ironic/fix-baremetal-admin-user-not-neutron-admin-f163df90ab520dad.yaml at b9a792af9f90dcaa33896a82a4183ad403155591 - ironic - OpenDev: Free Software Needs Free Tools

openstack/ironic

Vasyl Saienko 7bfd88aa37 Do not use user token in neutron client

Ironic requires admin rights in Neutron to perform certain
operations like (create provisioning/cleaning ports, unbind port,
update mac_address). Previously only admins were able to use ironic,
with keystone policy implementation it is possible that baremetal
admin doesn't have enough rights (admin rights) in Neutron with leads
to neutron operations failures.

This patch ensures that we do not pass user token to neutron client,
and always pick admin session.

Closes-Bug: #1657675

Change-Id: If17d5501062075fb8d6ca0eb4f2f38c87e2c2cc3

2017-01-19 12:21:58 +00:00

6 lines

189 B

YAML

Raw Blame History

 ---
 fixes:
   - An issue when baremetal admin user doesn't have enough rights (admin)
     in Neutron by always picking neutron user from ironic config
     and avoiding passing client token.