Bug 1815029 - [OSP] Adding instances to an external network fails with 403 error
Summary: [OSP] Adding instances to an external network fails with 403 error
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Cloud Compute
Version: 4.4
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: ---
: 4.5.0
Assignee: Mike Fedosin
QA Contact: sunzhaohua
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-03-19 10:49 UTC by Mike Fedosin
Modified: 2020-08-27 22:35 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-08-27 22:35:08 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift cluster-api-provider-openstack pull 86 0 None closed Bug 1815029: Allow to create network ports without allowed address pairs 2021-02-17 13:18:31 UTC

Description Mike Fedosin 2020-03-19 10:49:45 UTC
When I'm trying to add machines to an external network (that doesn't belong to my tenant) I see the next error from cluster-api-provider-openstack:

W0318 22:10:59.996899       1 controller.go:321] Failed to create machine "mfedosin-tw4hb-worker-trmkx": error creating Openstack instance: Failed to create port err: Create port for server err: Request forbidden: [POST https://rhos-d.infra.prod.upshift.rdu2.redhat.com:13696/v2.0/ports], error message: {"NeutronError": {"message": "(rule:create_port and (rule:create_port:allowed_address_pairs and (rule:create_port:allowed_address_pairs:ip_address and rule:create_port:allowed_address_pairs:ip_address and rule:create_port:allowed_address_pairs:ip_address))) is disallowed by policy", "type": "PolicyNotAuthorized", "detail": ""}}

This happens because CAPO doesn't differentiate between private and external networks and always tries to set allowed_address_pairs for ports.

Comment 3 sunzhaohua 2020-03-25 09:51:31 UTC
postpone it until https://github.com/openshift/installer/pull/3291 is merged

Comment 5 Luke Meyer 2020-08-27 22:35:08 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:2409'


Note You need to log in before you can comment on or make changes to this bug.