yahoo-eng-team team mailing list archive

[Thierry Carrez <thierry.carrez+lp@xxxxxxxxx>]

** Changed in: nova
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1260905

Title:
  Return policy error, not generic error if nova net-create/delete is
  forbidden by policy

Status in OpenStack Compute (Nova):
  Fix Released

Bug description:
  When nova net-create and net-delete are prohibited by policy, we
  should raise policy violation error (403) to the user instead of
  service unavailable (503) error which is incorrect.

  Steps to reproduce:
  1. Add the following policies to policy.json:
  "network:create": "rule:admin_api",
  "network:delete": "rule:admin_api"

  2. As a non-admin user, run nova net-create:
  $ nova net-create xyz 192.168.254.1/30
  ERROR: Create networks failed (HTTP 503)

  Here's the output of other forbidden commands:
  $ nova baremetal-node-list
  ERROR: Policy doesn't allow compute_extension:baremetal_nodes to be performed. (HTTP 403)

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1260905/+subscriptions