inmanta-module-openstack 6.1.0__tar.gz → 6.1.1__tar.gz

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: inmanta-module-openstack
-Version: 6.1.0
+Version: 6.1.1
 License: Apache 2.0
 Requires-Dist: inmanta-module-ssh
 Requires-Dist: inmanta-module-std

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/inmanta_module_openstack.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: inmanta-module-openstack
-Version: 6.1.0
+Version: 6.1.1
 License: Apache 2.0
 Requires-Dist: inmanta-module-ssh
 Requires-Dist: inmanta-module-std

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/inmanta_module_openstack.egg-info/SOURCES.txt

@@ -43,6 +43,7 @@ inmanta_plugins/openstack/network/trunk_port.py
 inmanta_plugins/openstack/quota/__init__.py
 inmanta_plugins/openstack/quota/quota.py
 tests/test_block_devices.py
+tests/test_common_base.py
 tests/test_dependency_handling.py
 tests/test_examples.py
 tests/test_flavor.py

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/inmanta_plugins/openstack/common/base.py

@@ -175,15 +175,19 @@ class OpenStackHandler(CRUDHandler):
         """
         Retrieve the id of a project based on the given name
         """
+        # A project-scoped token already knows its own project id. Use it before
+        # querying Keystone: non-admin users may be forbidden to get/list projects.
+        current_project_id = self._connection.current_project_id
+        if name == resource.admin_project_name and current_project_id:
+            return current_project_id
+
         project = self._connection.identity.find_project(name)
         if project:
             return project.id
 
         # fallback for non-admins: if we’re scoped to a project and its name matches
-        if self._connection.current_project_id:
-            current = self._connection.identity.get_project(
-                self._connection.current_project_id
-            )
+        if current_project_id:
+            current = self._connection.identity.get_project(current_project_id)
             if current and current.name == name:
                 return current.id
 
@@ -342,14 +346,15 @@ class OpenStackHandler(CRUDHandler):
             return None
         return self._connection.identity.find_domain(domain_name)
 
-    def get_server_by_name(self, name, project_id=None):
+    def get_server_by_name(self, name, project_id=None, all_projects=False):
         """
         Retrieve a server by name
         """
         additional_args = {}
         if project_id is not None:
-            additional_args["all_projects"] = True
             additional_args["project_id"] = project_id
+        if all_projects:
+            additional_args["all_projects"] = True
         # regex for exact match
         servers = self._connection.compute.servers(name=f"^{name}$", **additional_args)
 

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/inmanta_plugins/openstack/compute/flavor.py

@@ -19,7 +19,7 @@ Contact: code@inmanta.com
 from typing import Any
 
 from inmanta.agent import handler
-from inmanta.agent.handler import ResourcePurged, cache, provider
+from inmanta.agent.handler import ResourcePurged, SkipResource, cache, provider
 from inmanta.resources import resource
 from openstack.compute.v2.flavor import Flavor as SdkFlavor
 
@@ -47,6 +47,7 @@ class Flavor(OpenstackAdminResource):
         "rxtx_factor",
         "is_public",
         "description",
+        "allowed_projects",
         "extra_specs",
     )
     name: str
@@ -60,6 +61,17 @@ class Flavor(OpenstackAdminResource):
     is_public: bool
     description: str | None
     extra_specs: dict[str, Any] | None
+    allowed_projects: list[dict[str, str]]
+
+    @staticmethod
+    def get_allowed_projects(_, obj):
+        return sorted(
+            [
+                {"name": project.name, "domain": project.domain}
+                for project in obj.allowed_projects
+            ],
+            key=lambda project: (project["domain"], project["name"]),
+        )
 
     @staticmethod
     def get_extra_specs(_, obj):
@@ -72,7 +84,7 @@ class Flavor(OpenstackAdminResource):
 class FlavorHandler(OpenStackHandler):
     # Fields Nova can change on an existing flavor. Any other change requires
     # deleting and recreating it.
-    IN_PLACE_FIELDS = {"description", "extra_specs"}
+    IN_PLACE_FIELDS = {"description", "extra_specs", "allowed_projects"}
 
     # Set by read_resource, which raises ResourcePurged when the flavor is gone,
     # so the other handler methods can rely on it being there.
@@ -163,14 +175,17 @@ class FlavorHandler(OpenStackHandler):
         # value in place keeps whatever is on the flavor out of the diff.
         if resource.description is not None:
             resource.description = self.flavor.description or ""
+        resource.allowed_projects = self._current_allowed_projects(resource)
         if resource.extra_specs is not None:
             resource.extra_specs = self.flavor.extra_specs
         self._set_facts(ctx)
 
     def create_resource(self, ctx: handler.HandlerContext, resource: Flavor) -> None:
+        desired_project_ids = self._desired_project_ids(resource)
         self.flavor = self._create_flavor(
             resource, resource.description, resource.extra_specs
         )
+        self._update_allowed_projects(desired_project_ids)
         self._set_facts(ctx)
         ctx.set_created()
 
@@ -187,6 +202,7 @@ class FlavorHandler(OpenStackHandler):
         """Update flavor parameters.
 
