<div dir="ltr">Hi Li,<div><br></div><div>The problem here is that db.service_get_by_compute_host() requires admin context. [1] The live_migrate command needs to check that both hosts have a running nova-compute service before it begins migration. Perhaps the live_migrate task is passing the incorrect context in for this database query? [2] I would think that conductor should be running under it's own context and not the caller's context? (Devs?)</div>
<div><br></div><div>And before someone comments that migration should always be *admin-only*, I'll point out that there are legitimate reasons an operator might want to give someone migrate permissions and not all admin permissions.</div>
<div><br></div><div>~ Scott</div><div><br></div><div>[1] <a href="https://github.com/openstack/nova/blob/master/nova/db/sqlalchemy/api.py#L485">https://github.com/openstack/nova/blob/master/nova/db/sqlalchemy/api.py#L485</a></div>
<div>[2] <a href="https://github.com/openstack/nova/blob/master/nova/conductor/tasks/live_migrate.py#L87">https://github.com/openstack/nova/blob/master/nova/conductor/tasks/live_migrate.py#L87</a></div></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Tue, Jun 24, 2014 at 9:11 PM, Li, Chen <span dir="ltr"><<a href="mailto:chen.li@intel.com" target="_blank">chen.li@intel.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="color:#1f497d">Hi </span><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">Sushma</span><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">Thanks for the reply.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">Well, edit
</span><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">/etc/nova/policy.json</span><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"> do works for command “nova migrate”.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">But when I run command “nova live-migration”, I still get errors, in /var/log/nova/conductor.log:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:07:23.897 115385 INFO oslo.messaging._drivers.impl_qpid [-] Connected to AMQP server on <a href="http://192.168.40.122:5672" target="_blank">192.168.40.122:5672</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 ERROR nova.conductor.manager [req-63f0a004-ef69-47f4-aefb-e0fa194d99b9 fa970646fa92442fa14b2b759cf381a6 2eb6bd3a69ad454a90489dd12b9cdf3b] Migration of instance 446d96d7-2073-46ac-b40c-0f167fbd04b2
to host None unexpectedly failed.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager Traceback (most recent call last):<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager File "/usr/lib/python2.6/site-packages/nova/conductor/manager.py", line 757, in _live_migrate<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager block_migration, disk_over_commit)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager File "/usr/lib/python2.6/site-packages/nova/conductor/tasks/live_migrate.py", line 191, in execute<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager return task.execute()<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager File "/usr/lib/python2.6/site-packages/nova/conductor/tasks/live_migrate.py", line 56, in execute<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager self._check_host_is_up(self.source)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager File "/usr/lib/python2.6/site-packages/nova/conductor/tasks/live_migrate.py", line 87, in _check_host_is_up<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager service = db.service_get_by_compute_host(self.context, host)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager File "/usr/lib/python2.6/site-packages/nova/db/api.py", line 129, in service_get_by_compute_host<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager return IMPL.service_get_by_compute_host(context, host)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager File "/usr/lib/python2.6/site-packages/nova/db/sqlalchemy/api.py", line 145, in wrapper<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager nova.context.require_admin_context(args[0])<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager File "/usr/lib/python2.6/site-packages/nova/context.py", line 195, in require_admin_context<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager raise exception.AdminRequired()<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager AdminRequired: User does not have admin privileges<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.221 115395 TRACE nova.conductor.manager<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.226 115395 ERROR oslo.messaging.rpc.dispatcher [-] Exception during message handling: Migration error: User does not have admin privileges<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.226 115395 TRACE oslo.messaging.rpc.dispatcher Traceback (most recent call last):<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.226 115395 TRACE oslo.messaging.rpc.dispatcher File "/usr/lib/python2.6/site-packages/oslo/messaging/rpc/dispatcher.py", line 133, in _dispatch_and_reply<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.226 115395 TRACE oslo.messaging.rpc.dispatcher incoming.message))<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.226 115395 TRACE oslo.messaging.rpc.dispatcher File "/usr/lib/python2.6/site-packages/oslo/messaging/rpc/dispatcher.py", line 176, in _dispatch<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.226 115395 TRACE oslo.messaging.rpc.dispatcher return self._do_dispatch(endpoint, method, ctxt, args)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.226 115395 TRACE oslo.messaging.rpc.dispatcher File "/usr/lib/python2.6/site-packages/oslo/messaging/rpc/dispatcher.py", line 122, in _do_dispatch<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.226 115395 TRACE oslo.messaging.rpc.dispatcher result = getattr(endpoint, method)(ctxt, **new_args)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.226 115395 TRACE oslo.messaging.rpc.dispatcher File "/usr/lib/python2.6/site-packages/oslo/messaging/rpc/server.py", line 139, in inner<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.226 115395 TRACE oslo.messaging.rpc.dispatcher return func(*args, **kwargs)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.226 115395 TRACE oslo.messaging.rpc.dispatcher File "/usr/lib/python2.6/site-packages/nova/conductor/manager.py", line 681, in