Bug 2074400
| Summary: | Quotas usage not visible on cli for users with "member" role | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Eric Nothen <enothen> |
| Component: | python-openstackclient | Assignee: | mathieu bultel <mbultel> |
| Status: | CLOSED ERRATA | QA Contact: | nlevinki <nlevinki> |
| Severity: | medium | Docs Contact: | |
| Priority: | high | ||
| Version: | 16.2 (Train) | CC: | apevec, dpeacock, jpichon, jschluet, lhh, mbultel, ramishra, stchen, tvignaud |
| Target Milestone: | z4 | Keywords: | Triaged |
| Target Release: | 16.2 (Train on RHEL 8.4) | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | python-openstackclient-4.0.2-2.20220427020029.el8ost | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-12-07 19:22:17 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
With the caveat of having to reset the OS_COMPUTE_API_VERSION, this is working when using a newer version of the openstack client, at least for network and compute: [stack.lab ~]$ openstack --version openstack 4.0.2 [stack.lab ~]$ [stack.lab ~]$ source quota_member-rc (quota_member@quota-test) [stack.lab ~]$ openstack quota list --network --detail --project c75b6bb4d04948d99512843f2340f9da You are not authorized to perform the requested action: identity:list_projects. (HTTP 403) (Request-ID: req-e57b3646-f871-48bc-9069-a3949f024eb4) (quota_member@quota-test) [stack.lab ~]$ (quota_member@quota-test) [stack.lab ~]$ source ospcli/bin/activate (ospcli) (quota_member@quota-test) [stack.lab ~]$ (ospcli) (quota_member@quota-test) [stack.lab ~]$ openstack --version openstack 5.8.0 (ospcli) (quota_member@quota-test) [stack.lab ~]$ openstack quota list --network --detail --project c75b6bb4d04948d99512843f2340f9da +----------------------+--------+----------+-------+ | Resource | In Use | Reserved | Limit | +----------------------+--------+----------+-------+ | floating_ips | 0 | 0 | 50 | | networks | 0 | 0 | 100 | | ports | 0 | 0 | 500 | | rbac_policies | 0 | 0 | 10 | | routers | 0 | 0 | 10 | | subnets | 0 | 0 | 100 | | subnet_pools | 0 | 0 | -1 | | security_group_rules | 0 | 0 | 100 | | security_groups | 0 | 0 | 10 | +----------------------+--------+----------+-------+ (ospcli) (quota_member@quota-test) [stack.lab ~]$ openstack quota list --compute --detail --project c75b6bb4d04948d99512843f2340f9da Version 2.90 is not supported by the API. Minimum is 2.1 and maximum is 2.79. (HTTP 406) (Request-ID: req-91f40d29-2123-423c-8dd3-85b87119e96f) (ospcli) (quota_member@quota-test) [stack.lab ~]$ (ospcli) (quota_member@quota-test) [stack.lab ~]$ export OS_COMPUTE_API_VERSION=2.79 (ospcli) (quota_member@quota-test) [stack.lab ~]$ openstack quota list --compute --detail --project c75b6bb4d04948d99512843f2340f9da +----------------------+--------+----------+-------+ | Resource | In Use | Reserved | Limit | +----------------------+--------+----------+-------+ | cores | 0 | 0 | 20 | | instances | 0 | 0 | 10 | | key_pairs | 0 | 0 | 100 | | metadata_items | 0 | 0 | 128 | | ram | 0 | 0 | 51200 | | server_group_members | 0 | 0 | 10 | | server_groups | 0 | 0 | 10 | +----------------------+--------+----------+-------+ (ospcli) (quota_member@quota-test) [stack.lab ~]$ openstack quota list --volume --detail --project c75b6bb4d04948d99512843f2340f9da Volume service doesn't provide detailed quota information (ospcli) (quota_member@quota-test) [stack.lab ~]$ openstack quota list --volume --project c75b6bb4d04948d99512843f2340f9da (ospcli) (quota_member@quota-test) [stack.lab ~]$ Hey, I cherry picked the fix to stable/ussuri and stable/train but I'm not sure we will be able to backport this into 16.1 (blocker only) and maybe even 16.2. Maybe we can target 16.2.4 but we need ack from PM & so on. Eric, does a customer hardly