         Nova lets us change the description and the extra specs on an existing
+        flavor. Project access can also be reconciled without recreating the
         flavor. The sizing fields are immutable, so a change to any of those is
         applied by deleting the existing flavor and recreating it. That is only
         safe when OpenStack assigns the id: an explicit flavor_id would collide
@@ -196,7 +212,10 @@ class FlavorHandler(OpenStackHandler):
         never updated, and a recreate carries the live values over rather than
         dropping them.
         """
-        if not set(changes) - self.IN_PLACE_FIELDS:
+        recreate_flavor = bool(set(changes) - self.IN_PLACE_FIELDS)
+        desired_project_ids = self._desired_project_ids(resource)
+
+        if not recreate_flavor:
             if "description" in changes:
                 self._connection.compute.update_flavor(
                     self.flavor, description=resource.description
@@ -204,6 +223,8 @@ class FlavorHandler(OpenStackHandler):
             # Unmanaged fields never end up in changes, so both are set here.
             if "extra_specs" in changes and resource.extra_specs is not None:
                 self._update_extra_specs(resource.extra_specs)
+            if "allowed_projects" in changes:
+                self._update_allowed_projects(desired_project_ids)
             ctx.set_updated()
             return
 
@@ -232,9 +253,98 @@ class FlavorHandler(OpenStackHandler):
         )
         self._delete_flavor()
         self.flavor = self._create_flavor(resource, description, extra_specs)
+        self._update_allowed_projects(desired_project_ids)
         self._set_facts(ctx)
         ctx.set_updated()
 
+    def _flavor_accesses(self) -> list[dict[str, str]]:
+        if self.flavor.is_public:
+            return []
+        return list(self._connection.compute.get_flavor_access(self.flavor))
+
+    @staticmethod
+    def _project_id_from_access(access: dict[str, str]) -> str | None:
+        return access.get("tenant_id") or access.get("project_id")
+
+    def _get_project(self, project: dict[str, str]):
+        domain_name = project["domain"]
+        domain = self._connection.identity.find_domain(domain_name)
+        if domain is None:
+            raise SkipResource(f"The domain {domain_name} does not exist.")
+
+        project_name = project["name"]
+        openstack_project = self._connection.identity.find_project(
+            project_name,
+            domain_id=domain.id,
+        )
+        if openstack_project is None:
+            raise SkipResource(
+                f"The project {project_name} does not exist in domain {domain_name}."
+            )
+        return openstack_project
+
+    def _current_allowed_projects(self, resource: Flavor) -> list[dict[str, str]]:
+        if resource.is_public:
+            return []
+
+        projects = []
+        for access in self._flavor_accesses():
+            project_id = self._project_id_from_access(access)
+            if project_id is None:
+                continue
+
+            project = self._connection.identity.find_project(
+                project_id, ignore_missing=True
+            )
+            if project is None:
+                # Nova keeps the access row when the project is deleted in Keystone.
+                # Report it as an unknown grant so the update revokes it.
+                projects.append({"name": project_id, "domain": ""})
+                continue
+            domain = self._connection.identity.find_domain(
+                project.domain_id, ignore_missing=True
+            )
+            projects.append(
+                {"name": project.name, "domain": domain.name if domain else ""}
+            )
+        return sorted(
+            projects, key=lambda project: (project["domain"], project["name"])
+        )
+
+    def _desired_project_ids(self, resource: Flavor) -> set[str]:
+        """Resolve every desired project before touching the flavor, so an
+        unresolvable project skips the resource instead of leaving it half
+        applied (flavor created/recreated but with a partial access list).
+        """
+        if resource.is_public and resource.allowed_projects:
+            raise ValueError(
+                "Project access can only be configured on a private flavor."
+            )
+        return {self._get_project(project).id for project in resource.allowed_projects}
+
+    def _update_allowed_projects(self, desired_project_ids: set[str]) -> None:
+        current_project_ids = {
+            project_id
+            for access in self._flavor_accesses()
+            if (project_id := self._project_id_from_access(access)) is not None
+        }
+
+        for project_id in desired_project_ids - current_project_ids:
+            if hasattr(self._connection.compute, "flavor_add_tenant_access"):
+                self._connection.compute.flavor_add_tenant_access(
+                    self.flavor, project_id
+                )
+            else:
+                self._connection.compute.add_flavor_access(self.flavor, project_id)
+
+        for project_id in current_project_ids - desired_project_ids:
+            if hasattr(self._connection.compute, "flavor_remove_tenant_access"):
+                self._connection.compute.flavor_remove_tenant_access(
+                    self.flavor, project_id
+                )
+            else:
+                self._connection.compute.remove_flavor_access(self.flavor, project_id)
+
     def _set_facts(self, ctx):
         ctx.set_fact("flavor_id", self.flavor.id)
         ctx.set_fact("is_disabled", str(self.flavor.is_disabled))