migrate_server<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.226 115395 TRACE oslo.messaging.rpc.dispatcher block_migration, disk_over_commit)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.226 115395 TRACE oslo.messaging.rpc.dispatcher File "/usr/lib/python2.6/site-packages/nova/conductor/manager.py", line 783, in _live_migrate<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.226 115395 TRACE oslo.messaging.rpc.dispatcher raise exception.MigrationError(reason=ex)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.226 115395 TRACE oslo.messaging.rpc.dispatcher MigrationError: Migration error: User does not have admin privileges<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.226 115395 TRACE oslo.messaging.rpc.dispatcher<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.228 115395 ERROR oslo.messaging._drivers.common [-] Returning exception Migration error: User does not have admin privileges to caller<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">2014-06-25 02:08:59.228 115395 ERROR oslo.messaging._drivers.common [-] ['Traceback (most recent call last):\n', ' File "/usr/lib/python2.6/site-packages/oslo/messaging/rpc/dispatcher.py", line 133, in _dispatch_and_reply\n
incoming.message))\n', ' File "/usr/lib/python2.6/site-packages/oslo/messaging/rpc/dispatcher.py", line 176, in _dispatch\n return self._do_dispatch(endpoint, method, ctxt, args)\n', ' File "/usr/lib/python2.6/site-packages/oslo/messaging/rpc/dispatcher.py",
line 122, in _do_dispatch\n result = getattr(endpoint, method)(ctxt, **new_args)\n', ' File "/usr/lib/python2.6/site-packages/oslo/messaging/rpc/server.py", line 139, in inner\n return func(*args, **kwargs)\n', ' File "/usr/lib/python2.6/site-packages/nova/conductor/manager.py",
line 681, in migrate_server\n block_migration, disk_over_commit)\n', ' File "/usr/lib/python2.6/site-packages/nova/conductor/manager.py", line 783, in _live_migrate\n raise exception.MigrationError(reason=ex)\n', 'MigrationError: Migration error: User
does not have admin privileges\n']<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Sushma Korati [mailto:<a href="mailto:sushma_korati@persistent.co.in" target="_blank">sushma_korati@persistent.co.in</a>]
<br>
<b>Sent:</b> Tuesday, June 24, 2014 4:43 PM<br>
<b>To:</b> Li, Chen; <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
<b>Subject:</b> RE: How can I enable operation for non-admin user<u></u><u></u></span></p>
</div>
</div><div class="">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p style="background:white"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><u></u> <u></u></span></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">Hi Li,<br>
<br>
As fas as I know to migrate an instance you'll need admin priviliges.<br>
But if you want to allow this operation for normal user then might try editing /etc/nova/policy.json file and give privileges.
<br>
<br>
File: /etc/nova/policy.json <br>
change "compute_extension:admin_actions:migrate": "rule:admin_api" to<br>
"compute_extension:admin_actions:migrate": "<strong><span style="font-family:"Tahoma","sans-serif"">rule:admin_or_owner</span></strong>"<br>
<br>
<br>
Regards,<br>
Sushma <u></u><u></u></span></p>
<div name="divtagdefaultwrapper">
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><u></u> <u></u></span></p>
</div>
</div>
</div>
</div>
<div>
<div class="MsoNormal" align="center" style="text-align:center;background:white">
<span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#282828">
<hr size="2" width="98%" align="center">
</span></div>
<div>
<p class="MsoNormal" style="background:white"><b><span style="color:black">From:</span></b><span style="color:black"> Li, Chen <<a href="mailto:chen.li@intel.com" target="_blank">chen.li@intel.com</a>><br>
<b>Sent:</b> Tuesday, June 24, 2014 1:44 PM<br>
<b>To:</b> <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
<b>Subject:</b> [Openstack] How can I enable operation for non-admin user</span><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#282828">
<u></u><u></u></span></p>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#282828"> <u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:#282828">Hi list,<u></u><u></u></span></p>
<p class="MsoNormal" style="background:white"><span style="color:#282828"> <u></u><u></u></span></p>
<p class="MsoNormal" style="background:white"><span style="color:#282828">I’m working under CentOS + icehouse.<u></u><u></u></span></p>
<p class="MsoNormal" style="background:white"><span style="color:#282828"> <u></u><u></u></span></p>
<p class="MsoNormal" style="background:white"><span style="color:#282828">While, I have an non-admin user “demo”, and I can work under this this user with basic operations.<u></u><u></u></span></p>
<p class="MsoNormal" style="background:white"><span style="color:#282828">Everything works well.<u></u><u></u></span></p>
<p class="MsoNormal" style="background:white"><span style="color:#282828"> <u></u><u></u></span></p>
<p class="MsoNormal" style="background:white"><span style="color:#282828">But, I also hope this user can do some admin operations, such as migrate and so on, because currently when I run command:<u></u><u></u></span></p>
<p class="MsoNormal" style="text-indent:.5in;background:white"><span style="color:#282828">nova migrate ${my_instance}<u></u><u></u></span></p>
<p class="MsoNormal" style="background:white"><span style="color:#282828">I get output:<u></u><u></u></span></p>
<p class="MsoNormal" style="text-indent:.5in;background:white"><span style="color:#282828">ERROR: Policy doesn't allow compute_extension:admin_actions:migrate to be performed. (HTTP 403) (Request-ID: req-698ad5b5-f1fe-48fc-b81f-a765020bf89f)<u></u><u></u></span></p>
<p class="MsoNormal" style="background:white"><span style="color:#282828"> <u></u><u></u></span></p>
<p class="MsoNormal" style="background:white"><span style="color:#282828">Anyone can help me ?<u></u><u></u></span></p>
<p class="MsoNormal" style="background:white"><span style="color:#282828"> <u></u><u></u></span></p>
<p class="MsoNormal" style="background:white"><span style="color:#282828">Thanks.<u></u><u></u></span></p>
<p class="MsoNormal" style="background:white"><span style="color:#282828">-chen<u></u><u></u></span></p>
</div>
</div>
</div>
</div>
</div></div>
</div>
<br>_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
<br></blockquote></div><br></div>