Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Invalidated auth may be reused when rescoping to project #243

Open
enolfc opened this issue Aug 17, 2023 · 0 comments
Open

Invalidated auth may be reused when rescoping to project #243

enolfc opened this issue Aug 17, 2023 · 0 comments
Assignees

Comments

@enolfc
Copy link
Contributor

enolfc commented Aug 17, 2023

Short Description of the issue

When multiple VOs have the same project mapped in OpenStack (should this be allowed?) and there is an error between them, it may happen that the rescoping fails as the project_id is not properly reseted on failures

Environment

  • Operating System: Debian 12
  • python version: 3.11.4
  • OpenStack version: n/a

Steps to reproduce

Create a config with 3 VOs: 2 mapped to the same project and one with bad credentials as follows:

site:
  name: FOOBAR

compute:
  shares:
    VO1:
      auth:
        project_id: ABC
      name: VO1

    VO2:
      auth:
        project_id: BAD
      name: VO2

    VO3:
      auth:
        project_id: ABC
      name: VO3

Logs, stack trace, or other symptoms

cloud-info-provider will fail with this traceback:

Traceback (most recent call last):
  File "/usr/local/bin/cloud-info-provider-service", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cloud_info_provider/core.py", line 168, in main
    output = mgr.driver.format(opts, providers, auth_refresher)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cloud_info_provider/formatters/base.py", line 54, in format
    info = available_collectors[tpl].fetch()
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cloud_info_provider/collectors/compute.py", line 62, in fetch
    share.update(self.fetch_share_info(site_info, share, vo))
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cloud_info_provider/collectors/compute.py", line 19, in fetch_share_info
    endpoints = self._get_info_from_providers("get_compute_endpoints", **kwargs)
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cloud_info_provider/collectors/base.py", line 26, in _get_info_from_providers
    result = getattr(i, method)(**provider_kwargs)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cloud_info_provider/providers/openstack.py", line 26, in inner
    return f(self, **kwargs)
           ^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cloud_info_provider/providers/openstack.py", line 166, in get_compute_endpoints
    catalog = self.auth_plugin.get_access(self.session).service_catalog
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/keystoneauth1/identity/base.py", line 131, in get_access
    self.auth_ref = self.get_auth_ref(session)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/keystoneauth1/identity/v3/federation.py", line 70, in get_auth_ref
    auth_ref = token_plugin.get_auth_ref(session)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/keystoneauth1/identity/v3/base.py", line 185, in get_auth_ref
    resp = session.post(token_url, json=body, headers=headers,
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/keystoneauth1/session.py", line 1141, in post
    return self.request(url, 'POST', **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/keystoneauth1/session.py", line 978, in request
    raise exceptions.from_response(resp, method, url)
keystoneauth1.exceptions.http.Unauthorized: The request you have made requires authentication. (HTTP 401) (Request-ID: req-XXXXX)

Summary of proposed changes

Invalidate the project_id after a failure

@enolfc enolfc self-assigned this Aug 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant