openstack/senlin
Code Issues Proposed changes

Fix: TrustMiddleware unable to fetch trusts/credentials from identity service

Browse Source 
When using token to init a new openstacksdk connection, the SDK try to fetch
another token from it, causing keystone raise exception and return 500 status
response. Refer: https://bugs.launchpad.net/keystone/+bug/1959674
Switch from `token` to `admin_token` to make the SDK session use the provided
token directly instead of fetching a new one.

Closes-bug: #2048452
Depends-On: https://review.opendev.org/c/openstack/senlin/+/905555
Change-Id: I8f9b2db3d4851cf54c2113b2fb0ae97ae38ac286
This commit is contained in:
Pham Le Gia Dai 2024-01-08 16:32:49 +07:00
parent 29f2e885e7
commit a39f7e02ce
21 changed files with 160 additions and 62 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
releasenotes/notes/bug-2048452-8a690353815601a0.yaml Normal file
View File

@ -0,0 +1,9 @@
---
fixes:
- |
[`bug 2048452 <https://bugs.launchpad.net/senlin/+bug/2048452>`_]
Fixed a bug where `TrustMiddleware` unable to fetch trusts/credentials
from Identity service, may be related to:
https://bugs.launchpad.net/keystone/+bug/1959674
This bug is fixed by using `admin_token` instead of `token` auth method
to fetch trusts/credentials from Identity service.

1
senlin/api/middleware/trust.py
View File

@ -44,7 +44,6 @@ class TrustMiddleware(wsgi.Middleware):
params = {
'auth_url': ctx.auth_url,
'token': ctx.auth_token,
'project_id': ctx.project_id,
'user_id': ctx.user_id,
}
kc = driver_base.SenlinDriver().identity(params)

2
senlin/drivers/os/cinder_v2.py
View File

@ -19,7 +19,7 @@ class CinderClient(base.DriverBase):
def __init__(self, params):
super(CinderClient, self).__init__(params)
self.conn = sdk.create_connection(params)
self.conn = sdk.create_connection(params, service_type='block-storage')
self.session = self.conn.session
@sdk.translate_exception

2
senlin/drivers/os/glance_v2.py
View File

@ -19,7 +19,7 @@ class GlanceClient(base.DriverBase):
def __init__(self, params):
super(GlanceClient, self).__init__(params)
self.conn = sdk.create_connection(params)
self.conn = sdk.create_connection(params, service_type='image')
self.session = self.conn.session
@sdk.translate_exception

2
senlin/drivers/os/heat_v1.py
View File

@ -21,7 +21,7 @@ class HeatClient(base.DriverBase):
def __init__(self, params):
super(HeatClient, self).__init__(params)
self.conn = sdk.create_connection(params)
self.conn = sdk.create_connection(params, service_type='orchestration')
@sdk.translate_exception
def stack_create(self, **params):

2
senlin/drivers/os/mistral_v2.py
View File

@ -21,7 +21,7 @@ class MistralClient(base.DriverBase):
def __init__(self, params):
super(MistralClient, self).__init__(params)
self.conn = sdk.create_connection(params)
self.conn = sdk.create_connection(params, service_type='workflow')
self.session = self.conn.session
@sdk.translate_exception

2
senlin/drivers/os/neutron_v2.py
View File

@ -21,7 +21,7 @@ class NeutronClient(base.DriverBase):
def __init__(self, params):
super(NeutronClient, self).__init__(params)
self.conn = sdk.create_connection(params)
self.conn = sdk.create_connection(params, service_type='network')
@sdk.translate_exception
def network_get(self, name_or_id, ignore_missing=False):

2
senlin/drivers/os/nova_v2.py
View File

@ -26,7 +26,7 @@ class NovaClient(base.DriverBase):
def __init__(self, params):
super(NovaClient, self).__init__(params)
self.conn = sdk.create_connection(params)
self.conn = sdk.create_connection(params, service_type='compute')
self.session = self.conn.session
@sdk.translate_exception

2
senlin/drivers/os/octavia_v2.py
View File

@ -19,7 +19,7 @@ class OctaviaClient(base.DriverBase):
def __init__(self, params):
super(OctaviaClient, self).__init__(params)
self.conn = sdk.create_connection(params)
self.conn = sdk.create_connection(params, service_type='load-balancer')
@sdk.translate_exception
def loadbalancer_get(self, name_or_id, ignore_missing=False,

2
senlin/drivers/os/zaqar_v2.py
View File

@ -21,7 +21,7 @@ class ZaqarClient(base.DriverBase):
def __init__(self, params):
super(ZaqarClient, self).__init__(params)
self.conn = sdk.create_connection(params)
self.conn = sdk.create_connection(params, service_type='messaging')
self.session = self.conn.session
@sdk.translate_exception

72
senlin/drivers/sdk.py
View File

@ -17,13 +17,13 @@ import sys
import functools
import openstack
from openstack import connection
from openstack import exceptions as sdk_exc
from oslo_config import cfg
from oslo_log import log as logging
from oslo_serialization import jsonutils
from requests import exceptions as req_exc
from senlin.common import context
from senlin.common import exception as senlin_exc
from senlin import version
@ -106,34 +106,61 @@ def translate_exception(func):
return invoke_with_catch
def create_connection(params=None):
if params is None:
params = {}
if 'token' in params:
params['auth_type'] = 'token'
params['app_name'] = USER_AGENT
params['app_version'] = version.version_info.version_string()
def create_connection(params=None, service_type='identity'):
"""Create a connection to SDK service client."""
params = params or {}
params.setdefault('region_name', cfg.CONF.default_region_name)
params.setdefault('identity_api_version', '3')
params.setdefault('messaging_api_version', '2')
if 'token' in params:
# NOTE(daiplg): If existing token is provided, use admin_token plugin
# to authenticate to avoid fetching service catalog or determining
# scope info because of:
# https://bugs.launchpad.net/keystone/+bug/1959674
# Refer: keystoneauth1.loading._plugins.admin_token.AdminToken
params['auth_type'] = 'admin_token'
if 'endpoint' not in params:
# NOTE(daiplg): Because there is no service catalog the endpoint
# that is supplied with initialization is used for all operations
# performed with this plugin so must be the full base URL to
# an actual service.
service_credentials = context.get_service_credentials() or {}
admin_connection = _create_connection(service_credentials)
region_name = params['region_name']
interface = service_credentials.get('interface', 'public')
temp_adapter = admin_connection.config.get_session_client(
service_type=service_type,
region_name=region_name,
allow_version_hack=True,
)
params['endpoint'] = temp_adapter.get_endpoint(
region_name=region_name,
interface=interface
)
return _create_connection(params)
def _create_connection(params=None):
"""Create a connection to SDK service client."""
params = params or {}
try:
conn = connection.Connection(**params)
connection = openstack.connect(
load_envvars=False,
load_yaml_config=False,
insecure=not cfg.CONF.authentication.verify_ssl,
cafile=cfg.CONF.authentication.cafile,
cert=cfg.CONF.authentication.certfile,
key=cfg.CONF.authentication.keyfile,
app_name=USER_AGENT,
app_version=version.version_info.version_string(),
**params,
)
except Exception as ex:
raise parse_exception(ex)
if cfg.CONF.authentication.certfile and \
cfg.CONF.authentication.keyfile:
conn.session.cert = (cfg.CONF.authentication.certfile,
cfg.CONF.authentication.keyfile)
if cfg.CONF.authentication.verify_ssl:
if cfg.CONF.authentication.cafile:
conn.session.verify = cfg.CONF.authentication.cafile
else:
conn.session.verify = cfg.CONF.authentication.verify_ssl
return conn
return connection
def authenticate(**kwargs):
@ -151,6 +178,7 @@ def authenticate(**kwargs):
class FakeResourceObject(object):
"""Generate a fake SDK resource object based on given dictionary"""
def __init__(self, params):
for key in params:
setattr(self, key, params[key])

4
senlin/tests/unit/api/middleware/test_trust.py
View File

@ -85,7 +85,6 @@ class TestTrustMiddleware(base.SenlinTestCase):
mock_driver.assert_called_once_with()
x_driver.identity.assert_called_once_with({
'auth_url': self.context.auth_url,
'project_id': self.context.project_id,
'user_id': self.context.user_id,
'token': self.context.auth_token,
})
@ -123,7 +122,6 @@ class TestTrustMiddleware(base.SenlinTestCase):
mock_driver.assert_called_once_with()
x_driver.identity.assert_called_once_with({
'auth_url': self.context.auth_url,
'project_id': self.context.project_id,
'user_id': self.context.user_id,
'token': self.context.auth_token,
})
@ -162,7 +160,6 @@ class TestTrustMiddleware(base.SenlinTestCase):
mock_driver.assert_called_once_with()
x_driver.identity.assert_called_once_with({
'auth_url': self.context.auth_url,
'project_id': self.context.project_id,
'user_id': self.context.user_id,
'token': self.context.auth_token,
})
@ -205,7 +202,6 @@ class TestTrustMiddleware(base.SenlinTestCase):
mock_driver.assert_called_once_with()
x_driver.identity.assert_called_once_with({
'auth_url': self.context.auth_url,
'project_id': self.context.project_id,
'user_id': self.context.user_id,
'token': self.context.auth_token,
})