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/inmanta_plugins/openstack/compute/virtual_machine.py

@@ -17,7 +17,6 @@ Contact: code@inmanta.com
 """
 
 import time
-import traceback
 from typing import Any
 
 from inmanta import ast
@@ -193,15 +192,17 @@ class VirtualMachine(OpenstackResource):
 class VirtualMachineHandler(OpenStackHandler):
     @cache(timeout=1, cache_none=False)
     def _get_server(self, ctx, resource):
+        if resource.project == resource.admin_project_name:
+            return self.get_server_by_name(resource.name)
+
         project_id = self.get_project_id(resource, resource.project)
-        server = self.get_server_by_name(resource.name, project_id)
-        if resource.project != resource.admin_project_name:
-            ctx.exception(
-                f"Unable to retrieve server list with a scoped login on project {resource.admin_project_name}, "
-                f"for project {resource.project}. This only works with admin credentials.",
-                traceback=traceback.format_exc(),
+        server = self.get_server_by_name(resource.name, project_id, all_projects=True)
+        if server is None:
+            ctx.debug(
+                "No server named %(name)s found in project %(project)s.",
+                name=resource.name,
+                project=resource.project,
             )
-            return None
         return server
 
     @cache(timeout=10, cache_none=False)
@@ -299,8 +300,13 @@ class VirtualMachineHandler(OpenStackHandler):
             ctx.info(f"Created a new keypair with name {resource.key_name}")
 
     def _server_with_name_exists(self, resource):
-        project_id = self.get_project_id(resource, resource.project)
-        server = self.get_server_by_name(resource.name, project_id)
+        if resource.project == resource.admin_project_name:
+            server = self.get_server_by_name(resource.name)
+        else:
+            project_id = self.get_project_id(resource, resource.project)
+            server = self.get_server_by_name(
+                resource.name, project_id, all_projects=True
+            )
         return server is not None
 
     def _raise_server_error(self, ctx: HandlerContext, log_message: str) -> None:
@@ -441,7 +447,8 @@ class VirtualMachineHandler(OpenStackHandler):
         if self.server is None:
             raise ResourcePurged()
 
-        if self.server.status == "ERROR":
+        # Raise error always except when the resource is being purged.
+        if self.server.status == "ERROR" and not resource.purged:
             self._raise_server_error(
                 ctx, "Server is in ERROR state; delete it to allow redeployment"
             )

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/inmanta_plugins/openstack/model/_init.cf

@@ -173,8 +173,8 @@ entity GroupRole extends OpenStackResource:
     """
     string role
     string group_name
-    string group_domain="Default"
-    string domain=""
+    string group_domain = "Default"
+    string? domain = null
 end
 index GroupRole(project, group_name, group_domain, role, domain)
 
@@ -865,6 +865,7 @@ entity Flavor extends OpenStackResource:
         :attr description: A free-form description of the flavor. Unlike the other
             attributes, this one can be updated in place, without recreating the flavor.
             Leave it null to not manage the description at all.
+        :attr allowed_projects: Projects that can access this flavor when is_public is false
         :attr extra_specs: Set extra specs on a flavor. See https://docs.openstack.org/nova/rocky/admin/flavors.html
             This set is managed exhaustively: a spec present on the flavor but absent
             here is removed, so the default of an empty dict clears every spec. Set it
@@ -887,6 +888,38 @@ end
 
 implement Flavor using providerRequire
 
+Flavor.allowed_projects [0:] -- Project.allowed_flavors [0:]
+"""
+:rel allowed_projects: The projects that may use this flavor. Only meaningful when
+    ``is_public`` is false; setting it on a public flavor is an error, since Nova has
+    no access list for public flavors. The list is managed exhaustively: a grant on
+    the flavor but absent here is revoked, so the default of an empty relation clears
+    every grant.
+"""
+
+implementation flavorProjectAccessDependencies for Flavor:
+    for project in self.allowed_projects:
+        std::assert(
+            project.provider == self.provider,
+            "Flavor '{{name}}' is on provider '{{provider.name}}' but allowed project '{{project.name}}' is on another provider."
+        )
+        if not self.purged and not project.purged:
+            self.requires += project
+        end
+    end
+end
+
+implement Flavor using flavorProjectAccessDependencies
+
+implementation flavorProjectAccessOnPrivateOnly for Flavor:
+    std::assert(
+        self.is_public == false or std::count(self.allowed_projects) == 0,
+        "Flavor '{{name}}' is public, so it cannot have allowed_projects: Nova has no access list for public flavors."
+    )
+end
+
+implement Flavor using flavorProjectAccessOnPrivateOnly
+
 index HostAggregateMetadata(provider, aggregate, key)
 HostAggregateMetadata.provider [1] -- Provider.host_aggregate_metadata [0:]
 entity HostAggregateMetadata extends OpenStackResource:

