<div dir="ltr">Hey Radomir,<div><br></div><div>Thanks for your input. I did indeed find that patch and used it to patch my env. In this case though, it didn’t seem to change the API request sent to Neutron.</div><div><br></div><div>If I log the data variable at this <a href="https://github.com/openstack/horizon/blob/master/openstack_dashboard/dashboards/project/networks/ports/workflows.py#L431">point</a> after applying the patch. It contains all of the fields:</div><div><br></div><div><span style="color:rgb(0,0,0)"><font face="Menlo">2022-09-16 00:01:55,046 35 INFO openstack_dashboard.dashboards.project.networks.ports.workflows bshephar - Data variable = {'port_id': '4df563ce-5464-4f7d-8aaf-c5496cdaefda', 'network_id': 'acefae53-b4d5-422f-bcca-dc32a0785d21', 'name': '', 'admin_state': True, 'target_tenant_id': '3ff28fc7abf742a6b7a0d016771dee49', 'binding__vnic_type': 'normal', 'port_security_enabled': True, 'instance_id': 'ccb72b14-3694-40fa-9b3b-ec1a8d7ef046', 'mac_state': None, 'wanted_groups': ['a3ae6e20-67df-4a72-9d5b-cc21ad87464f']}</font></span></div><div><br></div><div> So checking this</div><div> <span style="color:rgb(68,75,116);font-family:Menlo,Monaco,"Courier New",monospace;white-space:pre-wrap;background-color:rgb(244,249,255)"> </span><span style="font-family:Menlo,Monaco,"Courier New",monospace;white-space:pre-wrap;color:rgb(9,114,157);font-style:italic">if</span><span style="color:rgb(68,75,116);font-family:Menlo,Monaco,"Courier New",monospace;white-space:pre-wrap;background-color:rgb(244,249,255)"> </span><span style="color:rgb(68,75,116);font-family:Menlo,Monaco,"Courier New",monospace;white-space:pre-wrap;font-style:italic">data</span><span style="font-family:Menlo,Monaco,"Courier New",monospace;white-space:pre-wrap;color:rgb(9,114,157)">[</span><span style="font-family:Menlo,Monaco,"Courier New",monospace;white-space:pre-wrap;color:rgb(9,114,157)">'</span><span style="font-family:Menlo,Monaco,"Courier New",monospace;white-space:pre-wrap;color:rgb(85,131,17)">port_security_enabled</span><span style="font-family:Menlo,Monaco,"Courier New",monospace;white-space:pre-wrap;color:rgb(9,114,157)">'</span><span style="font-family:Menlo,Monaco,"Courier New",monospace;white-space:pre-wrap;color:rgb(9,114,157)">]</span><span style="color:rgb(68,75,116);font-family:Menlo,Monaco,"Courier New",monospace;white-space:pre-wrap;background-color:rgb(244,249,255)"> </span><span style="font-family:Menlo,Monaco,"Courier New",monospace;white-space:pre-wrap;color:rgb(9,114,157)">is</span><span style="color:rgb(68,75,116);font-family:Menlo,Monaco,"Courier New",monospace;white-space:pre-wrap;background-color:rgb(244,249,255)"> </span><span style="font-family:Menlo,Monaco,"Courier New",monospace;white-space:pre-wrap;color:rgb(9,114,157)">not</span><span style="color:rgb(68,75,116);font-family:Menlo,Monaco,"Courier New",monospace;white-space:pre-wrap;background-color:rgb(244,249,255)"> </span><span style="font-family:Menlo,Monaco,"Courier New",monospace;white-space:pre-wrap;color:rgb(9,114,157)">None</span><span style="font-family:Menlo,Monaco,"Courier New",monospace;white-space:pre-wrap;color:rgb(9,114,157)">:</span></div><div style="color:rgb(68,75,116);background-color:rgb(244,249,255);font-family:Menlo,Monaco,"Courier New",monospace;line-height:18px;white-space:pre-wrap"><div> params<span style="color:rgb(9,114,157)">[</span><span style="color:rgb(9,114,157)">'</span><span style="color:rgb(85,131,17)">port_security_enabled</span><span style="color:rgb(9,114,157)">'</span><span style="color:rgb(9,114,157)">]</span> <span style="color:rgb(9,114,157)">=</span> <span style="font-style:italic">data</span><span style="color:rgb(9,114,157)">[</span><span style="color:rgb(9,114,157)">'</span><span style="color:rgb(85,131,17)">port_security_enabled</span><span style="color:rgb(9,114,157)">'</span><span style="color:rgb(9,114,157)">]</span></div></div><div><br></div><div>This is still True, so we’re setting the param to the data value and using that in our API call to Neutron.</div><div><br></div><div>I’m really not familiar at all with the Horizon code base. So let me know if I’m misunderstanding the intention of the patch you referenced. But I think the idea would be to check our `params` against the actual value returned from neutron.port_get() and only have fields that are changed in our params. So when we call the port_update() here:</div><div><br></div><div>At least in the case we’re discussing here, that resolves the issue. This is just rudimentary hackery to see what works, but this fixes the issue for me (Ignore the LOG line obviously):</div><div><br></div><div><div><font face="Menlo">❯ diff horizon/openstack_dashboard/dashboards/project/networks/ports/workflows.py workflows.py</font></div><div><font face="Menlo">411c411</font></div><div><font face="Menlo">< params = self._construct_parameters(data)</font></div><div><font face="Menlo">---</font></div><div><font face="Menlo">> params = self._construct_parameters(request, data)</font></div><div><font face="Menlo">420c420</font></div><div><font face="Menlo">< def _construct_parameters(self, data):</font></div><div><font face="Menlo">---</font></div><div><font face="Menlo">> def _construct_parameters(self, request, data):</font></div><div><font face="Menlo">424a425,426</font></div><div><font face="Menlo">> LOG.info("bshephar - Data variable = %s", data)</font></div><div><font face="Menlo">> initial = api.neutron.port_get(request, self.context['port_id'])</font></div><div><font face="Menlo">431c433,434</font></div><div><font face="Menlo">< if data['port_security_enabled'] is not None:</font></div><div><font face="Menlo">---</font></div><div><font face="Menlo">> if (data['port_security_enabled'] is not None and data['port_security_enabled']</font></div><div><font face="Menlo">> != initial['port_security_enabled']):</font></div></div><div><br></div><div>The API call after this change looks like this:</div><div><br></div><div><font face="Menlo">2022-09-16 00:17:49,147 31 DEBUG neutronclient.client REQ: b'curl -i<span class="gmail-Apple-converted-space"> </span><a href="https://openstack.bne-home.net:13696/v2.0/ports/4df563ce-5464-4f7d-8aaf-c5496cdaefda" target="_blank">https://openstack.bne-home.net:13696/v2.0/ports/4df563ce-5464-4f7d-8aaf-c5496cdaefda</a><span class="gmail-Apple-converted-space"> </span>-X PUT -H "X-Auth-Token: {SHA256}65efff6982c871ae21a157ab46e4e2bebf69fc8619e8a1512d7ce0dd96b94369" -H "User-Agent: python-neutronclient" -d \'{"port": {"name": "", "admin_state_up": true, "security_groups": ["a3ae6e20-67df-4a72-9d5b-cc21ad87464f"], "binding:vnic_type": "normal"}}\''</font></div><div><br></div><div>And subsequently is accepted by Neutron. So I’m not too sure about the approach within your existing framework. But I mean, I’m happy to propose exactly that as a solution and we can debate it further if you like Radomir?</div><div><br></div><div>Thanks again,</div><div><span class="gmail-im" style="color:rgb(80,0,80)"><br><div>Brendan Shephard<br>Senior Software Engineer<br>Brisbane, Australia<div class="gmail-yj6qo gmail-ajU" style="outline:none;padding:10px 0px;width:22px;margin:2px 0px 0px"></div></div></span></div><br class="gmail-Apple-interchange-newline"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div>
