Hide Forgot
Description of problem: router creation permission issue - 'neutron router-create' vs 'openstack router create' - inconsistent for _member_ role Version-Release number of selected component (if applicable): RHEL OSP 9 How reproducible: Everytime Steps to Reproduce: 1. Able to create router using with default policy. Note : this is not a HA router. [heat-admin@overcloud-controller-0 keystonerc]$ neutron router-create test Created a new router: +-------------------------+--------------------------------------+ | Field | Value | +-------------------------+--------------------------------------+ | admin_state_up | True | | availability_zone_hints | | | availability_zones | | | description | | | external_gateway_info | | | id | 3dadc0eb-dc5e-4203-a3d1-ace8c2bd6a75 | | name | test | | routes | | | status | ACTIVE | | tenant_id | 0ed641d527e042f6a9eec4e2db290293 | +-------------------------+--------------------------------------+ 2. Not able to create router as same tenant using "openstack" command. [heat-admin@overcloud-controller-0 keystonerc]$ openstack router create test1 HttpException: Forbidden 3. Actual results: It's not allowing us to create router using openstack command. Expected results: It should allow us to create router using openstack command. Additional info: Seeing this behaviour with default policy. ~~~ [root@overcloud-controller-0 ~]# grep -i create_router /etc/neutron/policy.json "create_router": "rule:regular_user", "create_router:external_gateway_info:enable_snat": "rule:admin_only", "create_router:distributed": "rule:admin_only", "create_router:ha": "rule:admin_only", "create_router:external_gateway_info:external_fixed_ips": "rule:admin_only", ~~~
Reported https://bugs.launchpad.net/python-openstackclient/+bug/1664255 and https://bugs.launchpad.net/python-openstackclient/+bug/1659020 in u/s, and also corresponding changes https://review.openstack.org/#/c/433442/ (master) https://review.openstack.org/#/c/433452/ (newton) https://review.openstack.org/#/c/433457/ (mitaka)
@Ihar In u/s, this backport https://review.openstack.org/#/c/433452/2 was not allowed with below reasons(i.e review comments), 1) The stable policy is even stricter for OSC than usual, critical bug fixes backported only. 2) That's definitely not a High impact issue. You always have access to neutronclient. Do we follow the same for d/s also? i.e shall we go ahead and say we can't backport to osc and use neutronclient in this case? or can we backport that to d/s osp9? thanks Anil
Anil, upstream rules should not define what we can do for OSP. Yes, we can backport the patch in OSP.
Thanks Ihar. I will backport in d/s. Thanks Anil
Build python-openstackclient-2.3.1-2.el7ost created with the fix.
Moving back to ON_DEV as the OSP9 backport introduces a regression and needs to be reworked a bit. I left a comment on the review. Thanks!
https://code.engineering.redhat.com/gerrit/#/c/113270/ reverted. Need a fresh backport. But I feel its not worthy for developer to spend time on backporting to d/w OSC as discussed in comment 9( backporting is not allowed in u/s).
The severity of the bug does not align with the support policy for OSP 9. I am closing this bug.