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/inmanta_plugins/openstack/network/network_port.py

@@ -224,7 +224,12 @@ class NetworkPortHandler(OpenStackHandler):
         tries = 0
         max_attempts = resource.retries if resource.retries > 0 else 1
         while tries < max_attempts:
-            vm = self.get_server_by_name(resource.host, project_id)
+            cross_project = resource.project != resource.admin_project_name
+            vm = self.get_server_by_name(
+                resource.host,
+                project_id if cross_project else None,
+                all_projects=cross_project,
+            )
             if vm is None:
                 return None
 
@@ -322,6 +327,39 @@ class NetworkPortHandler(OpenStackHandler):
         resource.name = self.port.name
         self._set_facts(ctx)
 
+    def calculate_diff(
+        self, ctx: handler.HandlerContext, current: NetworkPort, desired: NetworkPort
+    ) -> dict[str, dict[str, object]]:
+        changes = super().calculate_diff(ctx, current, desired)
+
+        pairs = changes.get("allowed_address_pairs")
+        if pairs is not None and self._equivalent_address_pairs(
+            current=pairs["current"], desired=pairs["desired"]
+        ):
+            del changes["allowed_address_pairs"]
+
+        return changes
+
+    @staticmethod
+    def _equivalent_address_pairs(
+        *, current: dict[str, Optional[str]], desired: dict[str, Optional[str]]
+    ) -> bool:
+        """
+        Whether two sets of allowed address pairs describe the same desired state.
+
+        Neutron pins the port's own MAC on a pair that does not carry one, so a pair
+        left without a MAC always reads back with one: the MAC of such a pair is not
+        managed and any value it holds is equivalent. A pair that does request a MAC
+        is compared as is.
+        """
+        if current.keys() != desired.keys():
+            return False
+
+        return all(
+            desired_mac is None or desired_mac == current[address]
+            for address, desired_mac in desired.items()
+        )
+
     def create_resource(
         self, ctx: handler.HandlerContext, resource: NetworkPort
     ) -> None:
@@ -455,6 +493,23 @@ class NetworkPortHandler(OpenStackHandler):
         changes: dict,
         resource: NetworkPort,
     ) -> None:
+        if "mac_address" in changes:
+            # Neutron only accepts a MAC address when it creates the port, so a port
+            # that is already there with another one cannot be reconciled - it has to be
+            # recreated. A port created before its MAC was pinned in the model looks
+            # exactly like this. Fail with the reason rather than through the generic
+            # unexpected-change check below, and never let the change through: nothing
+            # here can apply it, so the port would report an update on every deploy
+            # while staying on its original MAC.
+            raise ValueError(
+                f"Port {resource.name} has MAC address "
+                f"{changes['mac_address']['current']} but the model requests "
+                f"{changes['mac_address']['desired']}. Neutron assigns a MAC address "
+                "when the port is created and does not allow changing it afterwards, "
+                "so this port has to be deleted and recreated to take the requested "
+                "one."
+            )
+
         self.validate_allowed_fields(
             changes,
             {

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/inmanta_plugins/openstack/setup.cfg

@@ -22,7 +22,7 @@ target-version = 'py36', 'py37', 'py38'
 name = inmanta-module-openstack
 freeze_recursive = False
 freeze_operator = ~=
-version = 6.1.0
+version = 6.1.1
 license = Apache 2.0
 
 [egg_info]

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/setup.cfg

@@ -22,7 +22,7 @@ target-version = 'py36', 'py37', 'py38'
 name = inmanta-module-openstack
 freeze_recursive = False
 freeze_operator = ~=
-version = 6.1.0
+version = 6.1.1
 license = Apache 2.0
 
 [egg_info]

inmanta_module_openstack-6.1.1/tests/test_common_base.py

@@ -0,0 +1,60 @@
+"""
+Copyright 2026 Inmanta
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+Contact: code@inmanta.com
+"""
+
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+
+from inmanta_plugins.openstack.common.base import OpenStackHandler
+
+
+def _handler(connection) -> OpenStackHandler:
+    handler = object.__new__(OpenStackHandler)
+    handler._connection = connection
+    return handler
+
+
+def test_get_project_id_uses_scoped_project_without_identity_lookup() -> None:
+    connection = SimpleNamespace(
+        current_project_id="project-id",
+        identity=MagicMock(),
+    )
+    resource = SimpleNamespace(admin_project_name="tenant-project")
+
+    assert (
+        _handler(connection).get_project_id(resource, "tenant-project") == "project-id"
+    )
+    connection.identity.find_project.assert_not_called()
+    connection.identity.get_project.assert_not_called()
+
+
+def test_get_project_id_can_still_resolve_another_visible_project() -> None:
+    connection = SimpleNamespace(
+        current_project_id="current-project-id",
+        identity=MagicMock(),
+    )
+    connection.identity.find_project.return_value = SimpleNamespace(
+        id="other-project-id"
+    )
+    resource = SimpleNamespace(admin_project_name="current-project")
+
+    assert (
+        _handler(connection).get_project_id(resource, "other-project")
+        == "other-project-id"
+    )
+    connection.identity.find_project.assert_called_once_with("other-project")
+    connection.identity.get_project.assert_not_called()