<p style="font-weight:bold;margin:0px;padding:0px;font-size:14px;text-transform:capitalize;font-family:"RedHatText",sans-serif">
<span>Brendan</span> <span>Shephard</span><span style="color:rgb(170,170,170);margin:0px"></span>
</p>
<p style="font-weight:normal;font-size:12px;margin:0px;text-transform:capitalize;font-family:"RedHatText",sans-serif">
<span>Senior Software Engineer</span>
</p>
<p style="font-weight:normal;margin:0px 0px 4px;font-size:12px;font-family:"RedHatText",sans-serif">
<a style="color:rgb(0,136,206);font-size:12px;margin:0px;text-decoration:none;font-family:"RedHatText",sans-serif" href="https://www.redhat.com" target="_blank">Red Hat <span>APAC</span></a>
</p>
<div style="margin-bottom:4px">
<span>
<p style="font-size:12px;margin:0px;font-family:"RedHatText",sans-serif">193 N Quay</p>
</span>
<span>
<p style="font-size:12px;margin:0px;font-family:"RedHatText",sans-serif">Brisbane City QLD 4000</p>
</span>
</div>
<div style="font-weight:normal;font-size:12px;font-family:"RedHatText",sans-serif;margin-bottom:8px">
<div>
<a href="https://twitter.com/redhat" title="twitter" style="background:transparent url("https://marketing-outfit-prod-images.s3-us-west-2.amazonaws.com/3780bd4ede961ef3cd4108b8c0e80186/web-icon-twitter.png") no-repeat scroll 0px 50%/13px auto;text-decoration:none;color:rgb(0,0,0);display:inline-block;line-height:20px;padding-left:13px" target="_blank">
<span style="margin-left:2px">@RedHat</span>
</a>
<a href="https://www.linkedin.com/company/red-hat" title="LinkedIn" style="background:transparent url("https://marketing-outfit-prod-images.s3-us-west-2.amazonaws.com/8d3507e3c6b6c9ad10e301accf1a4af0/web-icon-linkedin.png") no-repeat scroll 0px 50%/12px auto;text-decoration:none;color:rgb(0,0,0);display:inline-block;line-height:20px;padding-left:12px;margin:0px 4px 0px 3px;padding-top:1px" target="_blank">
<span style="margin-left:4px">Red Hat</span>
</a>
<a href="https://www.facebook.com/RedHatInc" title="Facebook" style="background:transparent url("https://marketing-outfit-prod-images.s3-us-west-2.amazonaws.com/220b85e2f100025e94cb1bcd993bd51d/web-icon-facebook.png") no-repeat scroll 0px 50%/11px auto;text-decoration:none;color:rgb(0,0,0);display:inline-block;line-height:20px;padding-left:13px" target="_blank">
<span>Red Hat</span>
</a>
</div>
</div>
<div style="margin-top:12px">
<table border="0">
<tbody><tr>
<td width="100px"><a href="https://red.ht/sig" target="_blank"> <img src="https://static.redhat.com/libs/redhat/brand-assets/latest/corp/logo.png" width="90" height="auto"></a> </td>
<td style="font-weight:normal;font-size:12px">
<div><a href="https://redhat.com/summit" style="text-decoration:none" target="_blank"><img style="outline:currentcolor none 0px" src="https://static.redhat.com/libs/redhat/brand-assets/latest/events/red-hat-summit.png" width="53px" height="auto"></a></div>
</td>
</tr>
</tbody></table>
</div>
</div><span></span></div></div></div></div></div></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Sep 15, 2022 at 11:57 PM Radomir Dopieralski <<a href="mailto:rdopiera@redhat.com">rdopiera@redhat.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">It's a known problem and there is a patch for it in review for quite some time: <a href="https://review.opendev.org/c/openstack/horizon/+/810224" target="_blank">https://review.opendev.org/c/openstack/horizon/+/810224</a></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Sep 15, 2022 at 3:36 PM Brendan Shephard <<a href="mailto:bshephar@redhat.com" target="_blank">bshephar@redhat.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hey all,<div><br></div><div>I think we might be onto something here. With the help of <a class="gmail_plusreply" id="m_-399415530535496849m_-3784280237417560770plusReplyChip-1" href="mailto:smooney@redhat.com" target="_blank">@Sean Mooney</a> ++ and <a class="gmail_plusreply" id="m_-399415530535496849m_-3784280237417560770plusReplyChip-3" href="mailto:tkajinam@redhat.com" target="_blank">@Takashi Kajinami</a> ++. It appears the API request when sent from Horizon contains additional fields that don't require update. But when the request comes from openstackcli, it is just updating the security group field only.</div><div><br></div><div>openstackcli:</div><div><font face="monospace">REQ: curl -g -i --cacert "/Users/shep/.certs/overcloud-cacert.pem" -X PUT <a href="https://openstack.bne-home.net:13696/v2.0/ports/4df563ce-5464-4f7d-8aaf-c5496cdaefda" target="_blank">https://openstack.bne-home.net:13696/v2.0/ports/4df563ce-5464-4f7d-8aaf-c5496cdaefda</a> -H "Content-Type: application/json" -H "User-Agent: openstacksdk/0.100.0 keystoneauth1/5.0.0 python-requests/2.28.1 CPython/3.10.6" -H "X-Auth-Token: {SHA256}3ec8b1d0b17434ec67c2960486ec19f17dfb2884fb47c5b54e1cec2beceb1a87" -d '{"port": {"security_groups": ["a3ae6e20-67df-4a72-9d5b-cc21ad87464f", "a31b9954-b7e6-4d4e-887c-e21a59c052ea"]}}'<br><a href="https://openstack.bne-home.net:13696" target="_blank">https://openstack.bne-home.net:13696</a> "PUT /v2.0/ports/4df563ce-5464-4f7d-8aaf-c5496cdaefda HTTP/1.1" 200 1002</font><br></div><div><br></div><div><br></div><div>Horizon API call to Neutron:</div><div><font face="monospace">2022-09-15 00:02:46,820 33 DEBUG neutronclient.client REQ: b'curl -i <a href="https://openstack.bne-home.net:13696/v2.0/ports/4df563ce-5464-4f7d-8aaf-c5496cdaefda" target="_blank">https://openstack.bne-home.net:13696/v2.0/ports/4df563ce-5464-4f7d-8aaf-c5496cdaefda</a> -X PUT -H "X-Auth-Token: {SHA256}52f077cf0115286c45f1e212cbec4ecdfc56ae41704c869aeb35cea41fdbfde1" -H "User-Agent: python-neutronclient" -d \'{"port": {"name": "", "admin_state_up": true, "port_security_enabled": true, "security_groups": [], "binding:vnic_type": "normal"}}\''</font><br></div><div><br></div><div>So when Neutron receives that request from Horizon, we get blocked because we (as members) are not permitted to update the port_security_enabled field. Even though it's already set to true in this case.</div><div><br></div><div>Given that information, the bug is probably back on Horizon here to not include fields that don't require update.</div><div><br clear="all"><div><div dir="ltr"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div>
<p style="font-weight:bold;margin:0px;padding:0px;font-size:14px;text-transform:capitalize;font-family:RedHatText,sans-serif">
<span>Brendan</span> <span>Shephard</span><span style="color:rgb(170,170,170);margin:0px"></span>
</p>
<p style="font-weight:normal;font-size:12px;margin:0px;text-transform:capitalize;font-family:RedHatText,sans-serif">
<span>Senior Software Engineer</span>
</p>
<p style="font-weight:normal;margin:0px 0px 4px;font-size:12px;font-family:RedHatText,sans-serif">
