openstack/python-openstackclient
Code Issues Proposed changes

Fix 'project purge' deleting wrong project's servers and volumes

Browse Source 
Project purge would delete the servers and volumes for the project the
user is currently authenticated for, regardless of the --project flag.

Note: This change means that no server at all will be deleted if the
logged in user doesn't have the get_all_tenants permission set in the
Nova policy (default: admin_api). This doesn't appear to be an issue
with Cinder as the default rule appears to be admin_or_owner.

Change-Id: If1c54e24e1482438b81c3c32fd5fc9fdd7a7be04
Story: 1747988
Task: 13854
This commit is contained in:
Julie Pichon 2018-09-14 09:59:32 +01:00
parent 53c99a21fd
commit 1b66ad9067
2 changed files with 20 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
openstackclient/common/project_purge.py
View File

@ -85,7 +85,7 @@ class ProjectPurge(command.Command):
# servers # servers
try: try:
compute_client = self.app.client_manager.compute compute_client = self.app.client_manager.compute
search_opts = {'tenant_id': project_id} search_opts = {'tenant_id': project_id, 'all_tenants': True}
data = compute_client.servers.list(search_opts=search_opts) data = compute_client.servers.list(search_opts=search_opts)
self.delete_objects( self.delete_objects(
compute_client.servers.delete, data, 'server', dry_run) compute_client.servers.delete, data, 'server', dry_run)
@ -110,7 +110,7 @@ class ProjectPurge(command.Command):
# volumes, snapshots, backups # volumes, snapshots, backups
volume_client = self.app.client_manager.volume volume_client = self.app.client_manager.volume
search_opts = {'project_id': project_id} search_opts = {'project_id': project_id, 'all_tenants': True}
try: try:
data = volume_client.volume_snapshots.list(search_opts=search_opts) data = volume_client.volume_snapshots.list(search_opts=search_opts)
self.delete_objects( self.delete_objects(

