[SRU] Backport Fix barbican client with application credentials/trusts to Ussuri/Victoria

Bug #2035180 reported by David Negreira
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Ubuntu Cloud Archive
Fix Released
Undecided
Unassigned
Antelope
Fix Released
Undecided
Unassigned
Bobcat
Fix Released
Undecided
Unassigned
Ussuri
Triaged
Medium
Unassigned
Victoria
Triaged
Medium
Unassigned
Wallaby
Triaged
Medium
Unassigned
Xena
Fix Released
Undecided
Unassigned
Yoga
Fix Released
Undecided
Unassigned
Zed
Fix Released
Undecided
Unassigned
octavia (Ubuntu)
Fix Released
Undecided
Unassigned
Focal
Incomplete
Medium
David Negreira
Jammy
Fix Released
Undecided
Unassigned

Bug Description

[Impact]

* Users cannot add an HTTPS endpoint with octavia/barbican when using application credentials (it returns http error 500).

[Test Case]

* Full details of commands in comment #10, summary below.
* Add a user in a project
* Add the admin role to the user in the project
* Create application credentials
* Create a barbican certificate store
* Create octavia loadbalancer and listener with the application credentials

[Where problems could occur]

* Users might not be able to create load balancers or attach a listener to a load balancer that has TLS-terminated endpoints.
* This is due to the fact that we are patching the way we retrieve tokens from Barbican.
* Loadbalancers or termination without TLS should not be affected and might be used as a workaround.

[Other Info]

 * Original story: https://storyboard.openstack.org/#!/story/2007619
 * Upstream fix and backports: https://review.opendev.org/q/Id77ce36f59b71d309f153e5c1d44059f162ee440
 * Current upstream fix for octavia/Ussuri: https://review.opendev.org/c/openstack/octavia/+/894548
 * Current upstream fix for octavia/Victoria:https://review.opendev.org/c/openstack/octavia/+/894547

no longer affects: octavia
no longer affects: octavia (Ubuntu)
description: updated
Revision history for this message
Edward Hope-Morley (hopem) wrote :

this is just a placeholder atm until the upstream backports are merged

Revision history for this message
David Negreira (dnegreira) wrote :
Revision history for this message
David Negreira (dnegreira) wrote :
Revision history for this message
David Negreira (dnegreira) wrote :

The upstream fixes have been merged, and this is now ready to be reviewed.

I have attached the following debdiffs:

* lp2035180-octavia-focal.debdiff - Ubuntu Focal
* lp2035180-octavia-bionic-ussuri.debdiff - UCA Bionic-Ussuri
* lp2035180-octavia-focal-victoria.debdiff - UCA Focal-Victoria

Revision history for this message
David Negreira (dnegreira) wrote :
Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "lp2035180-octavia-focal.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

tags: added: patch
Revision history for this message
Mauricio Faria de Oliveira (mfo) wrote :

Duplicating the contents from pastebin for documentation purposes.
Please always use comments/attachments (in case external links break in the future, but this needs to be revisited/reviewed; e.g., when analyzing regressions or related work :)

Revision history for this message
Mauricio Faria de Oliveira (mfo) wrote :
Download full text (14.3 KiB)

(originally in https://pastebin.ubuntu.com/p/458fsc9ffz/ )

ubuntu@dnegreira-bastion:~/stsstack-bundles/openstack$ openstack project list
+----------------------------------+----------+
| ID | Name |
+----------------------------------+----------+
| 424d928b34b640e0a36a8a2e3fdc6f09 | demo |
| 507dbc22af73459b853e3766c35c8b64 | admin |
| cab27753566d42029be264f36ba2b8e4 | admin |
| d212590292cf4a60b445c6d6343ccfbc | services |
| ec0fb8a582714d54aaa71fef843e1dea | alt_demo |
| fe131c6831fc477ea15e27d46c28fe2f | services |
+----------------------------------+----------+
ubuntu@dnegreira-bastion:~/stsstack-bundles/openstack$ openstack domain list
+----------------------------------+----------------+---------+--------------------+
| ID | Name | Enabled | Description |
+----------------------------------+----------------+---------+--------------------+
| 201b2ebc79db4c73bf5e72b548327830 | service_domain | True | Created by Juju |
| 9a9ba9e3fb704f24a45098c605f6b4fb | admin_domain | True | Created by Juju |
| default | Default | True | The default domain |
+-------------------...

description: updated
description: updated
description: updated
Revision history for this message
Mauricio Faria de Oliveira (mfo) wrote :

Hey David,

Thanks for the patches and SRU template, it looks good and to the point.

1) I'd just suggest to add more detail to 'Where problems could occur section'
(e.g., why is that a possible regression, and if there are other cases where
it wouldn't apply, say http only, or if a workaround is available if needed).

Regarding the debdiffs and .patch files -- mostly good too! Just a few points:

2) The version increment in Ubuntu stable releases is almost always '0.1'
(vs. '1' in Ubuntu development releases), see guide in [1].
For the Cloud Archive, the number in the ~cloudX suffix is incremented
(with '1' instead of '0.1' now :) instead of another ubuntuX(.Y) scheme at the end).

3) Some of the changelogs have an extra empty line before the signature.
Ah, and you may set TZ= for dch to pick up your timezone if you want.)
Bug number and patch file name format look good!

4) The git commit/patch format provides most fields (see Standard Fields in DEP3 [2];
e.g., Description/Subject, Origin/Author/From, Bug-Ubuntu), and only 'Origin:' and
'Bug-Ubuntu:' are usually required for Ubuntu SRUs, in addition.

Origin: ideally points to the commit merged upstream (instead of a review/issue/pr),
and has the 'backport' keyword (vs. 'upstream') only if changes were needed for the
patch to apply in the Ubuntu package (instead of whether the upstream commit itself
is a backport of an upstream change introduced in later versions).

Thanks again,
Mauricio

[1] https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Update_the_packaging
[2] https://dep-team.pages.debian.net/deps/dep3/

Changed in octavia (Ubuntu Focal):
status: New → Incomplete
importance: Undecided → Medium
assignee: nobody → David Negreira (dnegreira)
Revision history for this message
Mauricio Faria de Oliveira (mfo) wrote :

Ah, it would be nice to note in Impact and/or Other Info (depending on the level of detail) in which version in Ubuntu the fix is introduced (i.e., so we can mark the devel release task as Fix Released) -- in this case it seems to be Jammy, but having it documented is great! Thanks.

Changed in cloud-archive:
status: New → Fix Released
Changed in octavia (Ubuntu):
status: New → Fix Released
description: updated
description: updated
Revision history for this message
David Negreira (dnegreira) wrote :
Changed in octavia (Ubuntu Jammy):
status: New → Fix Released
Revision history for this message
David Negreira (dnegreira) wrote :
Revision history for this message
David Negreira (dnegreira) wrote :
Revision history for this message
David Negreira (dnegreira) wrote :
Revision history for this message
David Negreira (dnegreira) wrote :

Hi Mauricio,

Thank you for your comments, I have improved the bug description as well as uploaded new debdiffs:

For Ubuntu focal:
* lp2035180-octavia-focal.debdiff

I have also uploaded the debdiffs for UCA:

* lp2035180-octavia-bionic-ussuri.debdiff
* lp2035180-octavia-focal-victoria.debdiff
* lp2035180-octavia-focal-wallaby.debdiff

I have also added the targets with the released Fixes.

PS, the TZ is set to 0000 as that is what I usually work with on my development environments :)

Hope this is good now, any comments appreciated.

tags: added: sts-sru-needed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.