impact by this ? Do you want to increase the priority and severity ? (In reply to mathieu bultel from comment #3) > Hey, > > I cherry picked the fix to stable/ussuri and stable/train but I'm not sure > we will be able to backport this into 16.1 (blocker only) and maybe even > 16.2. > Maybe we can target 16.2.4 but we need ack from PM & so on. > > Eric, does a customer hardly impact by this ? Do you want to increase the > priority and severity ? I don't think so, as there are workarounds in place, but I will keep the needinfo and consult with them. @Eric Ack, I will try to get this into 16.2.4. I will test the patches to be sure that it solve the customer issue. Do you have a way to validate as well ? And if we target 16.2, can you update the release field from 16.1 to 16.2 ? (In reply to mathieu bultel from comment #6) > @Eric > > Ack, I will try to get this into 16.2.4. > I will test the patches to be sure that it solve the customer issue. > Do you have a way to validate as well ? Yeah, I can test, but it would just using the methods described on the BZ description and c2. (In reply to mathieu bultel from comment #7) > And if we target 16.2, can you update the release field from 16.1 to 16.2 ? Done Mathieu, are we still good to include this BZ in 16.2.4? Hey Eric, It's on a good way, just need to land the backport downstream and it will be on his way to 16.2.4. (In reply to mathieu bultel from comment #10) > Hey Eric, > > It's on a good way, just need to land the backport downstream and it will be > on his way to 16.2.4. Hey Mathieu, sorry for the repetition, but I see this BZ is still ON_DEV passed the Oct. 5th deadline. Will it still make it to 16.2.4? @Eric, yes, it has been merged yesterday. I got hardtime to find someone able to merge it downstream. (In reply to mathieu bultel from comment #12) > @Eric, yes, it has been merged yesterday. > I got hardtime to find someone able to merge it downstream. Great, thanks for the confirmation. Can you tell me if the fix addresses network, compute and volume quotas as well? When I tested with a newer version of the client (c#2), volume quotas was still not working in that version (5.8.0). Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Release of components for Red Hat OpenStack Platform 16.2.4), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:8794 The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days |
Description of problem: When a user with "member" role on a tenant logs into horizon, can see multiple metrics of quotas usage, divided in three main groups: 1. Compute: Instances, VCPUs and RAM 2. Volume: Volumes, Volume Snapshots, Volume Storage 3. Network: Floating IPs, Security Groups, Security Group Rules When the same user uses the openstack cli, this information is not visible. It's only visible to users with an "admin" role on the tenant. Version-Release number of selected component (if applicable): Not working on 16.1.7, 16.1.8, 16.2.1 and 16.2.2 How reproducible: Always reproducible on fresh RHOSP installs. Steps to Reproduce: 1. Deploy a new RHOSP cluster, any version mentioned above (overcloud) [stack.lab ~]$ ansible -i inventory.yaml -m shell -a 'cat /etc/rhosp-release' Controller -b overcloud-controller-0 | CHANGED | rc=0 >> Red Hat OpenStack Platform release 16.2.2 (Train) overcloud-controller-2 | CHANGED | rc=0 >> Red Hat OpenStack Platform release 16.2.2 (Train) overcloud-controller-1 | CHANGED | rc=0 >> Red Hat OpenStack Platform release 16.2.2 (Train) 2. Create a new project (overcloud) [stack.lab ~]$ openstack project create quota-test +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | | | domain_id | default | | enabled | True | | id | c75b6bb4d04948d99512843f2340f9da | | is_domain | False | | name | quota-test | | options | {} | | parent_id | default | | tags | [] | +-------------+----------------------------------+ 3. Create a user with member role and another one with admin role into the same project (overcloud) [stack.lab ~]$ openstack user create --project quota-test --project-domain default --domain default --password redhat quota_member +---------------------+----------------------------------+ | Field | Value | +---------------------+----------------------------------+ | default_project_id | c75b6bb4d04948d99512843f2340f9da | | domain_id | default | | enabled | True | | id | cb90d2ae365940219f0442adc67c959a | | name | quota_member | | options | {} | | password_expires_at | None | +---------------------+----------------------------------+ (overcloud) [stack.lab ~]$ openstack role add --user-domain default --user quota_member --project quota-test --project-domain default member (overcloud) [stack.lab ~]$ openstack user create --project quota-test --project-domain default --domain default --password redhat quota_admin +---------------------+----------------------------------+ | Field | Value | +---------------------+----------------------------------+ | default_project_id | c75b6bb4d04948d99512843f2340f9da | | domain_id | default | | enabled | True | | id | 7dfe3d2f35aa46f189b06dac42c1dcc9 | | name | quota_admin | | options | {} | | password_expires_at | None | +---------------------+----------------------------------+ (overcloud) [stack.lab ~]$ openstack role add --user-domain default --user quota_admin --project quota-test --project-domain default admin (overcloud) [stack.lab ~]$ openstack role assignment list --user-domain default --names --project quota-test +--------+----------------------+-------+--------------------+--------+--------+-----------+ | Role | User | Group | Project | Domain | System | Inherited | +--------+----------------------+-------+--------------------+--------+--------+-----------+ | admin | quota_admin@Default | | quota-test@Default | | | False | | member | quota_member@Default | | quota-test@Default | | | False | +--------+----------------------+-------+--------------------+--------+--------+-----------+ 4. Create rc file for both users (overcloud) [stack.lab ~]$ cp overcloudrc quota_member-rc (overcloud) [stack.lab ~]$ sed -i 's/OS_USERNAME=admin/OS_USERNAME=quota_member/;s/OS_PROJECT_NAME=admin/OS_PROJECT_NAME=quota-test/;s/OS_CLOUDNAME=overcloud/OS_CLOUDNAME=quota_member@quota-test/' quota_member-rc (overcloud) [stack.lab ~]$ cp overcloudrc quota_admin-rc (overcloud) [stack.lab ~]$ sed -i 's/OS_USERNAME=admin/OS_USERNAME=quota_admin/;s/OS_PROJECT_NAME=admin/OS_PROJECT_NAME=quota-test/;s/OS_CLOUDNAME=overcloud/OS_CLOUDNAME=quota_admin@quota-test/' quota_admin-rc Actual results: User is not allowed to get quotas usage due to a restriction to list projects (even when the project id is specified on the cli): (overcloud) [stack.lab ~]$ source quota_member-rc (quota_member@quota-test) [stack.lab ~]$ (quota_member@quota-test) [stack.lab ~]$ openstack quota list --network --detail --project c75b6bb4d04948d99512843f2340f9da You are not authorized to perform the requested action: identity:list_projects. (HTTP 403) (Request-ID: req-44c1098f-8257-4a00-b2cc-9e5538ab0a4d) (quota_member@quota-test) [stack.lab ~]$ (quota_member@quota-test) [stack.lab ~]$ openstack quota list --compute --detail --project c75b6bb4d04948d99512843f2340f9da You are not authorized to perform the requested action: identity:list_projects. (HTTP 403) (Request-ID: req-91384c84-2b2e-4f9b-b9cb-c5c022c8da66) (quota_member@quota-test) [stack.lab ~]$ (quota_member@quota-test) [stack.lab ~]$ openstack quota list --volume --detail --project c75b6bb4d04948d99512843f2340f9da You are not authorized to