30
openstackclient/tests/unit/common/test_project_purge.py
View File

@ -117,10 +117,11 @@ class TestProjectPurge(TestProjectPurgeInit):
self.projects_mock.get.assert_called_once_with(self.project.id) self.projects_mock.get.assert_called_once_with(self.project.id)
self.projects_mock.delete.assert_called_once_with(self.project.id) self.projects_mock.delete.assert_called_once_with(self.project.id)
self.servers_mock.list.assert_called_once_with( self.servers_mock.list.assert_called_once_with(
search_opts={'tenant_id': self.project.id}) search_opts={'tenant_id': self.project.id, 'all_tenants': True})
kwargs = {'filters': {'owner': self.project.id}} kwargs = {'filters': {'owner': self.project.id}}
self.images_mock.list.assert_called_once_with(**kwargs) self.images_mock.list.assert_called_once_with(**kwargs)
volume_search_opts = {'project_id': self.project.id} volume_search_opts = {'project_id': self.project.id,
'all_tenants': True}
self.volumes_mock.list.assert_called_once_with( self.volumes_mock.list.assert_called_once_with(
search_opts=volume_search_opts) search_opts=volume_search_opts)
self.snapshots_mock.list.assert_called_once_with( self.snapshots_mock.list.assert_called_once_with(
@ -152,10 +153,11 @@ class TestProjectPurge(TestProjectPurgeInit):
self.projects_mock.get.assert_called_once_with(self.project.id) self.projects_mock.get.assert_called_once_with(self.project.id)
self.projects_mock.delete.assert_not_called() self.projects_mock.delete.assert_not_called()
self.servers_mock.list.assert_called_once_with( self.servers_mock.list.assert_called_once_with(
search_opts={'tenant_id': self.project.id}) search_opts={'tenant_id': self.project.id, 'all_tenants': True})
kwargs = {'filters': {'owner': self.project.id}} kwargs = {'filters': {'owner': self.project.id}}
self.images_mock.list.assert_called_once_with(**kwargs) self.images_mock.list.assert_called_once_with(**kwargs)
volume_search_opts = {'project_id': self.project.id} volume_search_opts = {'project_id': self.project.id,
'all_tenants': True}
self.volumes_mock.list.assert_called_once_with( self.volumes_mock.list.assert_called_once_with(
search_opts=volume_search_opts) search_opts=volume_search_opts)
self.snapshots_mock.list.assert_called_once_with( self.snapshots_mock.list.assert_called_once_with(
@ -187,10 +189,11 @@ class TestProjectPurge(TestProjectPurgeInit):
self.projects_mock.get.assert_called_once_with(self.project.id) self.projects_mock.get.assert_called_once_with(self.project.id)
self.projects_mock.delete.assert_not_called() self.projects_mock.delete.assert_not_called()
self.servers_mock.list.assert_called_once_with( self.servers_mock.list.assert_called_once_with(
search_opts={'tenant_id': self.project.id}) search_opts={'tenant_id': self.project.id, 'all_tenants': True})
kwargs = {'filters': {'owner': self.project.id}} kwargs = {'filters': {'owner': self.project.id}}
self.images_mock.list.assert_called_once_with(**kwargs) self.images_mock.list.assert_called_once_with(**kwargs)
volume_search_opts = {'project_id': self.project.id} volume_search_opts = {'project_id': self.project.id,
'all_tenants': True}
self.volumes_mock.list.assert_called_once_with( self.volumes_mock.list.assert_called_once_with(
search_opts=volume_search_opts) search_opts=volume_search_opts)
self.snapshots_mock.list.assert_called_once_with( self.snapshots_mock.list.assert_called_once_with(
@ -223,10 +226,11 @@ class TestProjectPurge(TestProjectPurgeInit):
self.projects_mock.get.assert_not_called() self.projects_mock.get.assert_not_called()
self.projects_mock.delete.assert_called_once_with(self.project.id) self.projects_mock.delete.assert_called_once_with(self.project.id)
self.servers_mock.list.assert_called_once_with( self.servers_mock.list.assert_called_once_with(
search_opts={'tenant_id': self.project.id}) search_opts={'tenant_id': self.project.id, 'all_tenants': True})
kwargs = {'filters': {'owner': self.project.id}} kwargs = {'filters': {'owner': self.project.id}}
self.images_mock.list.assert_called_once_with(**kwargs) self.images_mock.list.assert_called_once_with(**kwargs)
volume_search_opts = {'project_id': self.project.id} volume_search_opts = {'project_id': self.project.id,
'all_tenants': True}
self.volumes_mock.list.assert_called_once_with( self.volumes_mock.list.assert_called_once_with(
search_opts=volume_search_opts) search_opts=volume_search_opts)
self.snapshots_mock.list.assert_called_once_with( self.snapshots_mock.list.assert_called_once_with(
@ -259,10 +263,11 @@ class TestProjectPurge(TestProjectPurgeInit):
self.projects_mock.get.assert_called_once_with(self.project.id) self.projects_mock.get.assert_called_once_with(self.project.id)
self.projects_mock.delete.assert_called_once_with(self.project.id) self.projects_mock.delete.assert_called_once_with(self.project.id)
self.servers_mock.list.assert_called_once_with( self.servers_mock.list.assert_called_once_with(
search_opts={'tenant_id': self.project.id}) search_opts={'tenant_id': self.project.id, 'all_tenants': True})
kwargs = {'filters': {'owner': self.project.id}} kwargs = {'filters': {'owner': self.project.id}}
self.images_mock.list.assert_called_once_with(**kwargs) self.images_mock.list.assert_called_once_with(**kwargs)
volume_search_opts = {'project_id': self.project.id} volume_search_opts = {'project_id': self.project.id,
'all_tenants': True}
self.volumes_mock.list.assert_called_once_with( self.volumes_mock.list.assert_called_once_with(
search_opts=volume_search_opts) search_opts=volume_search_opts)
self.snapshots_mock.list.assert_called_once_with( self.snapshots_mock.list.assert_called_once_with(
@ -295,10 +300,11 @@ class TestProjectPurge(TestProjectPurgeInit):
self.projects_mock.get.assert_called_once_with(self.project.id) self.projects_mock.get.assert_called_once_with(self.project.id)
self.projects_mock.delete.assert_called_once_with(self.project.id) self.projects_mock.delete.assert_called_once_with(self.project.id)
self.servers_mock.list.assert_called_once_with( self.servers_mock.list.assert_called_once_with(
search_opts={'tenant_id': self.project.id}) search_opts={'tenant_id': self.project.id, 'all_tenants': True})
kwargs = {'filters': {'owner': self.project.id}} kwargs = {'filters': {'owner': self.project.id}}
self.images_mock.list.assert_called_once_with(**kwargs) self.images_mock.list.assert_called_once_with(**kwargs)
volume_search_opts = {'project_id': self.project.id} volume_search_opts = {'project_id': self.project.id,
'all_tenants': True}
self.volumes_mock.list.assert_called_once_with( self.volumes_mock.list.assert_called_once_with(
search_opts=volume_search_opts) search_opts=volume_search_opts)
self.snapshots_mock.list.assert_called_once_with( self.snapshots_mock.list.assert_called_once_with(