juju bug (?) when allocating floating ips to machines

[Heather Lanigan]

Hi Patrizio,

Judging by the code in develop, we do not check the tenant_id when choosing
a FIP.  There is an attempt to ensure the FIP is in the provided external
network, if specified.  So that may be another work around.

Please file a bug.  I'm wondering if there are more places the provider
should be checking the tenant as well.

-Heather



On Thu, Jul 27, 2017 at 9:04 AM, Patrizio Bassi <patrizio.bassi at gmail.com>
wrote:

> Hi all
>
> i'm using juju 2.1.2.1 (i didn't upgrade to 2.2 yet, that's why i didn't
> open a bug on launchpad) with openstack as cloud provider.
>
> When i use as credentials an Admin user (but a specific tenant) i have
> issues with floating ip assignment: the admin user can see all the floating
> ips in the openstack region.
> So, if another tenant allocates an IP without assigning to a VM (so,
> unused) juju tries to use it and attach to the VM it just deployed.
>
> i.e.
>
> user test1 is Admin and has primary project "tenant-one"
> user test2 is member of project "tenant-two"
>
> credentials given to juju are test1, test1_password, tenant-one and
> RegionOne.
>
> # source novarc_test1
>
> # neutron floatingip-list
> +--------------------------------------+------------------+-
> --------------------+--------------------------------------+
> | id                                   | fixed_ip_address |
> floating_ip_address | port_id                              |
> +--------------------------------------+------------------+-
> --------------------+--------------------------------------+
> | 03d1a8e8-fd55-4d6e-ab7e-b62061ea6206 | 192.168.0.10     | 10.1.2.19
>     | b6ac7caf-0c6e-4d81-b055-ecb8b4bdeebd |
> | 2b4e48ba-aad6-4d78-aff6-88b912f89bf5 | 192.168.0.20     | 10.1.2.9
>      | 17f69b3b-97d0-4cec-8208-e4d2ac2f1034 |
> | 3144b683-2cf5-43cf-bddd-b06cb5662430 |                  | 10.1.2.22
>     |                                      |
> | 55145d85-58ea-4f15-8a0c-96a719c0fa8d | 192.168.0.22     | 10.1.2.4
>      | 6eeaa12b-0971-496c-bd38-89e9b9d71818 |
> +--------------------------------------+------------------+-
> --------------------+--------------------------------------+
>
> the third line shows and ip address assigned to tenant-two by test2.
>
> User test1 has admin role so he has permission to see the ip.
> Using a command like "neutron floatingip-show
> 3144b683-2cf5-43cf-bddd-b06cb5662430" correctly shows the project_id uuid
> related to tenant-two and not tenant-one.
>
> juju model is configured with
> use-default-secgroup          model       true
> use-floating-ip               model       true
>
> When trying to deploy any application juju spawns a VM, but it never ends
> and logs:
>
> Unable to associate floating IP 10.1.2.22 to fixed IP 192.168.0.9 for
> instance 3d95283c-69f2-4cf1-8980-99462a5904a2.
>
> Removing the unused floating ip address or using a member-only (not admin
> user) bypass the problem: juju will allocate a new ip and associate with
> the new VM.
>
> I didn't try but i do think that if an user is member of two different
> tenants it may try to mis-use the addresses and mess with them, failing to
> deploy.
>
> Desiderata: juju should check if the allocated ip address is in the same
> tenant view of the given credentials.
>
> Regards
>
> Patrizio
>
> --
> Juju mailing list
> Juju at lists.ubuntu.com
> Modify settings or unsubscribe at: https://lists.ubuntu.com/
> mailman/listinfo/juju
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/juju/attachments/20170727/3df636a5/attachment.html>