Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1623855

Summary:	Namespace isolation for services not working for normal tenants
Product:	Red Hat OpenStack	Reporter:	Luis Tomas Bolivar <ltomasbo>
Component:	openstack-kuryr-kubernetes	Assignee:	Luis Tomas Bolivar <ltomasbo>
Status:	CLOSED DUPLICATE	QA Contact:	GenadiC <gcheresh>
Severity:	high	Docs Contact:
Priority:	high
Version:	14.0 (Rocky)	CC:	asegurap, athomas, itbrown, tzumainn
Target Milestone:	z1	Keywords:	Triaged, ZStream
Target Release:	14.0 (Rocky)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-01-17 12:48:56 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1626377, 1635892
Bug Blocks:

Description Luis Tomas Bolivar 2018-08-30 10:33:06 UTC

Namespace isolation for services is not working for normal tenants. The kuryr namespace isolation functionality relies on modifying the default security group rules created by octavia to, instead of allowing traffic from everywhere to the specified port, allow just the traffic from the specific namespaces (itself and default one). The problem is that this security group does not belong to the tenant but to admin, and unless the tenant has access to modify it, the next error will pop up on the kuryr-controller, leaving the security group rules unmodified, and therefore enabling the access to the specified port from everywhere:

2018-08-30 09:58:51.484 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 [-] Failed when creating security group rule for listener test/demo:TCP:80.: NotFound: Security group 397abbf5-1106-4311-93a3-472f9bbcb9e9 does not exist
Neutron server returns request_ids: ['req-301617bf-51e3-4eed-b3d2-4788fb977fb3']
2018-08-30 09:58:51.484 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 Traceback (most recent call last):
2018-08-30 09:58:51.484 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2   File "/usr/lib/python2.7/site-packages/kuryr_kubernetes/controller/drivers/lbaasv2.py", line 165, in _extend_lb_security_group_rules
2018-08-30 09:58:51.484 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2     'description': listener.name,
2018-08-30 09:58:51.484 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 989, in create_security_group_rule
2018-08-30 09:58:51.484 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2     return self.post(self.security_group_rules_path, body=body)
2018-08-30 09:58:51.484 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 359, in post
2018-08-30 09:58:51.484 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2     headers=headers, params=params)
2018-08-30 09:58:51.484 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 294, in do_request
2018-08-30 09:58:51.484 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2     self._handle_fault_response(status_code, replybody, resp)
2018-08-30 09:58:51.484 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 269, in _handle_fault_response
2018-08-30 09:58:51.484 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2     exception_handler_v20(status_code, error_body)
2018-08-30 09:58:51.484 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2   File "/usr/lib/python2.7/site-packages/neutronclient/v2_0/client.py", line 93, in exception_handler_v20
2018-08-30 09:58:51.484 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2     request_ids=request_ids)
2018-08-30 09:58:51.484 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 NotFound: Security group 397abbf5-1106-4311-93a3-472f9bbcb9e9 does not exist
2018-08-30 09:58:51.484 1 ERROR kuryr_kubernetes.controller.drivers.lbaasv2 Neutron server returns request_ids: ['req-301617bf-51e3-4eed-b3d2-4788fb977fb3']


How reproducible:
100%


Steps to Reproduce:
1. Deploy with namespace isolation enabled
2. Create 2 projects and 1 deployments on each one
3. Create service for deployment on project 1
4. Curl service on project 1 from pod on project 2

Actual results:
Curl succeeds

Expected results:
Curl hangs as pod from one namespace/project is not supposed to be able to reach a service from another namespace/project

Comment 1 Luis Tomas Bolivar 2018-08-30 10:56:28 UTC

Not sure about the reasons behind creating the loadbalancer security group on the admin project instead of on the tenant that created the loadbalancer, but I see 2 possible options here:
1.- make Octavia create the security group within the tenant project instead of the admin one, or
2.- extend Octavia to permit specifying (restricting) the security group rules to be applied. For instance, from where it should be accessible, not just on what port.

Comment 5 Luis Tomas Bolivar 2019-01-17 12:48:56 UTC


*** This bug has been marked as a duplicate of bug 1626377 ***