1877630 – [RHOSP13] neutron security-group-list --tenant-id command can create Security Groups with non-existent project

Bug 1877630 - [RHOSP13] neutron security-group-list --tenant-id command can create Security Groups with non-existent project

Summary: [RHOSP13] neutron security-group-list --tenant-id command can create Security...

Keywords:
Status:	CLOSED WONTFIX
Alias:	None
Product:	Red Hat OpenStack
Classification:	Red Hat
Component:	python-neutronclient
Sub Component:
Version:	13.0 (Queens)
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	medium
Target Milestone:	---
Target Release:	---
Assignee:	Rodolfo Alonso
QA Contact:	Toni Freger
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:	1877631
TreeView+	depends on / blocked

Reported:	2020-09-10 03:06 UTC by Yadnesh Kulkarni
Modified:	2023-12-15 19:15 UTC (History)
CC List:	5 users (show)
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Clones:	1877631 (view as bug list)
Environment:
Last Closed:	2020-09-21 15:10:26 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Description Yadnesh Kulkarni 2020-09-10 03:06:00 UTC

Description of problem:

(overcloud) [stack@director13 ~]$ openstack project list
+----------------------------------+---------+
| ID                               | Name    |
+----------------------------------+---------+
| 640cd3931ff248ae94c79ec12f8f28d6 | service |
| 78c82decabc14c1493b1647bc8bf6791 | admin   |
+----------------------------------+---------+

(overcloud) [stack@director13 ~]$ neutron security-group-list 
neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead.
+--------------------------------------+---------+----------------------------------+----------------------------------------------------------------------+
| id                                   | name    | tenant_id                        | security_group_rules                                                 |
+--------------------------------------+---------+----------------------------------+----------------------------------------------------------------------+
| c1b0edd0-24db-48b8-b83b-638b09642abf | default | 78c82decabc14c1493b1647bc8bf6791 | egress, IPv4                                                         |
|                                      |         |                                  | egress, IPv6                                                         |
|                                      |         |                                  | ingress, IPv4, remote_group_id: c1b0edd0-24db-48b8-b83b-638b09642abf |
|                                      |         |                                  | ingress, IPv6, remote_group_id: c1b0edd0-24db-48b8-b83b-638b09642abf |
+--------------------------------------+---------+----------------------------------+----------------------------------------------------------------------+

Using neutron cli to list sec grps in a tenant which does not exist.
~~~
(overcloud) [stack@director13 ~]$ neutron security-group-list --tenant-id some-fake-tenant
neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead.
+--------------------------------------+---------+------------------+----------------------------------------------------------------------+
| id                                   | name    | tenant_id        | security_group_rules                                                 |
+--------------------------------------+---------+------------------+----------------------------------------------------------------------+
| a610f02f-7b37-468f-ae03-0b328c2364c5 | default | some-fake-tenant | egress, IPv4                                                         |
|                                      |         |                  | egress, IPv6                                                         |
|                                      |         |                  | ingress, IPv4, remote_group_id: a610f02f-7b37-468f-ae03-0b328c2364c5 |
|                                      |         |                  | ingress, IPv6, remote_group_id: a610f02f-7b37-468f-ae03-0b328c2364c5 |
+--------------------------------------+---------+------------------+----------------------------------------------------------------------+
~~~

(overcloud) [stack@director13 ~]$ neutron security-group-list 
neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead.
+--------------------------------------+---------+----------------------------------+----------------------------------------------------------------------+
| id                                   | name    | tenant_id                        | security_group_rules                                                 |
+--------------------------------------+---------+----------------------------------+----------------------------------------------------------------------+
| 5d33a0f2-e7d4-4ccc-a0f7-11d0a165d9ce | default | some-fake-tenant                 | egress, IPv4                                                         |
|                                      |         |                                  | egress, IPv6                                                         |
|                                      |         |                                  | ingress, IPv4, remote_group_id: 5d33a0f2-e7d4-4ccc-a0f7-11d0a165d9ce |
|                                      |         |                                  | ingress, IPv6, remote_group_id: 5d33a0f2-e7d4-4ccc-a0f7-11d0a165d9ce |
| c1b0edd0-24db-48b8-b83b-638b09642abf | default | 78c82decabc14c1493b1647bc8bf6791 | egress, IPv4                                                         |
|                                      |         |                                  | egress, IPv6                                                         |
|                                      |         |                                  | ingress, IPv4, remote_group_id: c1b0edd0-24db-48b8-b83b-638b09642abf |
|                                      |         |                                  | ingress, IPv6, remote_group_id: c1b0edd0-24db-48b8-b83b-638b09642abf |
+--------------------------------------+---------+----------------------------------+----------------------------------------------------------------------+


Version-Release number of selected component (if applicable):
python-neutron-12.0.6-10.el7ost.noarch
python2-neutronclient-6.7.0-1.el7ost.noarch
python2-neutron-lib-1.13.0-1.el7ost.noarch


How reproducible:
100%

Actual results:
When using "--tenant-id", existence of a project is not validated and new sec grp is created

Expected results:
Using "--tenant-id" should first check whether the project exists or not and only list sec grps in that tenant and certainly should not create new sec grps.


Additional info:

Note You need to log in before you can comment on or make changes to this bug.