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/tests/test_flavor.py

@@ -18,6 +18,7 @@ Contact: code@inmanta.com
 
 import json
 import os
+import uuid
 
 import inmanta
 import pytest
@@ -56,6 +57,59 @@ def cleanup(os_tester):
     cleanup_flavor(os_tester.connection)
 
 
+@pytest.fixture()
+def flavor_access_projects(os_tester):
+    project_domain_name = os.environ["OS_PROJECT_DOMAIN_NAME"]
+    projects = (
+        os_tester.get_project(f"flavor-access-1-{uuid.uuid4().hex[:8]}"),
+        os_tester.get_project(f"flavor-access-2-{uuid.uuid4().hex[:8]}"),
+    )
+
+    cleanup_flavor(os_tester.connection)
+
+    yield project_domain_name, projects
+
+    cleanup_flavor(os_tester.connection)
+
+
+@pytest.fixture()
+def flavor_access_member_user(os_tester, flavor_access_projects):
+    _, os_projects = flavor_access_projects
+    identity = os_tester.connection.identity
+    user_domain_name = os.environ["OS_USER_DOMAIN_NAME"]
+    user_domain = identity.find_domain(user_domain_name, ignore_missing=True)
+    if user_domain is None:
+        pytest.skip(f"The user domain {user_domain_name} does not exist.")
+
+    role = identity.find_role("member", ignore_missing=True)
+    if role is None:
+        pytest.skip("The member role does not exist.")
+
+    user_name = f"test-flavor-access-{uuid.uuid4().hex[:8]}"
+    password = f"test-flavor-access-{uuid.uuid4().hex}"
+    user = identity.create_user(
+        name=user_name,
+        password=password,
+        is_enabled=True,
+        domain_id=user_domain.id,
+    )
+
+    # Use a non-admin tenant user so admin policy does not bypass flavor access.
+    for os_project in os_projects:
+        identity.assign_project_role_to_user(os_project.project_object, user, role)
+
+    yield user_name, password
+
+    for os_project in os_projects:
+        try:
+            identity.unassign_project_role_from_user(
+                os_project.project_object, user, role
+            )
+        except Exception:
+            pass
+    identity.delete_user(user, ignore_missing=True)
+
+
 def compile_flavor(
     os_tester,
     project,
@@ -328,3 +382,278 @@ flavor=openstack::Flavor(
     assert os_flavor.id == flavor_id
     assert os_flavor.description == "Set on an explicit-id flavor"
     assert os_flavor.extra_specs == {"hw:watchdog_action": "reset"}
+
+
+def test_flavor_project_access(project, os_tester, flavor_access_projects):
+    project_domain_name, os_projects = flavor_access_projects
+    project_name_1, project_name_2 = (
+        os_project.project_object.name for os_project in os_projects
+    )
+
+    def compile_model(allowed_projects):
+        os_tester.compile_with_provider(f"""
+project_1 = openstack::Project(
+    provider=provider,
+    name="{project_name_1}",
+    domain="{project_domain_name}",
+    description="",
+    enabled=true,
+    purged=false,
+)
+
+project_2 = openstack::Project(
+    provider=provider,
+    name="{project_name_2}",
+    domain="{project_domain_name}",
+    description="",
+    enabled=true,
+    purged=false,
+)
+
+flavor = openstack::Flavor(
+    provider=provider,
+    name="test-flavor",
+    ram=1024,
+    vcpus=4,
+    disk=10,
+    is_public=false,
+    allowed_projects={allowed_projects},
+)
+""")
+
+    def project_ids_for_flavor_access():
+        flavor = get_test_flavor(os_tester.connection)
+        compute = os_tester.connection.compute
+        if hasattr(compute, "get_flavor_access"):
+            accesses = compute.get_flavor_access(flavor)
+        else:
+            accesses = compute.flavor_accesses(flavor)
+
+        project_ids = set()
+        for access in accesses:
+            project_id = getattr(access, "tenant_id", None) or getattr(
+                access, "project_id", None
+            )
+            if project_id is None and hasattr(access, "get"):
+                project_id = access.get("tenant_id") or access.get("project_id")
+            project_ids.add(project_id)
+        return project_ids
+
+    def project_id(name):
+        return os_tester.connection.identity.find_project(name).id
+
+    compile_model("[project_1, project_2]")
+    flavor = project.get_resource("openstack::Flavor", name="test-flavor")
+    assert flavor.allowed_projects == [
+        {"name": project_name_1, "domain": project_domain_name},
+        {"name": project_name_2, "domain": project_domain_name},
+    ]
+
+    for project_name in (project_name_1, project_name_2):
+        project_resource = project.get_resource("openstack::Project", name=project_name)
+        assert (
+            project.deploy(project_resource).status
+            == inmanta.const.ResourceState.deployed
+        )
+
+    assert project.deploy(flavor).status == inmanta.const.ResourceState.deployed
+    assert project_ids_for_flavor_access() == {
+        project_id(project_name_1),
+        project_id(project_name_2),
+    }
+
+    flavor_id = get_test_flavor(os_tester.connection).id
+    compile_model("[project_1]")
+    flavor = project.get_resource("openstack::Flavor", name="test-flavor")
+    assert project.deploy(flavor).status == inmanta.const.ResourceState.deployed
+    assert get_test_flavor(os_tester.connection).id == flavor_id
+    assert project_ids_for_flavor_access() == {project_id(project_name_1)}
+    assert not project.dryrun(flavor).changes
+
+
+def test_private_flavor_controls_vm_creation(
+    project,
+    os_tester,
