Bug 2232573 - Shared networks can be returned as "shared=False" in the API request
Summary: Shared networks can be returned as "shared=False" in the API request
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: documentation
Version: 16.2 (Train)
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: z6
: ---
Assignee: Greg Rakauskas
QA Contact: RHOS Documentation Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-08-17 12:33 UTC by Slawek Kaplonski
Modified: 2023-08-29 13:26 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Known Issue
Doc Text:
In RHOSP 16.2.5, there is a known issue where SQLAlchemy queries don't retrieve all of the RHOSP Networking service (neutron) RBAC entries for network resources. + For example, if a network has two RBAC registers, one with action `access_as_shared` and other with `access_as_external`, and both are accessible to a specific non-admin user, the `openstack port list --share` query does not show the related network. However, this network is still available to the user because of the `access_as_external` RBAC entry. + Workaround: Currently, there is no workaround.
Clone Of:
Environment:
Last Closed: 2023-08-29 13:26:44 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Launchpad 2031656 0 None None None 2023-08-17 12:33:34 UTC
Red Hat Bugzilla 2209754 0 high ON_QA Neutron very long when lot of RBAC are used 2023-08-25 08:00:55 UTC
Red Hat Issue Tracker OSP-27556 0 None None None 2023-08-17 12:33:44 UTC

Description Slawek Kaplonski 2023-08-17 12:33:00 UTC
This issue is caused by https://github.com/openstack/neutron-lib/commit/829e97024c2b73dd67bfd8a04c65f03be556eec8 which added "group by" clause to the sql query to get e.g. all networks.
If network is "access_as_external" and also "access_as_shared" then if regular user will do API request like:

GET /v2.0/networks?shared=True

It will receive that external AND shared network but it will have "shared=False" in the network parameters.

This is also causing failures in our CI jobs, like: https://rhos-ci-jenkins.lab.eng.tlv2.redhat.com/job/DFG-network-networking-ovn-16.2_director-rhel-virthost-3cont_2comp-ipv4-vxlan-ovn/24//artifact/tempest-results/tempest-results-neutron.1.html - see test neutron_tempest_plugin.api.admin.test_shared_network_extension.SharedNetworksTest.test_filtering_shared_networks

Comment 7 Greg Rakauskas 2023-08-29 13:26:25 UTC
Hi,

I have incorporated feedback from the tech review and added the Doc Text to the
RHOSP 16.2.5 Release Notes. Customers can see the fix here:

   https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/16.2/html-single/release_notes/index#known_issues_6

--Greg


Note You need to log in before you can comment on or make changes to this bug.