perform the requested action: identity:list_projects. (HTTP 403) (Request-ID: req-ee6b921c-2c01-4816-9e26-efc700e6e209) (quota_member@quota-test) [stack.lab ~]$ Expected results: This information is visible to the "member" user on the web interface and should also be available when using the openstack cli. Additional info: The information is actually available for the user on the API: (quota_member@quota-test) [stack.lab ~]$ export OS_TOKEN=$(openstack token issue -c id -f value) (quota_member@quota-test) [stack.lab ~]$ curl -X GET http://192.168.24.13:9696/v2.0/quotas/c75b6bb4d04948d99512843f2340f9da/details -H "Accept: application/json" -H "X-Auth-Token: $OS_TOKEN" | jq . % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 557 100 557 0 0 873 0 --:--:-- --:--:-- --:--:-- 873 { "quota": { "network": { "limit": 100, "used": 0, "reserved": 0 }, "subnet": { "limit": 100, "used": 0, "reserved": 0 }, "subnetpool": { "limit": -1, "used": 0, "reserved": 0 }, "port": { "limit": 500, "used": 0, "reserved": 0 }, "router": { "limit": 10, "used": 0, "reserved": 0 }, "floatingip": { "limit": 50, "used": 0, "reserved": 0 }, "rbac_policy": { "limit": 10, "used": 0, "reserved": 0 }, "security_group": { "limit": 10, "used": 0, "reserved": 0 }, "security_group_rule": { "limit": 100, "used": 0, "reserved": 0 }, "trunk": { "limit": -1, "used": 0, "reserved": 0 } } } (quota_member@quota-test) [stack.lab ~]$ (quota_member@quota-test) [stack.lab ~]$ curl -X GET http://192.168.24.13:8774/v2.1/os-quota-sets/c75b6bb4d04948d99512843f2340f9da/detail -H "Accept: application/json" -H "X-Auth-Token: $OS_TOKEN" | jq . % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 917 100 917 0 0 1450 0 --:--:-- --:--:-- --:--:-- 1448 { "quota_set": { "id": "c75b6bb4d04948d99512843f2340f9da", "cores": { "limit": 20, "in_use": 0, "reserved": 0 }, "fixed_ips": { "limit": -1, "in_use": 0, "reserved": 0 }, "floating_ips": { "limit": 10, "in_use": 0, "reserved": 0 }, "injected_file_content_bytes": { "limit": 10240, "in_use": 0, "reserved": 0 }, "injected_file_path_bytes": { "limit": 255, "in_use": 0, "reserved": 0 }, "injected_files": { "limit": 5, "in_use": 0, "reserved": 0 }, "instances": { "limit": 10, "in_use": 0, "reserved": 0 }, "key_pairs": { "limit": 100, "in_use": 0, "reserved": 0 }, "metadata_items": { "limit": 128, "in_use": 0, "reserved": 0 }, "ram": { "limit": 51200, "in_use": 0, "reserved": 0 }, "security_group_rules": { "limit": 20, "in_use": 0, "reserved": 0 }, "security_groups": { "limit": 10, "in_use": 0, "reserved": 0 }, "server_group_members": { "limit": 10, "in_use": 0, "reserved": 0 }, "server_groups": { "limit": 10, "in_use": 0, "reserved": 0 } } } (quota_member@quota-test) [stack.lab ~]$ curl -X GET http://192.168.24.13:8776/v3/c75b6bb4d04948d99512843f2340f9da/os-quota-sets/c75b6bb4d04948d99512843f2340f9da?usage=True -H "Accept: application/json" -H "X-Auth-Token: $OS_TOKEN" | jq . % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 666 100 666 0 0 11100 0 --:--:-- --:--:-- --:--:-- 11288 { "quota_set": { "volumes": { "limit": 10, "in_use": 0, "reserved": 0 }, "per_volume_gigabytes": { "limit": -1, "in_use": 0, "reserved": 0 }, "snapshots": { "limit": 10, "in_use": 0, "reserved": 0 }, "gigabytes": { "limit": 1000, "in_use": 0, "reserved": 0 }, "backups": { "limit": 10, "in_use": 0, "reserved": 0 }, "backup_gigabytes": { "limit": 1000, "in_use": 0, "reserved": 0 }, "volumes___DEFAULT__": { "limit": -1, "in_use": 0, "reserved": 0 }, "gigabytes___DEFAULT__": { "limit": -1, "in_use": 0, "reserved": 0 }, "snapshots___DEFAULT__": { "limit": -1, "in_use": 0, "reserved": 0 }, "groups": { "limit": 10, "in_use": 0, "reserved": 0 }, "id": "c75b6bb4d04948d99512843f2340f9da" } } (quota_member@quota-test) [stack.lab ~]$