+    flavor_access_projects,
+    flavor_access_member_user,
+    ssh_public_key,
+):
+    project_domain_name, os_projects = flavor_access_projects
+    allowed_project, denied_project = os_projects
+    allowed_project_name = allowed_project.project_object.name
+    denied_project_name = denied_project.project_object.name
+    flavor_name = "test-flavor"
+    tenant_username, tenant_password = flavor_access_member_user
+
+    def compile_flavor_model():
+        os_tester.compile_with_provider(
+            f"""
+project_1 = openstack::Project(
+    provider=provider,
+    name="{allowed_project_name}",
+    domain="{project_domain_name}",
+    description="",
+    enabled=true,
+    purged=false,
+)
+
+project_2 = openstack::Project(
+    provider=provider,
+    name="{denied_project_name}",
+    domain="{project_domain_name}",
+    description="",
+    enabled=true,
+    purged=false,
+)
+
+flavor = openstack::Flavor(
+    provider=provider,
+    name="{flavor_name}",
+    ram=1024,
+    vcpus=1,
+    disk=1,
+    is_public=false,
+    allowed_projects=[project_1],
+)
+""",
+            name="flavor_access_admin",
+        )
+
+    def vm_names(os_project):
+        return {
+            "key": os_project.get_resource_name("flavor-access-key"),
+            "network": os_project.get_resource_name("flavor-access-net"),
+            "port": os_project.get_resource_name("flavor-access-port"),
+            "server": (
+                os_project.get_resource_name("flavor-access-server").replace("_", "-")
+            ),
+        }
+
+    def compile_vm_model(os_project, names, provider_name: str, purged: bool = False):
+        purged_value = str(purged).lower()
+        os_tester.compile_with_provider(
+            f"""
+import unittest
+import ssh
+
+tenant_project = openstack::Project(
+    provider=provider,
+    name=provider.project_name,
+    domain="{project_domain_name}",
+    description="",
+    enabled=true,
+    managed=false,
+)
+n = openstack::Network(
+    provider=provider,
+    name="{names["network"]}",
+    project=tenant_project,
+    purged={purged_value},
+)
+subnet = openstack::Subnet(
+    provider=provider,
+    project=tenant_project,
+    network=n,
+    dhcp=true,
+    name="{names["network"]}",
+    network_address="10.255.255.0/24",
+    purged={purged_value},
+)
+
+os = std::OS(name="cirros", version=0.4, family=std::linux)
+key = ssh::Key(name="{names["key"]}", public_key="{ssh_public_key}")
+vm = openstack::VirtualMachine(
+    provider=provider,
+    project=tenant_project,
+    key_pair=key,
+    name="{names["server"]}",
+    image=openstack::find_image(provider, os),
+    flavor="{flavor_name}",
+    user_data="",
+    purged={purged_value},
+)
+port = openstack::NetworkPort(
+    provider=provider,
+    project=tenant_project,
+    name="{names["port"]}",
+    subnet=subnet,
+    address="10.255.255.10",
+    dhcp=false,
+    vm=vm,
+    retries=1,
+    wait=0,
+    purged={purged_value},
+)
+vm.eth0_port = port
+""",
+            name=provider_name,
+            username=tenant_username,
+            password=tenant_password,
+            project_name=os_project.project_object.name,
+        )
+
+    def deploy(resource_type: str, resource_name: str) -> None:
+        project.deploy_resource(resource_type, name=resource_name)
+
+    allowed_names = vm_names(allowed_project)
+    denied_names = vm_names(denied_project)
+
+    compile_flavor_model()
+    for project_name in (allowed_project_name, denied_project_name):
+        deploy("openstack::Project", project_name)
+    deploy("openstack::Flavor", flavor_name)
+
+    compile_vm_model(
+        denied_project,
+        denied_names,
+        # The find_image plugin caches by provider name, so each scope gets its own.
+        provider_name="flavor_access_denied",
+    )
+    deploy("openstack::Network", denied_names["network"])
+    deploy("openstack::Subnet", denied_names["network"])
+    project.deploy_resource(
+        "openstack::VirtualMachine",
+        name=denied_names["server"],
+        status=inmanta.const.ResourceState.failed,
+    )
+    assert (
+        denied_project.connection.compute.find_server(
+            denied_names["server"], ignore_missing=True
+        )
+        is None
+    )
+
+    compile_vm_model(
+        allowed_project,
+        allowed_names,
+        provider_name="flavor_access_allowed",
+    )
+    deploy("openstack::Network", allowed_names["network"])
+    deploy("openstack::Subnet", allowed_names["network"])
+    deploy("openstack::VirtualMachine", allowed_names["server"])
+    assert (
+        allowed_project.connection.compute.find_server(
+            allowed_names["server"], ignore_missing=True
+        )
+        is not None
+    )
+
+    compile_vm_model(
+        allowed_project,
+        allowed_names,
+        provider_name="flavor_access_allowed",
+        purged=True,
+    )
+    deploy("openstack::VirtualMachine", allowed_names["server"])
+    deploy("openstack::Subnet", allowed_names["network"])
+    deploy("openstack::Network", allowed_names["network"])
+
+    compile_vm_model(
+        denied_project,
+        denied_names,
+        provider_name="flavor_access_denied",
+        purged=True,
+    )
+    deploy("openstack::VirtualMachine", denied_names["server"])
+    deploy("openstack::Subnet", denied_names["network"])
+    deploy("openstack::Network", denied_names["network"])

