EGI-Federation / cloud-info-provider

EGI Cloud Information System Provider
Apache License 2.0
3 stars 15 forks source link

Invalidated auth may be reused when rescoping to project #243

Open enolfc opened 1 year ago

enolfc commented 1 year ago

Short Description of the issue

When multiple VOs have the same project mapped in OpenStack (should this be allowed?) and there is an error between them, it may happen that the rescoping fails as the project_id is not properly reseted on failures

Environment

Steps to reproduce

Create a config with 3 VOs: 2 mapped to the same project and one with bad credentials as follows:

site:
  name: FOOBAR

compute:
  shares:
    VO1:
      auth:
        project_id: ABC
      name: VO1

    VO2:
      auth:
        project_id: BAD
      name: VO2

    VO3:
      auth:
        project_id: ABC
      name: VO3

Logs, stack trace, or other symptoms

cloud-info-provider will fail with this traceback:

Traceback (most recent call last):
  File "/usr/local/bin/cloud-info-provider-service", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cloud_info_provider/core.py", line 168, in main
    output = mgr.driver.format(opts, providers, auth_refresher)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cloud_info_provider/formatters/base.py", line 54, in format
    info = available_collectors[tpl].fetch()
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cloud_info_provider/collectors/compute.py", line 62, in fetch
    share.update(self.fetch_share_info(site_info, share, vo))
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cloud_info_provider/collectors/compute.py", line 19, in fetch_share_info
    endpoints = self._get_info_from_providers("get_compute_endpoints", **kwargs)
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cloud_info_provider/collectors/base.py", line 26, in _get_info_from_providers
    result = getattr(i, method)(**provider_kwargs)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cloud_info_provider/providers/openstack.py", line 26, in inner
    return f(self, **kwargs)
           ^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/cloud_info_provider/providers/openstack.py", line 166, in get_compute_endpoints
    catalog = self.auth_plugin.get_access(self.session).service_catalog
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/keystoneauth1/identity/base.py", line 131, in get_access
    self.auth_ref = self.get_auth_ref(session)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/keystoneauth1/identity/v3/federation.py", line 70, in get_auth_ref
    auth_ref = token_plugin.get_auth_ref(session)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/keystoneauth1/identity/v3/base.py", line 185, in get_auth_ref
    resp = session.post(token_url, json=body, headers=headers,
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/keystoneauth1/session.py", line 1141, in post
    return self.request(url, 'POST', **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/keystoneauth1/session.py", line 978, in request
    raise exceptions.from_response(resp, method, url)
keystoneauth1.exceptions.http.Unauthorized: The request you have made requires authentication. (HTTP 401) (Request-ID: req-XXXXX)

Summary of proposed changes

Invalidate the project_id after a failure