Hi all i'm using juju 2.1.2.1 (i didn't upgrade to 2.2 yet, that's why i didn't open a bug on launchpad) with openstack as cloud provider.
When i use as credentials an Admin user (but a specific tenant) i have issues with floating ip assignment: the admin user can see all the floating ips in the openstack region. So, if another tenant allocates an IP without assigning to a VM (so, unused) juju tries to use it and attach to the VM it just deployed. i.e. user test1 is Admin and has primary project "tenant-one" user test2 is member of project "tenant-two" credentials given to juju are test1, test1_password, tenant-one and RegionOne. # source novarc_test1 # neutron floatingip-list +--------------------------------------+------------------+- --------------------+--------------------------------------+ | id | fixed_ip_address | floating_ip_address | port_id | +--------------------------------------+------------------+- --------------------+--------------------------------------+ | 03d1a8e8-fd55-4d6e-ab7e-b62061ea6206 | 192.168.0.10 | 10.1.2.19 | b6ac7caf-0c6e-4d81-b055-ecb8b4bdeebd | | 2b4e48ba-aad6-4d78-aff6-88b912f89bf5 | 192.168.0.20 | 10.1.2.9 | 17f69b3b-97d0-4cec-8208-e4d2ac2f1034 | | 3144b683-2cf5-43cf-bddd-b06cb5662430 | | 10.1.2.22 | | | 55145d85-58ea-4f15-8a0c-96a719c0fa8d | 192.168.0.22 | 10.1.2.4 | 6eeaa12b-0971-496c-bd38-89e9b9d71818 | +--------------------------------------+------------------+- --------------------+--------------------------------------+ the third line shows and ip address assigned to tenant-two by test2. User test1 has admin role so he has permission to see the ip. Using a command like "neutron floatingip-show 3144b683-2cf5-43cf-bddd-b06cb5662430" correctly shows the project_id uuid related to tenant-two and not tenant-one. juju model is configured with use-default-secgroup model true use-floating-ip model true When trying to deploy any application juju spawns a VM, but it never ends and logs: Unable to associate floating IP 10.1.2.22 to fixed IP 192.168.0.9 for instance 3d95283c-69f2-4cf1-8980-99462a5904a2. Removing the unused floating ip address or using a member-only (not admin user) bypass the problem: juju will allocate a new ip and associate with the new VM. I didn't try but i do think that if an user is member of two different tenants it may try to mis-use the addresses and mess with them, failing to deploy. Desiderata: juju should check if the allocated ip address is in the same tenant view of the given credentials. Regards Patrizio
-- Juju mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/juju
