[Openstack-operators] Resources owned by a project/tenant are not cleaned up after that project is deleted from keystone

Jay Pipes jaypipes at gmail.com
Mon Feb 2 21:49:17 UTC 2015

On 02/02/2015 12:46 PM, Matt Riedemann wrote:
> This came up in the operators mailing list back in June [1] but given
> the subject probably didn't get much attention.
> Basically there is a really old bug [2] from Grizzly that is still a
> problem and affects multiple projects.  A tenant can be deleted in
> Keystone even though other resources in other projects are under that
> project, and those resources aren't cleaned up.
> Keystone implemented event notifications back in Havana [3] but the
> other projects aren't listening on them to know when a project has been
> deleted and act accordingly.
> The bug has several people saying "we should talk about this at the
> summit" for several summits, but I can't find any discussion or summit
> sessions related back to the bug.
> Given this is an operations and cross-project issue, I'd like to bring
> it up again for the Vancouver summit if there is still interest (which
> I'm assuming there is from operators).
> There is a blueprint specifically for the tenant deletion case but it's
> targeted at only Horizon [4].
> Is anyone still working on this? Is there sufficient interest in a
> cross-project session at the L summit?
> Thinking out loud, even if nova doesn't listen to events from keystone,
> we could at least have a periodic task that looks for instances where
> the tenant no longer exists in keystone and then take some action (log a
> warning, shutdown/archive/, reap, etc).
> There is also a spec for L to transfer instance ownership [5] which
> could maybe come into play, but I wouldn't depend on it.

I support adding this to Nova, yes. We listen for events from Neutron 
and act upon them; Keystone events should be handled no different, IMO.


More information about the OpenStack-operators mailing list