<a style="color:rgb(0,136,206);font-size:12px;margin:0px;text-decoration:none;font-family:RedHatText,sans-serif" href="https://www.redhat.com" target="_blank">Red Hat <span>APAC</span></a>
</p>
<div style="margin-bottom:4px">
<span>
<p style="font-size:12px;margin:0px;font-family:RedHatText,sans-serif">193 N Quay</p>
</span>
<span>
<p style="font-size:12px;margin:0px;font-family:RedHatText,sans-serif">Brisbane City QLD 4000</p>
</span>
</div>
<div style="font-weight:normal;font-size:12px;font-family:RedHatText,sans-serif;margin-bottom:8px">
<div>
<a href="https://twitter.com/redhat" title="twitter" style="background-image:url("");background-size:13px;background-color:transparent;text-decoration:none;color:rgb(0,0,0);display:inline-block;line-height:20px;padding-left:13px;background-position:0px 50%" target="_blank">
<span style="margin-left:2px">@RedHat</span>
</a>
<a href="https://www.linkedin.com/company/red-hat" title="LinkedIn" style="background-image:url("");background-size:12px;background-color:transparent;text-decoration:none;color:rgb(0,0,0);display:inline-block;line-height:20px;padding-left:12px;margin:0px 4px 0px 3px;padding-top:1px;background-position:0px 50%" target="_blank">
<span style="margin-left:4px">Red Hat</span>
</a>
<a href="https://www.facebook.com/RedHatInc" title="Facebook" style="background-image:url("");background-size:11px;background-color:transparent;text-decoration:none;color:rgb(0,0,0);display:inline-block;line-height:20px;padding-left:13px;background-position:0px 50%" target="_blank">
<span>Red Hat</span>
</a>
</div>
</div>
<div style="margin-top:12px">
<table border="0">
<tbody><tr>
<td width="100px"><a href="https://red.ht/sig" target="_blank"> <img width="90" height="auto"></a> </td>
<td style="font-weight:normal;font-size:12px">
<div><a href="https://redhat.com/summit" style="text-decoration:none" target="_blank"><img style="outline: currentcolor none 0px;" width="53px" height="auto"></a></div>
</td>
</tr>
</tbody></table>
</div>
</div><span></span></div></div></div></div></div></div></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Sep 15, 2022 at 10:46 PM Albert Braden <<a href="mailto:ozzzo@yahoo.com" target="_blank">ozzzo@yahoo.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div> If I add/remove security groups from an instance in Horizon, it works. It's when I add/remove security groups from a port that the error occurs. One way to reproduce is to click on the instance and then go to the "Interfaces" tab, and click "Update Security Groups" on the right.<br> </div> <div style="margin:10px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"> <div style="font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:13px;color:rgb(38,40,42)"> <div> On Thursday, September 15, 2022, 08:21:17 AM EDT, Brendan Shephard <<a href="mailto:bshephar@redhat.com" target="_blank">bshephar@redhat.com</a>> wrote: </div> <div><br></div> <div><br></div> <div><div id="m_-399415530535496849m_-3784280237417560770m_6317905321423339643yiv8046761948"><div><div dir="ltr">Hey,<div><br clear="none"></div><div>I'm doing it from the instances one:</div><div><a shape="rect" href="https://openstack.bne-home.net/dashboard/project/instances/ccb72b14-3694-40fa-9b3b-ec1a8d7ef046/" rel="noreferrer noopener" target="_blank">https://openstack.bne-home.net/dashboard/project/instances/ccb72b14-3694-40fa-9b3b-ec1a8d7ef046/</a><br clear="none"></div><div><br clear="none"></div><div>But for what it's worth. I get the same error if I do it from:</div><div><a shape="rect" href="https://openstack.bne-home.net/dashboard/project/networks/acefae53-b4d5-422f-bcca-dc32a0785d21/detail" rel="noreferrer noopener" target="_blank">https://openstack.bne-home.net/dashboard/project/networks/acefae53-b4d5-422f-bcca-dc32a0785d21/detail</a><br clear="none"></div><div><br clear="none"></div><div>Interesting that it worked for you there. Be good to confirm with <a shape="rect" id="m_-399415530535496849m_-3784280237417560770m_6317905321423339643yiv8046761948plusReplyChip-0" href="mailto:ozzzo@yahoo.com" rel="noreferrer noopener" target="_blank">@ozzzo@yahoo.com</a> as well as to exactly where in Horizon he is trying to modify the security groups. Just so we're all trying to do the exact same thing.</div><div><br clear="none"></div><div>My environment is also deployed from the latest tripleo packages, so I'll also test on that internal lab you referenced Sean. That would be more representative of Alberts issue since he is using RHOSP.</div><div><br clear="all"><div><div dir="ltr"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div> <p style="font-weight:bold;margin:0px;padding:0px;font-size:14px;text-transform:capitalize;font-family:sans-serif"> <span>Brendan</span> <span>Shephard</span><span style="color:rgb(170,170,170);margin:0px"></span> </p> <p style="font-weight:normal;font-size:12px;margin:0px;text-transform:capitalize;font-family:sans-serif"> <span>Senior Software Engineer</span> </p> <p style="font-weight:normal;margin:0px 0px 4px;font-size:12px;font-family:sans-serif"> <a shape="rect" style="color:rgb(0,136,206);font-size:12px;margin:0px;text-decoration:none;font-family:sans-serif" href="https://www.redhat.com" rel="noreferrer noopener" target="_blank">Red Hat <span>APAC</span></a> </p> <div style="margin-bottom:4px"> <span> </span><p style="font-size:12px;margin:0px;font-family:sans-serif">193 N Quay</p> <span> </span><p style="font-size:12px;margin:0px;font-family:sans-serif">Brisbane City QLD 4000</p> </div> <div style="font-weight:normal;font-size:12px;font-family:sans-serif;margin-bottom:8px"> <div> <a shape="rect" href="https://twitter.com/redhat" title="twitter" style="text-decoration:none;color:rgb(0,0,0);display:inline-block;line-height:20px;padding-left:13px" rel="noreferrer noopener" target="_blank"> <span style="margin-left:2px">@RedHat</span> </a> <a shape="rect" href="https://www.linkedin.com/company/red-hat" title="LinkedIn" style="text-decoration:none;color:rgb(0,0,0);display:inline-block;line-height:20px;padding-left:12px;margin:0px 4px 0px 3px;padding-top:1px" rel="noreferrer noopener" target="_blank"> <span style="margin-left:4px">Red Hat</span> </a> <a shape="rect" href="https://www.facebook.com/RedHatInc" title="Facebook" style="text-decoration:none;color:rgb(0,0,0);display:inline-block;line-height:20px;padding-left:13px" rel="noreferrer noopener" target="_blank"> <span>Red Hat</span> </a> </div> </div> <div style="margin-top:12px"> <table border="0"><tbody><tr><td colspan="1" rowspan="1" width="100px"><a shape="rect" href="https://red.ht/sig" rel="noreferrer noopener" target="_blank"> <img width="90" height="auto"></a> </td><td colspan="1" rowspan="1" style="font-weight:normal;font-size:12px"> <div><a shape="rect" href="https://redhat.com/summit" style="text-decoration:none" rel="noreferrer noopener" target="_blank"><img style="outline: currentcolor none 0px;" width="53px" height="auto"></a></div> </td></tr></tbody></table> </div> </div><span></span></div></div></div></div></div></div></div></div></div></div></div><br clear="none"></div></div><br clear="none"><div id="m_-399415530535496849m_-3784280237417560770m_6317905321423339643yiv8046761948yqt22110"><div><div dir="ltr">On Thu, Sep 15, 2022 at 10:12 PM Sean Mooney <<a shape="rect" href="mailto:smooney@redhat.com" rel="noreferrer noopener" target="_blank">smooney@redhat.com</a>> wrote:<br clear="none"></div><blockquote style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">On Thu, 2022-09-15 at 21:33 +1000, Brendan Shephard wrote:<br clear="none">> Hey Sean,<br clear="none">> <br clear="none">> Thanks for the reply.