the code which add 'admin' role and is delete in contrail3.0 is below:
if not self._pipe_start_app:
self._pipe_start_app = bottle.app()
# When the multi tenancy is disable, add 'admin' role into the
# header for all requests to see all resources
@self._pipe_start_app.hook('before_request')
@bottle.hook('before_request')
def set_admin_role(*args, **kwargs):
if bottle.request.app != self._pipe_start_app:
return
bottle.request.environ['HTTP_X_ROLE'] = 'admin'
[email protected]
From: [email protected]
Date: 2016-08-29 14:26
To: dev
Subject: [opencontrail-dev] permission about __no_rule__ security (contrail3.0
+ openstack M)
hi,all
My env is contrail3.0 + openstack M
I encounter an issue which is similar to
https://bugs.launchpad.net/opencontrail/+bug/1590790
when I remove all the security groups of a VM.
If this is not the first time, in another hand, when I remove security
groups if the __no_rule__ security is already exist,the operation would be
failed and raise RefsExistError
this is because,the request without admin role there is no permission to
read __no_rule__ security, and then attempt to create it which already exist.
In fact, the tenant has the admin role.
the contrail2.20 there is no the issue,so I check the code I found this is
because we disable auth=keystone in contrail-api.conf and 'HTTP_X_ROLE'
Deprecated in Mitaka of openstack.
disable auth=keystone,in contrail2.20 would add 'admin' role into the
header for all requests to see all resources (those code is delete in
contrail3.0)
enable auth=keystone,while auth_middleware.get_admin_token() raise
AttributeError: 'AuthProtocol' object has no attribute 'get_admin_token'
So,
1. how can I fix the issue while diable auth in contrail-api.conf ?
2. if enable auth=keystone, how to integrate with Mitaka ?
any help would be appreciated
Keyang Li
[email protected]
_______________________________________________
Dev mailing list
[email protected]
http://lists.opencontrail.org/mailman/listinfo/dev_lists.opencontrail.org