3
senlin/tests/unit/drivers/test_cinder_v2.py
View File

@ -32,7 +32,8 @@ class TestCinderV2(base.SenlinTestCase):
self.vo = cinder_v2.CinderClient(self.conn_params)
def test_init(self):
self.mock_create.assert_called_once_with(self.conn_params)
self.mock_create.assert_called_once_with(self.conn_params,
service_type='block-storage')
self.assertEqual(self.mock_conn, self.vo.conn)
def test_volume_get(self):

3
senlin/tests/unit/drivers/test_glance_v2.py
View File

@ -35,7 +35,8 @@ class TestGlanceV2(base.SenlinTestCase):
gc = glance_v2.GlanceClient(self.conn_params)
self.assertEqual(self.fake_conn, gc.conn)
mock_create.assert_called_once_with(self.conn_params)
mock_create.assert_called_once_with(self.conn_params,
service_type='image')
def test_image_find(self, mock_create):
mock_create.return_value = self.fake_conn

3
senlin/tests/unit/drivers/test_heat_v1.py
View File

@ -34,7 +34,8 @@ class TestHeatV1(base.SenlinTestCase):
self.hc = heat_v1.HeatClient(self.conn_params)
def test_init(self):
self.mock_create.assert_called_once_with(self.conn_params)
self.mock_create.assert_called_once_with(self.conn_params,
service_type='orchestration')
self.assertEqual(self.mock_conn, self.hc.conn)
def test_stack_create(self):

3
senlin/tests/unit/drivers/test_mistral_v2.py
View File

@ -34,7 +34,8 @@ class TestMistralV2(base.SenlinTestCase):
def test_init(self):
d = mistral_v2.MistralClient(self.conn_params)
self.mock_create.assert_called_once_with(self.conn_params)
self.mock_create.assert_called_once_with(self.conn_params,
service_type='workflow')
self.assertEqual(self.mock_conn, d.conn)
def test_workflow_find(self):

3
senlin/tests/unit/drivers/test_neutron_v2.py
View File

@ -35,7 +35,8 @@ class TestNeutronV2Driver(base.SenlinTestCase):
def test_init(self, mock_create_connection):
params = self.conn_params
neutron_v2.NeutronClient(params)
mock_create_connection.assert_called_once_with(params)
mock_create_connection.assert_called_once_with(params,
service_type='network')
def test_network_get_with_uuid(self):
net_id = uuidutils.generate_uuid()

3
senlin/tests/unit/drivers/test_nova_v2.py
View File

@ -37,7 +37,8 @@ class TestNovaV2(base.SenlinTestCase):
def test_init(self):
d = nova_v2.NovaClient(self.conn_params)
self.mock_create.assert_called_once_with(self.conn_params)
self.mock_create.assert_called_once_with(self.conn_params,
service_type='compute')
self.assertEqual(self.mock_conn, d.conn)
def test_flavor_find(self):

4
senlin/tests/unit/drivers/test_octavia_v2.py
View File

@ -33,7 +33,9 @@ class TestOctaviaV2Driver(base.SenlinTestCase):
def test_init(self, mock_create_connection):
params = self.conn_params
octavia_v2.OctaviaClient(params)
mock_create_connection.assert_called_once_with(params)
mock_create_connection.assert_called_once_with(
params,
service_type='load-balancer')
def test_loadbalancer_get(self):
lb_id = 'loadbalancer_identifier'