<br clear="none">> <br clear="none">> For reference, I have all the steps to reproduce along with the relevant<br clear="none">> debug logs attached to this LP:<br clear="none">> <a shape="rect" href="https://bugs.launchpad.net/neutron/+bug/1989627" rel="noreferrer noopener" target="_blank">https://bugs.launchpad.net/neutron/+bug/1989627</a><br clear="none">> <br clear="none">> But, to summarize. If I go to any random instance in Horizon as a member<br clear="none">> user - not a admin. Then try to remove any Security Group at all from any<br clear="none">> of the ports it fails with the policy violation (I attached a screenshot of<br clear="none">> where I'm making that change in Horizon). But doing it with the same user<br clear="none">> from the cli works fine. Since I'm editing individual interfaces there,<br clear="none">> rather than the instance itself. I assumed these would all be API calls to<br clear="none">> Neutron from Horizon rather than from Horizon to Nova.<br clear="none">updating the instance securty group will not affect any exsitng ports<br clear="none">when you want to add or remvoe security groups form a port in horizont<br clear="none">you do not do that via the instace secutity group you do it via the port edit dialog<br clear="none">in the port detail view under the network<br clear="none"><br clear="none">https://<your cloud goes here>/dashboard/project/networks/ports/<port uuid>/detail<br clear="none"><br clear="none">i just did that now on a train cloud we have internally and was able to add and remove a security group on a port.<br clear="none"><br clear="none">> <br clear="none">> I just run server list --all to demonstrate I was indeed using a member<br clear="none">> user and not a admin since an admin would have seen VM's from all projects.<br clear="none">> <br clear="none">> I agree with you in principle. It should be exactly the same whether it<br clear="none">> comes from openstackclient or from Horizon. In fact, I was 98% positive I<br clear="none">> would be able to demonstrate the wrong user was being used in this case.<br clear="none">> But unfortunately, my efforts to reproduce it demonstrated that the two are<br clear="none">> indeed handled differently.<br clear="none"><br clear="none">what page in horizon are you editing it form if i try and add/remove the secirty group via the interfaces tabe at<br clear="none">https://<cloud>/dashboard/project/instances/<instance uuid>/<br clear="none">it also work for me inlcuding removing all secuity groups and i am not an admin on this cloud.<br clear="none"><br clear="none">specificly this is the redhat internal shared cloud i was testing on.<br clear="none"><br clear="none">> <br clear="none">> I believe anyone should be able to reproduce it using the steps I outlined<br clear="none">> on the LP.<br clear="none">> <br clear="none">> Brendan Shephard<br clear="none">> <br clear="none">> Senior Software Engineer<br clear="none">> <br clear="none">> Red Hat APAC <<a shape="rect" href="https://www.redhat.com" rel="noreferrer noopener" target="_blank">https://www.redhat.com</a>><br clear="none">> <br clear="none">> 193 N Quay<br clear="none">> <br clear="none">> Brisbane City QLD 4000<br clear="none">> @RedHat <<a shape="rect" href="https://twitter.com/redhat" rel="noreferrer noopener" target="_blank">https://twitter.com/redhat</a>> Red Hat<br clear="none">> <<a shape="rect" href="https://www.linkedin.com/company/red-hat" rel="noreferrer noopener" target="_blank">https://www.linkedin.com/company/red-hat</a>> Red Hat<br clear="none">> <<a shape="rect" href="https://www.facebook.com/RedHatInc" rel="noreferrer noopener" target="_blank">https://www.facebook.com/RedHatInc</a>><br clear="none">> <<a shape="rect" href="https://red.ht/sig" rel="noreferrer noopener" target="_blank">https://red.ht/sig</a>><br clear="none">> <<a shape="rect" href="https://redhat.com/summit" rel="noreferrer noopener" target="_blank">https://redhat.com/summit</a>><br clear="none">> <br clear="none">> <br clear="none">> On Thu, Sep 15, 2022 at 8:48 PM Sean Mooney <<a shape="rect" href="mailto:smooney@redhat.com" rel="noreferrer noopener" target="_blank">smooney@redhat.com</a>> wrote:<br clear="none">> <br clear="none">> > On Thu, 2022-09-15 at 08:59 +1000, Brendan Shephard wrote:<br clear="none">> > > Hey Albert,<br clear="none">> > > <br clear="none">> > > The policy is the default Neutron policy in OpenStack Train. These can<br clear="none">> > indeed be changed and customised, but my assumption is that you haven’t<br clear="none">> > created any custom policies. Horizon uses the default for each service<br clear="none">> > unless it’s been overwritten.<br clear="none">> > policy is defiend server side not client side so it applie equially to all<br clear="none">> > users of the api<br clear="none">> > so the behavior will be the same for horizon or the cli<br clear="none">> > if you ever find a delta because horizon say used a differnt token to make<br clear="none">> > the request that is a securty vulnerablity in horizon and should be<br clear="none">> > reported privatly to the horizon core team :)<br clear="none">> > <br clear="none">> > > <br clear="none">> > > If I create a non-admin user and try to change security groups I also<br clear="none">> > get the same error:<br clear="none">> > > 2022-09-14 22:01:33,370 64 INFO<br clear="none">> > openstack_dashboard.dashboards.project.networks.ports.workflows Failed to<br clear="none">> > update port 4df563ce-5464-4f7d-8aaf-c5496cdaefda: ((rule:update_port and<br clear="none">> > rule:update_port:binding:vnic_type) and<br clear="none">> > rule:update_port:port_security_enabled) is disallowed by policy<br clear="none">> > > <br clear="none">> > > And I can reproduce your same scenario ff I try via the CLI using these<br clear="none">> > steps:<br clear="none">> > > 1. Add entry for new user to clouds.yaml file:<br clear="none">> > > bne-home-test:<br clear="none">> > > auth:<br clear="none">> > > auth_url: <a shape="rect" href="https://openstack.bne-home.net:13000" rel="noreferrer noopener" target="_blank">https://openstack.bne-home.net:13000</a><br clear="none">> > > password: "test"<br clear="none">> > > project_domain_name: Default<br clear="none">> > > project_name: bne-home<br clear="none">> > > user_domain_name: Default<br clear="none">> > > username: test<br clear="none">> > > cacert: ~/.certs/overcloud-cacert.pem<br clear="none">> > > identity_api_version: '3'<br clear="none">> > > region_name: regionOne<br clear="none">> > > volume_api_version: ‘3'<br clear="none">> > > <br clear="none">> > > 2. export OS_CLOUD=bne-home-test<br clear="none">> > > <br clear="none">> > > 3. Try to remove security group from port:<br clear="none">> > > ❯ openstack server show test-lb-net -c security_groups -c addresses -f<br clear="none">> > yaml<br clear="none">> > > addresses:<br clear="none">> > > lb-mgmt-net:<br clear="none">> > > - 172.24.0.90<br clear="none">> > > vlan4-infra:<br clear="none">> > > - 172.20.13.175<br clear="none">> > > security_groups:<br clear="none">> > > - name: management-bne<br clear="none">> > the security group listed in nova is the default security group that will<br clear="none">> > be used by all port create by nova.