Project deleted (with resources left orphaned)

Bug #1562190 reported by Josue Palmerin
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Mirantis OpenStack
Status tracked in 10.0.x
MOS Nova
Won't Fix
MOS Nova
Won't Fix
MOS Nova
Won't Fix
MOS Nova

Bug Description

Detailed bug description:

Customer reported an issue where he was able to delete a project with the admin account even with the project still having an instance and a network. The instance and the network are now orphaned and do not have a project assigned. Additionally, the owner of the project can no longer manage the instance via horizon or CLI.

Steps to reproduce:

1. Create test user with admin account
2. Create test project and assign test user as admin
3. Log into test project with test user account
4. Create test network and subnet
5. Launch test instance
6. Log out of test project
7. Log in as admin user to admin project
8. Delete test project - Project deletes successfully.
9. Try to log in as test user to Horizon gets "You are not authorized for any projects." Error as expected.
10. Try nova list with test user via CLI gets:
root@node-1:~# nova list
ERROR (Unauthorized): The request you have made requires authentication. (HTTP 401) (Request-ID: req-a77e5e5c-e919-4f6b-ad0f-99e44771d8da)
11. Do nova show <Instance_ID> with admin user and project and instance is active showing test project as its project.

Expected result:
Project should not be able to be deleted if the Project still has resources (Instances, networks, etc).

Actual result:
Project can be deleted regardless of whether it houses resources.

100% in MOS 7.0

None that I know.

Project owner can no longer manage their resources.

Description of the environment:
[root@fuel ~]# cat /etc/fuel/version.yaml
    - mirantis
  production: "docker"
  release: "7.0"
  openstack_version: "2015.1.0-7.0"
  api: "1.0"
  build_number: "301"
  build_id: "301"
  nailgun_sha: "4162b0c15adb425b37608c787944d1983f543aa8"
  python-fuelclient_sha: "486bde57cda1badb68f915f66c61b544108606f3"
  fuel-agent_sha: "50e90af6e3d560e9085ff71d2950cfbcca91af67"
  fuel-nailgun-agent_sha: "d7027952870a35db8dc52f185bb1158cdd3d1ebd"
  astute_sha: "6c5b73f93e24cc781c809db9159927655ced5012"
  fuel-library_sha: "5d50055aeca1dd0dc53b43825dc4c8f7780be9dd"
  fuel-ostf_sha: "2cd967dccd66cfc3a0abd6af9f31e5b4d150a11c"
  fuelmain_sha: "a65d453215edb0284a2e4761be7a156bb5627677"

Network model:

Changed in fuel:
status: New → Confirmed
Revision history for this message
Javier Diaz Jr (javierdiazcharles) wrote :

I was able to reproduce this on my own as well. There are more than just instances and networks being orphaned here. You also have volumes, glance images, and essentially everything that can be assigned to a project.

I propose that keystone checks the tenants to see if there are any resources available in them. One idea would be to scan the database (i.e. select * from instances where project_id='tenant' and deleted=0;) if any of these select commands return an active resource keystone should send an error to the user both via Horizon and CLI that they need to delete the available resources or migrate them before deleting a tenant.

tags: added: area-mos
Changed in fuel:
assignee: nobody → MOS Keystone (mos-keystone)
Revision history for this message
Boris Bobrov (bbobrov) wrote :

This is a known existing problem in OpenStack. Please see for discussion.

I am marking it as "Wishlist" because no resource cleanup now exists in OpenStack.

Changed in fuel:
importance: Undecided → Wishlist
Revision history for this message
Boris Bobrov (bbobrov) wrote :

I am also removing "Assigned to", because keystone already emits notifications and all projects can listen to them.

Changed in fuel:
assignee: MOS Keystone (mos-keystone) → nobody
Changed in fuel:
importance: Wishlist → Medium
assignee: nobody → MOS Nova (mos-nova)
milestone: none → 9.0
Revision history for this message
Roman Podoliaka (rpodolyaka) wrote :

I agree with Boris'es take on this: it's essentially a feature request, that will require blueprints / specs in upstream for each OpenStack project.

Changed in fuel:
importance: Medium → Wishlist
tags: removed: keystone
tags: added: enhancement
Revision history for this message
Roman Podoliaka (rpodolyaka) wrote :

We can give it a try in upstream in Newton.

no longer affects: fuel
no longer affects: fuel/7.0.x
Changed in mos:
status: Confirmed → Won't Fix
Revision history for this message
Roman Podoliaka (rpodolyaka) wrote :

^ at the same time it won't be backported to previous releases, thus, marking as Won't Fix.

tags: added: 10.0-reviewed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.