yahoo-eng-team team mailing list archive

[Tushar <tushar@xxxxxxxxxxxxxxxx>]

Public bug reported:

When nova net-create and net-delete are prohibited by policy, we should
raise policy violation error (403) to the user instead of service
unavailable (503) error which is incorrect.

Steps to reproduce:
1. Add the following policies to policy.json:
"network:create": "rule:admin_api",
"network:delete": "rule:admin_api"

2. As a non-admin user, run nova net-create:
$ nova net-create xyz 192.168.254.1/30
ERROR: Create networks failed (HTTP 503)

Here's the output of other forbidden commands:
$ nova baremetal-node-list
ERROR: Policy doesn't allow compute_extension:baremetal_nodes to be performed. (HTTP 403)

** Affects: nova
     Importance: Undecided
     Assignee: Tushar (tkay)
         Status: New

** Changed in: nova
     Assignee: (unassigned) => Tushar (tkay)

** Description changed:

  When nova net-create and net-delete are prohibited by policy, we should
  raise policy violation error (403) to the user instead of service
  unavailable (503) error which is incorrect.
  
  Steps to reproduce:
- 1. Add the following policies to policy.json:     
+ 1. Add the following policies to policy.json:
  "network:create": "rule:admin_api",
  "network:delete": "rule:admin_api"
  
  2. As a non-admin user, run nova net-create:
- nova net-create xyz 192.168.254.1/30
- ERROR: Create networks failed (HTTP 503) 
+ $ nova net-create xyz 192.168.254.1/30
+ ERROR: Create networks failed (HTTP 503)
  
  Here's the output of other forbidden commands:
  $ nova baremetal-node-list
  ERROR: Policy doesn't allow compute_extension:baremetal_nodes to be performed. (HTTP 403)

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1260905

Title:
  Return policy error, not generic error if nova net-create/delete is
  forbidden by policy

Status in OpenStack Compute (Nova):
  New

Bug description:
  When nova net-create and net-delete are prohibited by policy, we
  should raise policy violation error (403) to the user instead of
  service unavailable (503) error which is incorrect.

  Steps to reproduce:
  1. Add the following policies to policy.json:
  "network:create": "rule:admin_api",
  "network:delete": "rule:admin_api"

  2. As a non-admin user, run nova net-create:
  $ nova net-create xyz 192.168.254.1/30
  ERROR: Create networks failed (HTTP 503)

  Here's the output of other forbidden commands:
  $ nova baremetal-node-list
  ERROR: Policy doesn't allow compute_extension:baremetal_nodes to be performed. (HTTP 403)

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1260905/+subscriptions