<br clear="none">> > it only applie to ports created by nova and not ones that are passed in<br clear="none">> > using the uuid of a precreate port.<br clear="none">> > <br clear="none">> > you shoudl in general not mix managing security groups via nova and<br clear="none">> > neutron.<br clear="none">> > horizon shoudl prefer to manage security groups only via neutron if it can.<br clear="none">> > > <br clear="none">> > > ❯ openstack port show 4df563ce-5464-4f7d-8aaf-c5496cdaefda -c fixed_ips<br clear="none">> > -c port_security_enabled -c security_group_ids -f yaml<br clear="none">> > > fixed_ips:<br clear="none">> > > - ip_address: 172.20.13.175<br clear="none">> > > subnet_id: 71aad09a-3e7b-4399-97bf-075f066f6713<br clear="none">> > > port_security_enabled: true<br clear="none">> > > security_group_ids:<br clear="none">> > > - a3ae6e20-67df-4a72-9d5b-cc21ad87464f<br clear="none">> > > <br clear="none">> > > ❯ openstack port unset --security-group<br clear="none">> > a3ae6e20-67df-4a72-9d5b-cc21ad87464f 4df563ce-5464-4f7d-8aaf-c5496cdaefda<br clear="none">> > > ❯ openstack port show 4df563ce-5464-4f7d-8aaf-c5496cdaefda -c fixed_ips<br clear="none">> > -c port_security_enabled -c security_group_ids -f yaml<br clear="none">> > > fixed_ips:<br clear="none">> > > - ip_address: 172.20.13.175<br clear="none">> > > subnet_id: 71aad09a-3e7b-4399-97bf-075f066f6713<br clear="none">> > > port_security_enabled: true<br clear="none">> > > security_group_ids: []<br clear="none">> > > <br clear="none">> > > <br clear="none">> > > Verify that I’m definitely not a admin user:<br clear="none">> > > ❯ openstack server list --all<br clear="none">> > > Policy doesn't allow os_compute_api:servers:detail:get_all_tenants to be<br clear="none">> > performed. (HTTP 403) (Request-ID: req-75c19210-ad91-471f-b500-e1f3482825f8)<br clear="none">> > > <br clear="none">> > > <br clear="none">> > > I don’t think this user should be allowed to do that via the CLI either.<br clear="none">> > So that could be a bug there. The request in the Neutron server.log when I<br clear="none">> > do it via the CLI:<br clear="none">> > > <br clear="none">> > > <br clear="none">> > user can add or remove security groups without being and admin including<br clear="none">> > removing all securtiy groups thats intended behavior and should not require<br clear="none">> > admin.<br clear="none">> > <br clear="none">> > are you implying that horizon is doing "openstack server list --all" --all<br clear="none">> > is short for --all-tenants.<br clear="none">> > outside of the admin tab in horizon horizon would never pass the equivlent<br clear="none">> > of --all to the nova api.<br clear="none">> > > 2022-09-14 22:19:12.987 21 INFO neutron.wsgi [None<br clear="none">> > req-f99c4c15-003c-4f7e-9e41-9100daa2a566 781362d053ee4708a21430d3a825795a<br clear="none">> > 3ff28fc7abf742a6b7a0d016771dee49 - - default default]<br clear="none">> > 192.168.1.17,172.16.2.85 "PUT<br clear="none">> > /v2.0/ports/4df563ce-5464-4f7d-8aaf-c5496cdaefda HTTP/1.1" status: 200<br clear="none">> > len: 1102 time: 0.4449480<br clear="none">> > > <br clear="none">> > > VS Horizon:<br clear="none">> > > 2022-09-14 22:20:23.087 20 INFO neutron.wsgi [None<br clear="none">> > req-4c284690-eb69-43df-b205-4953a88ab87c 781362d053ee4708a21430d3a825795a<br clear="none">> > 3ff28fc7abf742a6b7a0d016771dee49 - - default default]<br clear="none">> > 172.20.10.25,172.16.2.85 "PUT<br clear="none">> > /v2.0/ports/4df563ce-5464-4f7d-8aaf-c5496cdaefda HTTP/1.1" status: 403<br clear="none">> > len: 386 time: 0.2209103<br clear="none">> > > <br clear="none">> > > I have raised a upstream bug for this since I can still reproduce it on<br clear="none">> > the latest version of OpenStack:<br clear="none">> > > <a shape="rect" href="https://bugs.launchpad.net/neutron/+bug/1989627" rel="noreferrer noopener" target="_blank">https://bugs.launchpad.net/neutron/+bug/1989627</a><br clear="none">> > > Bug #1989627 “Policy enforcement variance between openstackcli a...” :<br clear="none">> > Bugs : neutron<br clear="none">> > > <a shape="rect" href="http://bugs.launchpad.net" rel="noreferrer noopener" target="_blank">bugs.launchpad.net</a><br clear="none">> > policy is enfoced on the nova/neutron api it cant behave differntly for<br clear="none">> > horizon unless horizon is useing the wrong token.<br clear="none">> > i.e. not he users token.<br clear="none">> > > <br clear="none">> > > <br clear="none">> > > Brendan Shephard<br clear="none">> > > Senior Software Engineer<br clear="none">> > > Brisbane, Australia<br clear="none">> > > <br clear="none">> > > <br clear="none">> > > <br clear="none">> > > > On 15 Sep 2022, at 2:25 am, Albert Braden <<a shape="rect" href="mailto:ozzzo@yahoo.com" rel="noreferrer noopener" target="_blank">ozzzo@yahoo.com</a>> wrote:<br clear="none">> > > > <br clear="none">> > > > Hi Brendan, thanks for offering to help! I'll contact you privately<br clear="none">> > with info about some languishing cases.<br clear="none">> > > > <br clear="none">> > > > Here's the policy line:<br clear="none">> > > > "update_port:port_security_enabled": "rule:context_is_advsvc or<br clear="none">> > rule:admin_or_network_owner"<br clear="none">> > > > <br clear="none">> > > > Does this policy only affect Horizon? I'm using the same non-admin<br clear="none">> > user for both CLI and Horizon, on a project where that user is a member.<br clear="none">> > The network was created by the admin user.<br clear="none">> > > > On Wednesday, September 14, 2022, 10:41:31 AM EDT, Brendan Shephard <<br clear="none">> > <a shape="rect" href="mailto:bshephar@redhat.com" rel="noreferrer noopener" target="_blank">bshephar@redhat.com</a>> wrote:<br clear="none">> > > > <br clear="none">> > > > <br clear="none">> > > > Hi Albert,<br clear="none">> > > > <br clear="none">> > > > While I may not be the best person to address your Horizon concern. I<br clear="none">> > can probably help you with your Red Hat support concerns. If you had any<br clear="none">> > issues you wanted addressed, or feedback you wanted to provide. Feel free<br clear="none">> > to give me a yell.<br clear="none">> > > > <br clear="none">> > > > Looking at your Horizon issue though. It seems the default policy file<br clear="none">> > is what prevents you from updating that port. We can see the default policy<br clear="none">> > like this for example:<br clear="none">> > > > <br clear="none">> > > > [root@controller-2 ~]# podman exec -it neutron_api<br clear="none">> > oslopolicy-policy-generator --namespace neutron | grep<br clear="none">> > "update_port:port_security_enabled"<br clear="none">> > > > "update_port:port_security_enabled": "rule:context_is_advsvc or<br clear="none">> > rule:admin_or_network_owner"<br clear="none">> > > > <br clear="none">> > > > When you execute the command via the CLI, which user are you using?<br clear="none">> > Are you just sourcing the overcloudrc file, or using export<br clear="none">> > OS_CLOUD=overcloud. If that’s the case then you would be using the admin<br clear="none">> > user on the CLI, but probably a different user when logging into Horizon.<br clear="none">> > > > <br clear="none">> > > > I too would suggest opening a support case. It sounds like you have<br clear="none">> > previously had a negative experience with that. If you want to open a new<br clear="none">> > one and share the case number with me, I can follow up on that for you. As<br clear="none">> > someone who personally knows a lot of the RHOSP Technical Support team from<br clear="none">> > around the world. I’m confident we can right whatever wrong may have<br clear="none">> > occurred there.<br clear="none">> > > > <br clear="none">> > > > Let me know if I can help in any way.<br clear="none">> > > > <br clear="none">> > > > Regards,<br clear="none">> > > > <br clear="none">> > > > Brendan Shephard<br clear="none">> > > > Senior Software Engineer<br clear="none">> > > > Brisbane, Australia<br clear="none">> > > > <br clear="none">> > > > <br clear="none">> > > > <br clear="none">> > > > > On 14 Sep 2022, at 10:36 pm, Albert Braden <<a shape="rect" href="mailto:ozzzo@yahoo.com" rel="noreferrer noopener" target="_blank">ozzzo@yahoo.com</a>> wrote:<br clear="none">> > > > > <br clear="none">> > > > > On CLI I can type "openstack port set --no-security-group <ID>" to<br clear="none">> > remove all security groups. In Horizon, the equivalent operation would be<br clear="none">> > using the - button to remove all groups and then clicking "Update." Using<br clear="none">> > the + button would be the equivalent of typing "openstack port set<br clear="none">> > --security-group <group ID>". There doesn't seem to be a way to remove a<br clear="none">> > single security group via CLI; I think the only way would be to set<br clear="none">> > --no-security-group and then add back the desired groups.<br clear="none">> > > > > <br clear="none">> > > > > I can successfully add security groups to a port via CLI, or I can<br clear="none">> > remove all security groups. If I go into Horizon and try these operations<br clear="none">> > then I get the error when I click "Update." So it appears that security<br clear="none">> > groups can be added and removed, with port security set, via CLI. We only<br clear="none">> > see the failure when we try to do it via Horizon.<br clear="none">> > > > > <br clear="none">> > > > > Regarding RHOSP support; I assume that you are joking, or maybe<br clear="none">> > haven't experienced the support that they offer.<br clear="none">> > > > > On Tuesday, September 13, 2022, 06:30:11 PM EDT, Laurent Dumont <<br clear="none">> > <a shape="rect" href="mailto:laurentfdumont@gmail.com" rel="noreferrer noopener" target="_blank">laurentfdumont@gmail.com</a>> wrote:<br clear="none">> > > > > <br clear="none">> > > > > <br clear="none">> > > > > If you are running RHOSP, you might have a support contract with Red<br clear="none">> > Hat?<br clear="none">> > > > > <br clear="none">> > > > > Are you trying to remove all the security groups from a port that<br clear="none">> > has port_security enabled?<br clear="none">> > > > > <br clear="none">> > > > > On Tue, Sep 13, 2022 at 11:53 AM Albert Braden <<a shape="rect" href="mailto:ozzzo@yahoo.com" rel="noreferrer noopener" target="_blank">ozzzo@yahoo.com</a><br clear="none">> > <mailto:<a shape="rect" href="mailto:ozzzo@yahoo.com" rel="noreferrer noopener" target="_blank">ozzzo@yahoo.com</a>>> wrote:<br clear="none">> > > > > Unfortunately we are running RHOSP in which Train is the latest and<br clear="none">> > greatest. This is what we see in horizon.log:<br clear="none">> > > > > <br clear="none">> > > > > [Tue Sep 13 15:28:15.362703 2022] [wsgi:error] [pid 27:tid<br clear="none">> > 139683266553600] [remote <a shape="rect" href="http://10.232.233.11:57498" rel="noreferrer noopener" target="_blank">10.232.233.11:57498</a> <<a shape="rect" href="http://10.232.233.11:57498/" rel="noreferrer noopener" target="_blank">http://10.232.233.11:57498/</a>>]<br clear="none">> > Failed to update port 08fdbb97-4896-4afb-9390-41481ff27cac:<br clear="none">> > ((rule:update_port and rule:update_port:binding:vnic_type) and<br clear="none">> > rule:update_port:port_security_enabled) is disallowed by policy<br clear="none">> > > > > On Friday, September 9, 2022, 10:59:34 AM EDT, Pierre Riteau <<br clear="none">> > <a shape="rect" href="mailto:pierre@stackhpc.com" rel="noreferrer noopener" target="_blank">pierre@stackhpc.com</a> <mailto:<a shape="rect" href="mailto:pierre@stackhpc.com" rel="noreferrer noopener" target="_blank">pierre@stackhpc.com</a>>> wrote:<br clear="none">> > > > > <br clear="none">> > > > > <br clear="none">> > > > > Hello,<br clear="none">> > > > > <br clear="none">> > > > > This is more likely to be a Horizon bug than an issue with Kolla<br clear="none">> > itself, since Kolla doesn't change much from the default configuration.<br clear="none">> > > > > <br clear="none">> > > > > You should check Horizon logs in /var/log/kolla/horizon to find the<br clear="none">> > error. I would also encourage you to upgrade to a more recent release,<br clear="none">> > since Train has been marked as End of Life in Kolla recently.<br clear="none">> > > > > <br clear="none">> > > > > Cheers,<br clear="none">> > > > > Pierre Riteau (priteau)<br clear="none">> > > > > <br clear="none">> > > > > On Fri, 9 Sept 2022 at 15:41, Albert Braden <<a shape="rect" href="mailto:ozzzo@yahoo.com" rel="noreferrer noopener" target="_blank">ozzzo@yahoo.com</a><br clear="none">> > <mailto:<a shape="rect" href="mailto:ozzzo@yahoo.com" rel="noreferrer noopener" target="_blank">ozzzo@yahoo.com</a>>> wrote:<br clear="none">> > > > > We're running kolla train and we're seeing an apparent bug when we<br clear="none">> > try to add or remove security groups on a port. We see error "Failed to<br clear="none">> > update port <ID>". It works fine in CLI; we only see this in Horizon. Is<br clear="none">> > this a known bug, or are we doing something wrong?