Ironic-Horizon : Unable to retrieve Ironic drivers

Bug #2089029 reported by Sylvère K
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Ironic UI
Triaged
High
Unassigned

Bug Description

When trying to enroll a node in Ironic through the Horizon webGUI, the following error is displayed :

```
Error: Unable to retrieve Ironic drivers: "baremetal:driver:get": "(role:reader and system_scope:all) or (role:service and system_scope:all) or rule:service_role" requires a scope of ['system'], request was made with project scope. (HTTP 500)
```

This could be linked to this Kayobe bug : https://bugs.launchpad.net/kayobe/+bug/2089027

Logs returned with `grep ERROR /var/log/kolla/ironic/*`

```
ironic-api-wsgi.log:2024-11-20 08:46:24.077 26 ERROR ironic.common.policy [None req-1de4b076-ea16-485a-b0d5-c20a4fb591c2 8ab947ddddc94f99bde35966694a620d 7842595dd2334224a80059649f8adc47 - - default default] Rejecting authorization: baremetal:node:list_all is disallowed by policy: oslo_policy.policy.PolicyNotAuthorized: baremetal:node:list_all is disallowed by policy
ironic-api-wsgi.log:2024-11-20 08:46:25.659 27 ERROR ironic.api.method [None req-581e7d99-87ba-41af-9978-82b21cf30574 8ab947ddddc94f99bde35966694a620d 7842595dd2334224a80059649f8adc47 - - default default] Server-side error: ""baremetal:driver:get": "(role:reader and system_scope:all) or (role:service and system_scope:all) or rule:service_role" requires a scope of ['system'], request was made with project scope.". Detail:
```

Revision history for this message
Afonne-CID (cidelight) wrote :

A server error for a scope related error is something. Could you provide more details; Ironic version, full log, etc.

Changed in ironic:
status: New → Triaged
importance: Undecided → High
importance: High → Undecided
Revision history for this message
Sylvère K (sylvr) wrote :

Running `ironic --version` in the "ironic_api" container return :
```
24.1.4.dev1
```

Logs have been added to the original bug description (sorry for the delay).

What other information would you like me to provide ?

description: updated
Afonne-CID (cidelight)
affects: ironic → ironic-ui
Revision history for this message
Jay Faulkner (jason-oldos) wrote (last edit ):

Hey Sylvere,

Thanks for the report. Sadly, we have no real active developers working on ironic-ui and have kept the project alive mostly by it continuing to work without modification. I would not have a strong expectation of this bug being resolved.

I think you can work around it by disabling scope in oslo.policy; but then you lose all of the benefits of the new RBAC model https://docs.openstack.org/ironic/latest/configuration/config.html#oslo_policy.enforce_scope

-Jay

Changed in ironic-ui:
importance: Undecided → High
Revision history for this message
Sylvère K (sylvr) wrote :

Hey Jay,

I wondered if I can avoid this bug with the Skyline webGUI instead of Horizon ?

And I need to test if this doesn't affect the openstack CLI too (it shouldn't from what I can understand, and I can manage without webGUI in that case).

Thanks for your answer !

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.