<div dir="ltr"><div><div><div><div><div><div><div><div><div>Duncan, Attila,<br></div> Thanks for your response.<br><br></div>We found a issue when using os_priviledge_user_name which is when we sent this patch<br><a href="https://review.openstack.org/#/c/156940/">https://review.openstack.org/#/c/156940/</a><br><br></div>Post that we used admin user, its password and admin tenant in cinder.conf to make it work<br></div>But we thought that using admin creds (esp password) isn't secure in cinder.conf so we thought of <br></div>patching tempest test case, but later while talking with Attila on IRC, figured that we can use<br></div>user 'nova' which is added to admin role in lib/nova as part of devstack setup<br><br></div>So we plan to test using nova creds.<br></div><div></div><div><br></div>thanx,<br></div>deepak<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Mar 2, 2015 at 5:24 PM, Duncan Thomas <span dir="ltr"><<a href="mailto:duncan.thomas@gmail.com" target="_blank">duncan.thomas@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p>I'm assuming your mean the following lines in nova policy.js:<br>
"compute_extension:os-assisted-volume-snapshots:create":"rule:admin_api",<br>
"compute_extension:os-assisted-volume-snapshots:delete":"rule:admin_api"</p>
<p>These 2 calls are not intended to be made directly via an end user, but via cinder, as a privileged user.</p>
<p>Please do not patch tempest, since this is a real bug it is highlighting. The fix is to get cinder to use a privileged user account to make this call. Please raise a cinder bug.</p>
<p>Thanks<br><br><br><br><br><br></p>
<div style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
<div bgcolor="#FFFFFF" text="#000000">
Hi,<br>
<br>
As part of tempest job "
<a href="http://logs.openstack.org/11/159711/1/experimental/gate-tempest-dsvm-full-glusterfs/b2cb37e/" style="text-decoration:none;color:rgb(6,84,172);font-family:sans-serif;font-size:small;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255)" target="_blank">gate-tempest-dsvm-full-glusterfs</a>"
run [1], the test case "
<span style="color:rgb(121,93,163);font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:16.7999992370605px;text-align:start;text-indent:0px;text-transform:none;white-space:pre-wrap;word-spacing:0px;display:inline!important;float:none;background-color:rgb(255,255,255)">test_snapshot_create_with_volume_in_use"</span>
[2] is failing.<br>
This is because demo user is unable to create online snapshots, due
to nova policy rules[3].<br>
<br>
To avoid this issue we can modify test case, to make "demo" user as
an admin before creating snapshot and reverting after it finishes.<br>
<br>
Another approach is to use privileged user
(<a href="https://review.openstack.org/#/c/156940/" target="_blank">https://review.openstack.org/#/c/156940/</a>) to create online
snapshot.<br>
<br>
[1]
<a href="http://logs.openstack.org/11/159711/1/experimental/gate-tempest-dsvm-full-glusterfs/b2cb37e/" target="_blank">http://logs.openstack.org/11/159711/1/experimental/gate-tempest-dsvm-full-glusterfs/b2cb37e/</a><br>
[2]
<a href="https://github.com/openstack/tempest/blob/master/tempest/api/volume/test_volumes_snapshots.py#L66" target="_blank">https://github.com/openstack/tempest/blob/master/tempest/api/volume/test_volumes_snapshots.py#L66</a><br>
[3]
<a href="https://github.com/openstack/nova/blob/master/etc/nova/policy.json#L329" target="_blank">https://github.com/openstack/nova/blob/master/etc/nova/policy.json#L329</a><br>
<pre cols="72">--
Warm Regards,
Bharat Kumar Kobagana
Software Engineer
OpenStack Storage – RedHat India
</pre>
</div>
<br></div></div><span class="">__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></span></div>
<br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div>