<br clear="none">> > > > > <br clear="none">> > > > <br clear="none">> > > <br clear="none">> > > Hey Albert,<br clear="none">> > > <br clear="none">> > > The policy is the default Neutron policy in OpenStack Train. These can<br clear="none">> > indeed be changed and customised, but my assumption is that you haven’t<br clear="none">> > created any custom policies. Horizon uses the default for each service<br clear="none">> > unless it’s been overwritten.<br clear="none">> > > <br clear="none">> > > If I create a non-admin user and try to change security groups I also<br clear="none">> > get the same error:<br clear="none">> > > 2022-09-14 22:01:33,370 64 INFO<br clear="none">> > openstack_dashboard.dashboards.project.networks.ports.workflows Failed to<br clear="none">> > update port 4df563ce-5464-4f7d-8aaf-c5496cdaefda: ((rule:update_port and<br clear="none">> > rule:update_port:binding:vnic_type) and<br clear="none">> > rule:update_port:port_security_enabled) is disallowed by policy<br clear="none">> > > <br clear="none">> > > And I can reproduce your same scenario ff I try via the CLI using these<br clear="none">> > steps:<br clear="none">> > > 1. Add entry for new user to clouds.yaml file:<br clear="none">> > > bne-home-test:<br clear="none">> > > auth:<br clear="none">> > > auth_url: <a shape="rect" href="https://openstack.bne-home.net:13000" rel="noreferrer noopener" target="_blank">https://openstack.bne-home.net:13000</a><br clear="none">> > > password: "test"<br clear="none">> > > project_domain_name: Default<br clear="none">> > > project_name: bne-home<br clear="none">> > > user_domain_name: Default<br clear="none">> > > username: test<br clear="none">> > > cacert: ~/.certs/overcloud-cacert.pem<br clear="none">> > > identity_api_version: '3'<br clear="none">> > > region_name: regionOne<br clear="none">> > > volume_api_version: ‘3'<br clear="none">> > > <br clear="none">> > > 2. export OS_CLOUD=bne-home-test<br clear="none">> > > <br clear="none">> > > 3. Try to remove security group from port:<br clear="none">> > > ❯ openstack server show test-lb-net -c security_groups -c addresses -f<br clear="none">> > yaml<br clear="none">> > > addresses:<br clear="none">> > > lb-mgmt-net:<br clear="none">> > > - 172.24.0.90<br clear="none">> > > vlan4-infra:<br clear="none">> > > - 172.20.13.175<br clear="none">> > > security_groups:<br clear="none">> > > - name: management-bne<br clear="none">> > > <br clear="none">> > > ❯ openstack port show 4df563ce-5464-4f7d-8aaf-c5496cdaefda -c fixed_ips<br clear="none">> > -c port_security_enabled -c security_group_ids -f yaml<br clear="none">> > > fixed_ips:<br clear="none">> > > - ip_address: 172.20.13.175<br clear="none">> > > subnet_id: 71aad09a-3e7b-4399-97bf-075f066f6713<br clear="none">> > > port_security_enabled: true<br clear="none">> > > security_group_ids:<br clear="none">> > > - a3ae6e20-67df-4a72-9d5b-cc21ad87464f<br clear="none">> > > <br clear="none">> > > ❯ openstack port unset --security-group<br clear="none">> > a3ae6e20-67df-4a72-9d5b-cc21ad87464f 4df563ce-5464-4f7d-8aaf-c5496cdaefda<br clear="none">> > > ❯ openstack port show 4df563ce-5464-4f7d-8aaf-c5496cdaefda -c fixed_ips<br clear="none">> > -c port_security_enabled -c security_group_ids -f yaml<br clear="none">> > > fixed_ips:<br clear="none">> > > - ip_address: 172.20.13.175<br clear="none">> > > subnet_id: 71aad09a-3e7b-4399-97bf-075f066f6713<br clear="none">> > > port_security_enabled: true<br clear="none">> > > security_group_ids: []<br clear="none">> > > <br clear="none">> > > <br clear="none">> > > Verify that I’m definitely not a admin user:<br clear="none">> > > ❯ openstack server list --all<br clear="none">> > > Policy doesn't allow os_compute_api:servers:detail:get_all_tenants to be<br clear="none">> > performed. (HTTP 403) (Request-ID: req-75c19210-ad91-471f-b500-e1f3482825f8)<br clear="none">> > > <br clear="none">> > > <br clear="none">> > > I don’t think this user should be allowed to do that via the CLI either.<br clear="none">> > So that could be a bug there. The request in the Neutron server.log when I<br clear="none">> > do it via the CLI:<br clear="none">> > > 2022-09-14 22:19:12.987 21 INFO neutron.wsgi [None<br clear="none">> > req-f99c4c15-003c-4f7e-9e41-9100daa2a566 781362d053ee4708a21430d3a825795a<br clear="none">> > 3ff28fc7abf742a6b7a0d016771dee49 - - default default]<br clear="none">> > 192.168.1.17,172.16.2.85 "PUT<br clear="none">> > /v2.0/ports/4df563ce-5464-4f7d-8aaf-c5496cdaefda HTTP/1.1" status: 200<br clear="none">> > len: 1102 time: 0.4449480<br clear="none">> > > <br clear="none">> > > VS Horizon:<br clear="none">> > > 2022-09-14 22:20:23.087 20 INFO neutron.wsgi [None<br clear="none">> > req-4c284690-eb69-43df-b205-4953a88ab87c 781362d053ee4708a21430d3a825795a<br clear="none">> > 3ff28fc7abf742a6b7a0d016771dee49 - - default default]<br clear="none">> > 172.20.10.25,172.16.2.85 "PUT<br clear="none">> > /v2.0/ports/4df563ce-5464-4f7d-8aaf-c5496cdaefda HTTP/1.1" status: 403<br clear="none">> > len: 386 time: 0.2209103<br clear="none">> > > <br clear="none">> > > I have raised a upstream bug for this since I can still reproduce it on<br clear="none">> > the latest version of OpenStack:<br clear="none">> > > launchpad-og-image.pngBug #1989627 “Policy enforcement variance between<br clear="none">> > openstackcli a...” : Bugs : neutron<br clear="none">> > > <a shape="rect" href="http://bugs.launchpad.net" rel="noreferrer noopener" target="_blank">bugs.launchpad.net</a><br clear="none">> > > <br clear="none">> > > <br clear="none">> > > <br clear="none">> > > Brendan Shephard<br clear="none">> > > Senior Software Engineer<br clear="none">> > > Brisbane, Australia<br clear="none">> > > <br clear="none">> > > <br clear="none">> > > <br clear="none">> > > > On 15 Sep 2022, at 2:25 am, Albert Braden <<a shape="rect" href="mailto:ozzzo@yahoo.com" rel="noreferrer noopener" target="_blank">ozzzo@yahoo.com</a>> wrote:<br clear="none">> > > > <br clear="none">> > > > Hi Brendan, thanks for offering to help! I'll contact you privately<br clear="none">> > with info about some languishing cases.<br clear="none">> > > > <br clear="none">> > > > Here's the policy line:<br clear="none">> > > > "update_port:port_security_enabled": "rule:context_is_advsvc or<br clear="none">> > rule:admin_or_network_owner"<br clear="none">> > > > <br clear="none">> > > > Does this policy only affect Horizon? I'm using the same non-admin<br clear="none">> > user for both CLI and Horizon, on a project where that user is a member.<br clear="none">> > The network was created by the admin user.<br clear="none">> > > > On Wednesday, September 14, 2022, 10:41:31 AM EDT, Brendan Shephard <<br clear="none">> > <a shape="rect" href="mailto:bshephar@redhat.com" rel="noreferrer noopener" target="_blank">bshephar@redhat.com</a>> wrote:<br clear="none">> > > > <br clear="none">> > > > <br clear="none">> > > > Hi Albert,<br clear="none">> > > > <br clear="none">> > > > While I may not be the best person to address your Horizon concern. I<br clear="none">> > can probably help you with your Red Hat support concerns. If you had any<br clear="none">> > issues you wanted addressed, or feedback you wanted to provide. Feel free<br clear="none">> > to give me a yell.