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/tests/test_network_port_missing_network.py

@@ -73,6 +73,7 @@ def _port_handler(
 
     port_handler = typing.cast(NetworkPortHandler, project.get_handler(resource, False))
     port_handler._connection = MagicMock()
+    port_handler._connection.current_project_id = "project-id"
     port_handler._connection.identity.find_project.return_value = SimpleNamespace(
         id="project-id"
     )

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/tests/test_network_port_shared_network.py

@@ -88,6 +88,7 @@ def _port_handler(
 
     port_handler = typing.cast(NetworkPortHandler, project.get_handler(resource, False))
     port_handler._connection = MagicMock()
+    port_handler._connection.current_project_id = PROJECT_ID
     port_handler._connection.identity.find_project.return_value = SimpleNamespace(
         id=PROJECT_ID
     )

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/tests/test_neutron.py

@@ -825,7 +825,9 @@ port = openstack::NetworkPort(
     assert ports[0].network_id == networks[0].id
 
 
-def test_shared_network(project: Project, os_tester: OpenstackTester) -> None:
+def test_shared_network(
+    project: Project, os_tester: OpenstackTester, ssh_public_key: str
+) -> None:
     """
     Create a shared network as one project and add ports to it as another project
     """
@@ -866,7 +868,7 @@ def test_shared_network(project: Project, os_tester: OpenstackTester) -> None:
                            network_address="10.255.254.0/24", dns_servers=["8.8.8.8", "8.8.4.4"], managed=true)
 
     os = std::OS(name="cirros", version=0.4, family=std::linux)
-    key = ssh::Key(name="%(key_name)s", public_key="")
+    key = ssh::Key(name="%(key_name)s", public_key="%(ssh_public_key)s")
     vm = openstack::Host(provider=provider, project=project, key_pair=key, name="%(server_name)s", os=os,
                          ip=std::getfact(vm.vm, "ip_address"),
                          image=openstack::find_image(provider, os), flavor=openstack::find_flavor(provider, 1, 0.5),
@@ -877,6 +879,7 @@ def test_shared_network(project: Project, os_tester: OpenstackTester) -> None:
         % {
             "net_name": net_name,
             "key_name": key_name,
+            "ssh_public_key": ssh_public_key,
             "server_name": server_name,
         },
         project_name=project2._project_name,
@@ -908,7 +911,7 @@ def test_shared_network(project: Project, os_tester: OpenstackTester) -> None:
                            network_address="10.255.253.0/24", dns_servers=["8.8.8.8", "8.8.4.4"], managed=true)
 
     os = std::OS(name="cirros", version=0.4, family=std::linux)
-    key = ssh::Key(name="%(key_name)s", public_key="")
+    key = ssh::Key(name="%(key_name)s", public_key="%(ssh_public_key)s")
     vm = openstack::Host(provider=provider, project=project, key_pair=key, name="%(server_name)s", os=os,
                          ip=std::getfact(vm.vm, "ip_address"),
                          image=openstack::find_image(provider, os), flavor=openstack::find_flavor(provider, 1, 0.5),
@@ -923,6 +926,7 @@ def test_shared_network(project: Project, os_tester: OpenstackTester) -> None:
         % {
             "net_name": net_name,
             "key_name": key_name,
+            "ssh_public_key": ssh_public_key,
             "server_name": server_name,
         },
         project_name=project2._project_name,
@@ -933,7 +937,9 @@ def test_shared_network(project: Project, os_tester: OpenstackTester) -> None:
     project.deploy_resource("openstack::NetworkPort", name=server_name + "_eth2")
 
