[openstack-dev] Resources owned by a project/tenant are not cleaned up after that project is deleted from keystone
mriedem at linux.vnet.ibm.com
Mon Feb 2 17:46:53 UTC 2015
This came up in the operators mailing list back in June  but given
the subject probably didn't get much attention.
Basically there is a really old bug  from Grizzly that is still a
problem and affects multiple projects. A tenant can be deleted in
Keystone even though other resources in other projects are under that
project, and those resources aren't cleaned up.
Keystone implemented event notifications back in Havana  but the
other projects aren't listening on them to know when a project has been
deleted and act accordingly.
The bug has several people saying "we should talk about this at the
summit" for several summits, but I can't find any discussion or summit
sessions related back to the bug.
Given this is an operations and cross-project issue, I'd like to bring
it up again for the Vancouver summit if there is still interest (which
I'm assuming there is from operators).
There is a blueprint specifically for the tenant deletion case but it's
targeted at only Horizon .
Is anyone still working on this? Is there sufficient interest in a
cross-project session at the L summit?
Thinking out loud, even if nova doesn't listen to events from keystone,
we could at least have a periodic task that looks for instances where
the tenant no longer exists in keystone and then take some action (log a
warning, shutdown/archive/, reap, etc).
There is also a spec for L to transfer instance ownership  which
could maybe come into play, but I wouldn't depend on it.
More information about the OpenStack-dev