Created attachment 1399187 [details]
logs

When trying to add a router with external gateway to the open stack network manager get the following error.

Unable to create Network Router "trystack_router_gw": (rule:create_router and (rule:create_router:external_gateway_info and (rule:create_router:external_gateway_info:network_id and rule:create_router:external_gateway_info:enable_snat and rule:create_router:external_gateway_info:external_fixed_ips))) on {u'external_gateway_info': {u'network_id': u'eda11c37-395d-47a1-8bf5-03c2b6852ba8', u'enable_snat': False, u'external_fixed_ips': [{u'subnet_id': u'4514076b-41bd-4c55-bf12-e55372a04e67'}]}, u'name': u'trystack_router_gw', 'admin_state_up': True, 'tenant_id': u'c54816540e3a4ee0811862a522c1ca51', 'distributed': <object object at 0x7fb6e4301a80>, 'ha': <object object at 0x7fb6e4301a80>} by {'domain': None, 'project_name': u'facebook106712606521482', 'tenant_name': u'facebook106712606521482', 'project_domain': None, 'timestamp': '2018-02-22 08:37:23.736251', 'auth_token': 'd8258a2897b9431ca75b9d59896f87f8', 'resource_uuid': None, 'is_admin': False, 'user': u'b34df18789fc4e92b941b63b3d3bc49a', 'tenant': u'c54816540e3a4ee0811862a522c1ca51', 'read_only': False, 'project_id': u'c54816540e3a4ee0811862a522c1ca51', 'user_id': u'b34df18789fc4e92b941b63b3d3bc49a', 'show_deleted': False, 'roles': [u'_member_'], 'user_identity': 'b34df18789fc4e92b941b63b3d3bc49a c54816540e3a4ee0811862a522c1ca51 - - -', 'tenant_id': u'c54816540e3a4ee0811862a522c1ca51', 'request_id': 'req-d8e3c37f-3420-4c33-89a7-b0f9844169cb', 'user_domain': None, 'user_name': u'facebook106712606521482'} disallowed by policy

It's unclear from the comments whether this is happening with openstack, ovirt, or both. From the OpenStack API docs, they're somewhat vague on what parameter combinations are valid. With a clear reproducing case for OpenStack from MIQ, I can dig into seeing what exactly OpenStack needs from MIQ. Hopefully that's consistent with what ovirt needs.

Also, the screenshot is gone.

Upon further investigation, with the OpenStack provider the existing UI actually works as-is. I can create a router, select a subnet for the gateway interface, and the OpenStack API call succeeds, creating a router with an interface on that network with OpenStack choosing the IP address. Perhaps the IP address failure only happens with the Ovirt provider? If that's the case, 1) this BZ should probably be taken over by someone who works on maintaining the ovirt provider and 2) whatever fix is put in place needs to take into account that for OpenStack, *not* providing an explicit IP address is a valid use case.

Looking at the Networking API:
    https://developer.openstack.org/api-ref/network/v2/#routers-routers
the definition of "external_fixed_ips" says:
    "Each element of the list is a dictionary of ip_address and subnet_id."
which suggests that both fields are mandatory.

If we want to have the IP optional, the docs should be updated (as is in the case of port fixed_ips for example).
With the current definition, accepting "external_fixed_ips" without "ip_address" seems to be wrong.

Also adding a router port with a random IP is not very useful. The gateway should rather be something that we specify, not that is randomly generated.

I also agree, there should be at least an option to supply IP address in the UI. Otherwise, what is the point of having 'external_fixed_ips' for something that is allocated automatically?

So there are a few things going on here:
1) It's still unclear whether the bug as reported was an ovirt problem or an OpenStack one. I can't reproduce the problem as stated with OpenStack -- it works for me. Perhaps ovirt requires submitting the IP address along with a subnet.

2) For OpenStack at least, the IP address supplied is *not* the gateway forwarding IP address, it is the IP address of the *local* interface on the externally-facing subnet which contains the gateway. If we don't supply it, then OpenStack assigns it, and that IP address is returned from the OpenStack API. It's not randomly generated in MIQ -- it's generated by OpenStack.

3) Regarding the OpenStack docs, I would agree that the docs are misleading here. This would be an OpenStack issue rather than a MIQ one, but it's probably worth submitting it. Either the API should require an IP address for each gateway network in the external_fixed_ips, or the docs should explicitly state that it's not needed.

4) For the OpenStack use case, if supplying a subnet_id without an IP address is valid for router creation (using the returned IP address from openstack), then adding the explicit IP address field (as optional) seems more like an RFE here.

5) If the UI is currently broken for the ovirt use case, then it's a real bug, but the fix needs to reflect the fact that for OpenStack the field is currently not required.

> 1) It's still unclear whether the bug as reported was an ovirt problem or an
> OpenStack one. I can't reproduce the problem as stated with OpenStack -- it
> works for me. Perhaps ovirt requires submitting the IP address along with a
> subnet.

ovirt-provider-ovn does requires submitting the IP address along with a subnet, so this could be a possible cause for the problem indeed.


> 2) For OpenStack at least, the IP address supplied is *not* the gateway
> forwarding IP address, it is the IP address of the *local* interface on the
> externally-facing subnet which contains the gateway. If we don't supply it,
> then OpenStack assigns it, and that IP address is returned from the
> OpenStack API. It's not randomly generated in MIQ -- it's generated by
> OpenStack.

If generating the IP (when not provided) is the desired behaviour, ovirt can be changed to behave the same way. Can you please open a bug for this? 
It would be nice to change the Openstack docs before doing this.

> 
> 3) Regarding the OpenStack docs, I would agree that the docs are misleading
> here. This would be an OpenStack issue rather than a MIQ one, but it's
> probably worth submitting it. Either the API should require an IP address
> for each gateway network in the external_fixed_ips, or the docs should
> explicitly state that it's not needed.

+1 on either option

> 
> 4) For the OpenStack use case, if supplying a subnet_id without an IP
> address is valid for router creation (using the returned IP address from
> openstack), then adding the explicit IP address field (as optional) seems
> more like an RFE here.
> 
> 5) If the UI is currently broken for the ovirt use case, then it's a real
> bug, but the fix needs to reflect the fact that for OpenStack the field is
> currently not required.

Regarding 2) and 3) for OpenStack, in digging into the docs, I'm seeing that the ability to specify subnet and/or IP address in external_fixed_ips for the externa_gateway_info on a router was specified to use the same format as the fixed_ips field for port creation (as found at https://specs.openstack.org/openstack/neutron-specs/specs/kilo/specify-router-ext-ip.html )

Digging into the port fixed_ips API specs, it looks like the correct answer is that either subnet_id or ip_address or both are allowed there:

"The IP addresses for the port. If you would like to assign multiple IP addresses for the port, specify multiple entries in this field. Each entry consists of IP address (ip_address) and the subnet ID from which the IP address is assigned (subnet_id).

    If you specify both a subnet ID and an IP address, OpenStack Networking tries to allocate the IP address on that subnet to the port.
    If you specify only a subnet ID, OpenStack Networking allocates an available IP from that subnet to the port.
    If you specify only an IP address, OpenStack Networking tries to allocate the IP address if the address is a valid IP for any of the subnets on the specified network."

https://developer.openstack.org/api-ref/network/v2/#create-port