ role Version-Release number of selected component (if applicable): RHEL OSP 9 How reproducible: Everytime Steps to Reproduce: 1. Able to create router using with default policy. Note : this is not a HA router. [heat-admin@overcloud-controller-0 keystonerc]$ neutron router-create test Created a new router: +-------------------------+--------------------------------------+ | Field | Value | +-------------------------+--------------------------------------+ | admin_state_up | True | | availability_zone_hints | | | availability_zones | | | description | | | external_gateway_info | | | id | 3dadc0eb-dc5e-4203-a3d1-ace8c2bd6a75 | | name | test | | routes | | | status | ACTIVE | | tenant_id | 0ed641d527e042f6a9eec4e2db290293 | +-------------------------+--------------------------------------+ 2. Not able to create router as same tenant using "openstack" command. [heat-admin@overcloud-controller-0 keystonerc]$ openstack router create test1 HttpException: Forbidden 3. Actual results: It's not allowing us to create router using openstack command. Expected results: It should allow us to create router using openstack command. Additional info: Seeing this behaviour with default policy. ~~~ [root@overcloud-controller-0 ~]# grep -i create_router /etc/neutron/policy.json "create_router": "rule:regular_user", "create_router:external_gateway_info:enable_snat": "rule:admin_only", "create_router:distributed": "rule:admin_only", "create_router:ha": "rule:admin_only", "create_router:external_gateway_info:external_fixed_ips": "rule:admin_only", ~~~