 
-def test_allowed_addr_port_with_trunk(project, os_tester, require_network_extension):
+def test_allowed_addr_port_with_trunk(
+    project, os_tester, require_network_extension, ssh_public_key
+):
     """
     Test creating a port with allowed address pairs and trunk network/subports
     """
@@ -957,7 +963,7 @@ def test_allowed_addr_port_with_trunk(project, os_tester, require_network_extens
                                network_address="10.255.255.0/24", dns_servers=["8.8.8.8", "8.8.4.4"])
 
     os = std::OS(name="cirros", version=0.4, family=std::linux)
-    key = ssh::Key(name="%(key_name)s", public_key="")
+    key = ssh::Key(name="%(key_name)s", public_key="%(ssh_public_key)s")
 
     vm = openstack::VirtualMachine(provider=provider, project=project, key_pair=key, name="%(server_name)s",
                                    image=openstack::find_image(provider, os), flavor=openstack::find_flavor(provider, 1, 0.5),
@@ -993,6 +999,7 @@ def test_allowed_addr_port_with_trunk(project, os_tester, require_network_extens
             "port_name_2": port_name_2,
             "server_name": server_name,
             "key_name": key_name,
+            "ssh_public_key": ssh_public_key,
             "trunk_name": trunk_name,
             "subport_name": subport_name,
         },

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/tests/test_nova.py

@@ -17,7 +17,9 @@ Contact: code@inmanta.com
 """
 
 import time
+from types import SimpleNamespace
 from typing import Optional
+from unittest.mock import Mock
 
 import inmanta
 import inmanta.const
@@ -26,6 +28,29 @@ from conftest import OpenstackTester
 from inmanta.ast import ExplicitPluginException
 from pytest_inmanta.plugin import Project
 
+from inmanta_plugins.openstack.common.base import OpenStackHandler
+
+
+def test_get_server_by_name_all_projects_is_opt_in() -> None:
+    handler = OpenStackHandler.__new__(OpenStackHandler)
+    server = SimpleNamespace(name="server")
+    servers = Mock(return_value=iter([server]))
+    handler._connection = SimpleNamespace(compute=SimpleNamespace(servers=servers))
+
+    assert handler.get_server_by_name("server", project_id="project-id") is server
+    servers.assert_called_once_with(name="^server$", project_id="project-id")
+
+    servers.reset_mock()
+    servers.return_value = iter([server])
+
+    assert (
+        handler.get_server_by_name("server", project_id="project-id", all_projects=True)
+        is server
+    )
+    servers.assert_called_once_with(
+        name="^server$", project_id="project-id", all_projects=True
+    )
+
 
 def get_model(
     name: str,

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/tests/test_server_group.py

@@ -203,6 +203,7 @@ def _vm_handler(project):
         VirtualMachineHandler, project.get_handler(resource, False)
     )
     vm_handler._connection = MagicMock()
+    vm_handler._connection.current_project_id = "project-id"
     vm_handler._connection.identity.find_project.return_value = SimpleNamespace(
         id="project-id"
     )

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/tests/test_trunk.py

@@ -296,6 +296,7 @@ def test_trunk_deploy_on_vm_parent_port(
     project: pytest_inmanta.plugin.Project,
     os_tester,
     require_network_extension,
+    ssh_public_key,
 ):
     """
     Deploy a trunk whose parent port is attached to a VM.
@@ -327,7 +328,7 @@ def test_trunk_deploy_on_vm_parent_port(
                                    network_address="10.234.0.0/24", dns_servers=["8.8.8.8", "8.8.4.4"])
 
         os = std::OS(name="cirros", version=0.4, family=std::linux)
-        key = ssh::Key(name="{key_name}", public_key="")
+        key = ssh::Key(name="{key_name}", public_key="{ssh_public_key}")
 
         vm = openstack::VirtualMachine(provider=provider, project=project, key_pair=key, name="{server_name}",
                                        image=openstack::find_image(provider, os),

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.1}/tests/test_vm_boot_nic.py

@@ -157,6 +157,7 @@ def _vm_handler(
         VirtualMachineHandler, project.get_handler(resource, False)
     )
     vm_handler._connection = MagicMock()
+    vm_handler._connection.current_project_id = PROJECT_ID
     vm_handler._connection.identity.find_project.return_value = SimpleNamespace(
         id=PROJECT_ID
     )