<br clear="none">> > > > <br clear="none">> > > > Looking at your Horizon issue though. It seems the default policy file<br clear="none">> > is what prevents you from updating that port. We can see the default policy<br clear="none">> > like this for example:<br clear="none">> > > > <br clear="none">> > > > [root@controller-2 ~]# podman exec -it neutron_api<br clear="none">> > oslopolicy-policy-generator --namespace neutron | grep<br clear="none">> > "update_port:port_security_enabled"<br clear="none">> > > > "update_port:port_security_enabled": "rule:context_is_advsvc or<br clear="none">> > rule:admin_or_network_owner"<br clear="none">> > > > <br clear="none">> > > > When you execute the command via the CLI, which user are you using?<br clear="none">> > Are you just sourcing the overcloudrc file, or using export<br clear="none">> > OS_CLOUD=overcloud. If that’s the case then you would be using the admin<br clear="none">> > user on the CLI, but probably a different user when logging into Horizon.<br clear="none">> > > > <br clear="none">> > > > I too would suggest opening a support case. It sounds like you have<br clear="none">> > previously had a negative experience with that. If you want to open a new<br clear="none">> > one and share the case number with me, I can follow up on that for you. As<br clear="none">> > someone who personally knows a lot of the RHOSP Technical Support team from<br clear="none">> > around the world. I’m confident we can right whatever wrong may have<br clear="none">> > occurred there.<br clear="none">> > > > <br clear="none">> > > > Let me know if I can help in any way.<br clear="none">> > > > <br clear="none">> > > > Regards,<br clear="none">> > > > <br clear="none">> > > > Brendan Shephard<br clear="none">> > > > Senior Software Engineer<br clear="none">> > > > Brisbane, Australia<br clear="none">> > > > <br clear="none">> > > > <br clear="none">> > > > <br clear="none">> > > > > On 14 Sep 2022, at 10:36 pm, Albert Braden <<a shape="rect" href="mailto:ozzzo@yahoo.com" rel="noreferrer noopener" target="_blank">ozzzo@yahoo.com</a>> wrote:<br clear="none">> > > > > <br clear="none">> > > > > On CLI I can type "openstack port set --no-security-group <ID>" to<br clear="none">> > remove all security groups. In Horizon, the equivalent operation would be<br clear="none">> > using the - button to remove all groups and then clicking "Update." Using<br clear="none">> > the + button would be the equivalent of typing "openstack port set<br clear="none">> > --security-group <group ID>". There doesn't seem to be a way to remove a<br clear="none">> > single security group via CLI; I think the only way would be to set<br clear="none">> > --no-security-group and then add back the desired groups.<br clear="none">> > > > > <br clear="none">> > > > > I can successfully add security groups to a port via CLI, or I can<br clear="none">> > remove all security groups. If I go into Horizon and try these operations<br clear="none">> > then I get the error when I click "Update." So it appears that security<br clear="none">> > groups can be added and removed, with port security set, via CLI. We only<br clear="none">> > see the failure when we try to do it via Horizon.<br clear="none">> > > > > <br clear="none">> > > > > Regarding RHOSP support; I assume that you are joking, or maybe<br clear="none">> > haven't experienced the support that they offer.<br clear="none">> > > > > On Tuesday, September 13, 2022, 06:30:11 PM EDT, Laurent Dumont <<br clear="none">> > <a shape="rect" href="mailto:laurentfdumont@gmail.com" rel="noreferrer noopener" target="_blank">laurentfdumont@gmail.com</a>> wrote:<br clear="none">> > > > > <br clear="none">> > > > > <br clear="none">> > > > > If you are running RHOSP, you might have a support contract with Red<br clear="none">> > Hat?<br clear="none">> > > > > <br clear="none">> > > > > Are you trying to remove all the security groups from a port that<br clear="none">> > has port_security enabled?<br clear="none">> > > > > <br clear="none">> > > > > On Tue, Sep 13, 2022 at 11:53 AM Albert Braden <<a shape="rect" href="mailto:ozzzo@yahoo.com" rel="noreferrer noopener" target="_blank">ozzzo@yahoo.com</a>><br clear="none">> > wrote:<br clear="none">> > > > > > Unfortunately we are running RHOSP in which Train is the latest<br clear="none">> > and greatest. This is what we see in horizon.log:<br clear="none">> > > > > > <br clear="none">> > > > > > [Tue Sep 13 15:28:15.362703 2022] [wsgi:error] [pid 27:tid<br clear="none">> > 139683266553600] [remote <a shape="rect" href="http://10.232.233.11:57498" rel="noreferrer noopener" target="_blank">10.232.233.11:57498</a>] Failed to update port<br clear="none">> > 08fdbb97-4896-4afb-9390-41481ff27cac: ((rule:update_port and<br clear="none">> > rule:update_port:binding:vnic_type) and<br clear="none">> > rule:update_port:port_security_enabled) is disallowed by policy<br clear="none">> > > > > > On Friday, September 9, 2022, 10:59:34 AM EDT, Pierre Riteau <<br clear="none">> > <a shape="rect" href="mailto:pierre@stackhpc.com" rel="noreferrer noopener" target="_blank">pierre@stackhpc.com</a>> wrote:<br clear="none">> > > > > > <br clear="none">> > > > > > <br clear="none">> > > > > > Hello,<br clear="none">> > > > > > <br clear="none">> > > > > > This is more likely to be a Horizon bug than an issue with Kolla<br clear="none">> > itself, since Kolla doesn't change much from the default configuration.<br clear="none">> > > > > > <br clear="none">> > > > > > You should check Horizon logs in /var/log/kolla/horizon to find<br clear="none">> > the error. I would also encourage you to upgrade to a more recent release,<br clear="none">> > since Train has been marked as End of Life in Kolla recently.<br clear="none">> > > > > > <br clear="none">> > > > > > Cheers,<br clear="none">> > > > > > Pierre Riteau (priteau)<br clear="none">> > > > > > <br clear="none">> > > > > > On Fri, 9 Sept 2022 at 15:41, Albert Braden <<a shape="rect" href="mailto:ozzzo@yahoo.com" rel="noreferrer noopener" target="_blank">ozzzo@yahoo.com</a>><br clear="none">> > wrote:<br clear="none">> > > > > > > We're running kolla train and we're seeing an apparent bug when<br clear="none">> > we try to add or remove security groups on a port. We see error "Failed to<br clear="none">> > update port <ID>". It works fine in CLI; we only see this in Horizon. Is<br clear="none">> > this a known bug, or are we doing something wrong?<br clear="none">> > > > > > > <br clear="none">> > > > <br clear="none">> > > <br clear="none">> > <br clear="none">> > <br clear="none"><br clear="none"></blockquote></div></div></div></div></div> </div> </div></blockquote></div>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr"><div dir="ltr"><div><div dir="ltr"><div>Radomir Dopieralski</div></div></div></div></div>
</blockquote></div>