Apologies, like Matt pointed out I sort of forgot to add the title in my original email.
On Tue, Nov 26, 2019 at 7:08 PM Surya Seetharaman < surya.seetharaman9@gmail.com> wrote:
Hello everyone,
We came across this bug [1] in nova recently and wanted to know what people think is the best (relatively) way to fix this.
In the past, the project id validation was added as a best effort to prevent users from being able to enter random values into the database. When this validation is used from the os flavor set/unset admin apis [2], there are chances that keystone returns a 403 which gets silently ignored by nova [3] allowing the user to enter the provided project_id/name without validation or warning or remove an existing flavor-project mapping. There were a couple of options discussed on IRC [4] to fix this behaviour out of which the practically reasonable ones are:
- close the bug as invalid - tweak your config (we could add docs, idk if
that would be found or help) to do what you need to avoid the 403 from keystone 2) change the 403 case as an error and raise it back to the compute api caller - maybe enough time has passed to not worry about backward compat with the old non-validating behavior
Option 2 seems better than option 1 for most of us, however what we cannot agree upon is if this change should be accompanied by a microversion bump or not.
[1] https://bugs.launchpad.net/nova/+bug/1854053 [2] https://github.com/openstack/nova/blob/fd67f69cfdaf04620f2e8a5f1fbf573709696... [3] https://github.com/openstack/nova/blob/d621914442855ce67ce0b99003f7e69e8ee51... [4] http://eavesdrop.openstack.org/irclogs/%23openstack-nova/%23openstack-nova.2...
Cheers, Surya.