Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1678326

Summary:	Unable to dump policy using oslopolicy-policy-generator for heat,neutron,glance
Product:	Red Hat OpenStack	Reporter:	Jeremy <jmelvin>
Component:	openstack-keystone	Assignee:	John Dennis <jdennis>
Status:	CLOSED NOTABUG	QA Contact:	nlevinki <nlevinki>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	13.0 (Queens)	CC:	alee, josorior, nkinder, rmascena
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	1678769 1678771 1678774 (view as bug list)		Environment:
Last Closed:	2019-03-07 13:59:34 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jeremy 2019-02-18 14:06:59 UTC

Description of problem: Seems to be like Bug 1572317 , however this is effecting heat,neutron,glance. Looks like nova, cinder etc were fixed by that bug ; however still a few services don't work.



Version-Release number of selected component (if applicable):

docker exec keystone rpm -qa | grep keystone
openstack-keystone-13.0.1-1.el7ost.noarch

How reproducible:
100%

Actual results:

[root@ops2-rpc-cntl1 tmp]# oslopolicy-policy-generator --namespace heat
WARNING:stevedore.named:Could not load heat
Traceback (most recent call last):
  File "/usr/bin/oslopolicy-policy-generator", line 10, in <module>
    sys.exit(generate_policy())
  File "/usr/lib/python2.7/site-packages/oslo_policy/generator.py", line 295, in generate_policy
    _generate_policy(conf.namespace, conf.output_file)
  File "/usr/lib/python2.7/site-packages/oslo_policy/generator.py", line 240, in _generate_policy
    enforcer = _get_enforcer(namespace)
  File "/usr/lib/python2.7/site-packages/oslo_policy/generator.py", line 78, in _get_enforcer
    enforcer = mgr[namespace].obj
  File "/usr/lib/python2.7/site-packages/stevedore/extension.py", line 326, in __getitem__
    return self._extensions_by_name[name]
KeyError: 'heat'

[root@ops2-rpc-cntl1 tmp]# oslopolicy-policy-generator --namespace glance
WARNING:stevedore.named:Could not load glance
Traceback (most recent call last):
  File "/usr/bin/oslopolicy-policy-generator", line 10, in <module>
    sys.exit(generate_policy())
  File "/usr/lib/python2.7/site-packages/oslo_policy/generator.py", line 295, in generate_policy
    _generate_policy(conf.namespace, conf.output_file)
  File "/usr/lib/python2.7/site-packages/oslo_policy/generator.py", line 240, in _generate_policy
    enforcer = _get_enforcer(namespace)
  File "/usr/lib/python2.7/site-packages/oslo_policy/generator.py", line 78, in _get_enforcer
    enforcer = mgr[namespace].obj
  File "/usr/lib/python2.7/site-packages/stevedore/extension.py", line 326, in __getitem__
    return self._extensions_by_name[name]
KeyError: 'glance'

[root@ops2-rpc-cntl1 tmp]# oslopolicy-policy-generator --namespace neutron
WARNING:stevedore.named:Could not load neutron
Traceback (most recent call last):
  File "/usr/bin/oslopolicy-policy-generator", line 10, in <module>
    sys.exit(generate_policy())
  File "/usr/lib/python2.7/site-packages/oslo_policy/generator.py", line 295, in generate_policy
    _generate_policy(conf.namespace, conf.output_file)
  File "/usr/lib/python2.7/site-packages/oslo_policy/generator.py", line 240, in _generate_policy
    enforcer = _get_enforcer(namespace)
  File "/usr/lib/python2.7/site-packages/oslo_policy/generator.py", line 78, in _get_enforcer
    enforcer = mgr[namespace].obj
  File "/usr/lib/python2.7/site-packages/stevedore/extension.py", line 326, in __getitem__
    return self._extensions_by_name[name]
KeyError: 'neutron'

[root@ops2-rpc-cntl1 tmp]# oslopolicy-policy-generator --namespace keystone | grep get_role
"identity:get_role_for_trust": ""
"identity:get_role": "rule:admin_required"

[root@ops2-rpc-cntl1 tmp]# oslopolicy-policy-generator --namespace nova | grep create:attach_network
"os_compute_api:servers:create:attach_network": "rule:admin_or_owner"


Expected results:

works
Additional info:

Comment 2 Juan Antonio Osorio 2019-02-19 12:25:54 UTC

I think this would require a bug per service. The thing is that services need to migrate to using policy-in-code, and a lot of services are just finishing that work (e.g. neutron). This code won't be available until Train. So, I'm not sure if it's feasible to get this for OSP13.

Comment 7 Jeremy 2019-03-07 13:59:34 UTC

yes closing