95
senlin/tests/unit/drivers/test_sdk.py
View File

@ -13,7 +13,7 @@
import types
from unittest import mock
from openstack import connection
import openstack
from oslo_serialization import jsonutils
from requests import exceptions as req_exc
@ -127,7 +127,6 @@ class OpenStackSDKTest(base.SenlinTestCase):
self.assertEqual('Unknown Error', str(ex))
def test_translate_exception_wrapper(self):
@sdk.translate_exception
def test_func(driver):
return driver.__name__
@ -136,10 +135,9 @@ class OpenStackSDKTest(base.SenlinTestCase):
self.assertEqual(types.FunctionType, type(res))
def test_translate_exception_with_exception(self):
@sdk.translate_exception
def test_func(driver):
raise(Exception('test exception'))
raise (Exception('test exception'))
error = senlin_exc.InternalError(code=500, message='BOOM')
self.patchobject(sdk, 'parse_exception', side_effect=error)
@ -149,24 +147,62 @@ class OpenStackSDKTest(base.SenlinTestCase):
self.assertEqual(500, ex.code)
self.assertEqual('BOOM', ex.message)
@mock.patch.object(connection, 'Connection')
@mock.patch.object(openstack, 'connect')
def test_create_connection_token(self, mock_conn):
x_conn = mock.Mock()
mock_session_client = mock.Mock()
x_conn.config.get_session_client.return_value = mock_session_client
mock_conn.return_value = x_conn
mock_session_client.get_endpoint.return_value = 'https://FAKE_URL'
res = sdk.create_connection({'token': 'TOKEN', 'foo': 'bar'})
self.assertEqual(x_conn, res)
mock_conn.assert_called_once_with(
app_name=sdk.USER_AGENT, app_version=self.app_version,
identity_api_version='3',
messaging_api_version='2',
region_name=None,
auth_type='token',
token='TOKEN',
foo='bar')
calls = [
mock.call(
load_envvars=False,
load_yaml_config=False,
insecure=False,
cafile=None,
cert=None,
key=None,
app_name=sdk.USER_AGENT,
app_version=self.app_version,
auth_url='',
username='senlin',
password='',
project_name='service',
user_domain_name='Default',
project_domain_name='Default',
verify=True,
interface='public'
),
mock.call().config.get_session_client(
service_type='identity',
region_name=None,
allow_version_hack=True
),
mock.call().config.get_session_client().get_endpoint(
region_name=None, interface='public'),
mock.call(load_envvars=False,
load_yaml_config=False,
insecure=False,
cafile=None,
cert=None,
key=None,
app_name=sdk.USER_AGENT,
app_version=self.app_version,
token='TOKEN',
foo='bar',
region_name=None,
identity_api_version='3',
messaging_api_version='2',
auth_type='admin_token',
endpoint='https://FAKE_URL'),
]
mock_conn.assert_has_calls(calls)
@mock.patch.object(connection, 'Connection')
@mock.patch.object(openstack, 'connect')
def test_create_connection_password(self, mock_conn):
x_conn = mock.Mock()
mock_conn.return_value = x_conn
@ -176,7 +212,14 @@ class OpenStackSDKTest(base.SenlinTestCase):
self.assertEqual(x_conn, res)
mock_conn.assert_called_once_with(
app_name=sdk.USER_AGENT, app_version=self.app_version,
load_envvars=False,
load_yaml_config=False,
insecure=False,
cafile=None,
cert=None,
key=None,
app_name=sdk.USER_AGENT,
app_version=self.app_version,
identity_api_version='3',
messaging_api_version='2',
region_name=None,
@ -184,7 +227,7 @@ class OpenStackSDKTest(base.SenlinTestCase):
password='abc',
foo='bar')
@mock.patch.object(connection, 'Connection')
@mock.patch.object(openstack, 'connect')
def test_create_connection_with_region(self, mock_conn):
x_conn = mock.Mock()
mock_conn.return_value = x_conn
@ -193,12 +236,19 @@ class OpenStackSDKTest(base.SenlinTestCase):
self.assertEqual(x_conn, res)
mock_conn.assert_called_once_with(
app_name=sdk.USER_AGENT, app_version=self.app_version,
load_envvars=False,
load_yaml_config=False,
insecure=False,
cafile=None,
cert=None,
key=None,
app_name=sdk.USER_AGENT,
app_version=self.app_version,
identity_api_version='3',
messaging_api_version='2',
region_name='REGION_ONE')
@mock.patch.object(connection, 'Connection')
@mock.patch.object(openstack, 'connect')
@mock.patch.object(sdk, 'parse_exception')
def test_create_connection_with_exception(self, mock_parse, mock_conn):
ex_raw = Exception('Whatever')
@ -210,7 +260,14 @@ class OpenStackSDKTest(base.SenlinTestCase):
sdk.create_connection)
mock_conn.assert_called_once_with(
app_name=sdk.USER_AGENT, app_version=self.app_version,
load_envvars=False,
load_yaml_config=False,
insecure=False,
cafile=None,
cert=None,
key=None,
app_name=sdk.USER_AGENT,
app_version=self.app_version,
identity_api_version='3',
messaging_api_version='2',
region_name=None)

3
senlin/tests/unit/drivers/test_zaqar_v2.py
View File

@ -35,7 +35,8 @@ class TestZaqarV2(base.SenlinTestCase):
def test_init(self):
zc = zaqar_v2.ZaqarClient(self.conn_params)
self.mock_create.assert_called_once_with(self.conn_params)
self.mock_create.assert_called_once_with(self.conn_params,
service_type='messaging')
self.assertEqual(self.mock_conn, zc.conn)
def test_queue_create(self):