inmanta-module-openstack 6.1.0__tar.gz → 6.1.2__tar.gz

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: inmanta-module-openstack
-Version: 6.1.0
+Version: 6.1.2
 License: Apache 2.0
 Requires-Dist: inmanta-module-ssh
 Requires-Dist: inmanta-module-std

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.2}/inmanta_module_openstack.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: inmanta-module-openstack
-Version: 6.1.0
+Version: 6.1.2
 License: Apache 2.0
 Requires-Dist: inmanta-module-ssh
 Requires-Dist: inmanta-module-std

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.2}/inmanta_module_openstack.egg-info/SOURCES.txt

@@ -43,20 +43,24 @@ inmanta_plugins/openstack/network/trunk_port.py
 inmanta_plugins/openstack/quota/__init__.py
 inmanta_plugins/openstack/quota/quota.py
 tests/test_block_devices.py
+tests/test_common_base.py
 tests/test_dependency_handling.py
 tests/test_examples.py
 tests/test_flavor.py
 tests/test_host_aggregate.py
 tests/test_image.py
 tests/test_keystone.py
+tests/test_network.py
+tests/test_network_port.py
 tests/test_network_port_fixed_ips.py
-tests/test_network_port_missing_network.py
 tests/test_network_port_security_groups.py
-tests/test_network_port_shared_network.py
-tests/test_neutron.py
 tests/test_nova.py
+tests/test_qos_policy.py
 tests/test_quota.py
+tests/test_router.py
+tests/test_security_group.py
 tests/test_security_group_ethertype.py
 tests/test_server_group.py
+tests/test_subnet.py
 tests/test_trunk.py
 tests/test_vm_boot_nic.py

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.2}/inmanta_plugins/openstack/common/base.py

@@ -175,15 +175,19 @@ class OpenStackHandler(CRUDHandler):
         """
         Retrieve the id of a project based on the given name
         """
+        # A project-scoped token already knows its own project id. Use it before
+        # querying Keystone: non-admin users may be forbidden to get/list projects.
+        current_project_id = self._connection.current_project_id
+        if name == resource.admin_project_name and current_project_id:
+            return current_project_id
+
         project = self._connection.identity.find_project(name)
         if project:
             return project.id
 
         # fallback for non-admins: if we’re scoped to a project and its name matches
-        if self._connection.current_project_id:
-            current = self._connection.identity.get_project(
-                self._connection.current_project_id
-            )
+        if current_project_id:
+            current = self._connection.identity.get_project(current_project_id)
             if current and current.name == name:
                 return current.id
 
@@ -342,19 +346,30 @@ class OpenStackHandler(CRUDHandler):
             return None
         return self._connection.identity.find_domain(domain_name)
 
-    def get_server_by_name(self, name, project_id=None):
+    def get_server_by_name(self, name, project_id=None, all_projects=False):
         """
         Retrieve a server by name
         """
         additional_args = {}
         if project_id is not None:
-            additional_args["all_projects"] = True
             additional_args["project_id"] = project_id
+        if all_projects:
+            additional_args["all_projects"] = True
         # regex for exact match
         servers = self._connection.compute.servers(name=f"^{name}$", **additional_args)
 
         return self.require_single_item(servers)
 
+    def get_project_server(self, resource, name, project_id):
+        """
+        Retrieve a server by name in the project of the resource
+        """
+        # Nova lists only the servers of the token's own project. Servers of another
+        # project need all_projects, the project_id filter is ignored without it.
+        if resource.project == resource.admin_project_name:
+            return self.get_server_by_name(name)
+        return self.get_server_by_name(name, project_id, all_projects=True)
+
     def _get_qos_policy(self, **query_params):
         try:
             policies = self._connection.network.qos_policies(**query_params)

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.2}/inmanta_plugins/openstack/compute/flavor.py

@@ -19,7 +19,7 @@ Contact: code@inmanta.com
 from typing import Any
 
 from inmanta.agent import handler
-from inmanta.agent.handler import ResourcePurged, cache, provider
+from inmanta.agent.handler import ResourcePurged, SkipResource, cache, provider
 from inmanta.resources import resource
 from openstack.compute.v2.flavor import Flavor as SdkFlavor
 
@@ -47,6 +47,7 @@ class Flavor(OpenstackAdminResource):
         "rxtx_factor",
         "is_public",
         "description",
+        "allowed_projects",
         "extra_specs",
     )
     name: str
@@ -60,6 +61,17 @@ class Flavor(OpenstackAdminResource):
     is_public: bool
     description: str | None
     extra_specs: dict[str, Any] | None
+    allowed_projects: list[dict[str, str]]
+
+    @staticmethod
+    def get_allowed_projects(_, obj):
+        return sorted(
+            [
+                {"name": project.name, "domain": project.domain}
+                for project in obj.allowed_projects
+            ],
+            key=lambda project: (project["domain"], project["name"]),
+        )
 
     @staticmethod
     def get_extra_specs(_, obj):
@@ -72,7 +84,7 @@ class Flavor(OpenstackAdminResource):
 class FlavorHandler(OpenStackHandler):
     # Fields Nova can change on an existing flavor. Any other change requires
     # deleting and recreating it.
-    IN_PLACE_FIELDS = {"description", "extra_specs"}
+    IN_PLACE_FIELDS = {"description", "extra_specs", "allowed_projects"}
 
     # Set by read_resource, which raises ResourcePurged when the flavor is gone,
     # so the other handler methods can rely on it being there.
@@ -163,14 +175,17 @@ class FlavorHandler(OpenStackHandler):
         # value in place keeps whatever is on the flavor out of the diff.
         if resource.description is not None:
             resource.description = self.flavor.description or ""
+        resource.allowed_projects = self._current_allowed_projects(resource)
         if resource.extra_specs is not None:
             resource.extra_specs = self.flavor.extra_specs
         self._set_facts(ctx)
 
     def create_resource(self, ctx: handler.HandlerContext, resource: Flavor) -> None:
+        desired_project_ids = self._desired_project_ids(resource)
         self.flavor = self._create_flavor(
             resource, resource.description, resource.extra_specs
         )
+        self._update_allowed_projects(desired_project_ids)
         self._set_facts(ctx)
         ctx.set_created()
 
@@ -187,6 +202,7 @@ class FlavorHandler(OpenStackHandler):
         """Update flavor parameters.
 
         Nova lets us change the description and the extra specs on an existing
+        flavor. Project access can also be reconciled without recreating the
         flavor. The sizing fields are immutable, so a change to any of those is
         applied by deleting the existing flavor and recreating it. That is only
         safe when OpenStack assigns the id: an explicit flavor_id would collide
@@ -196,7 +212,10 @@ class FlavorHandler(OpenStackHandler):
         never updated, and a recreate carries the live values over rather than
         dropping them.
         """
-        if not set(changes) - self.IN_PLACE_FIELDS:
+        recreate_flavor = bool(set(changes) - self.IN_PLACE_FIELDS)
+        desired_project_ids = self._desired_project_ids(resource)
+
+        if not recreate_flavor:
             if "description" in changes:
                 self._connection.compute.update_flavor(
                     self.flavor, description=resource.description
@@ -204,6 +223,8 @@ class FlavorHandler(OpenStackHandler):
             # Unmanaged fields never end up in changes, so both are set here.
             if "extra_specs" in changes and resource.extra_specs is not None:
                 self._update_extra_specs(resource.extra_specs)
+            if "allowed_projects" in changes:
+                self._update_allowed_projects(desired_project_ids)
             ctx.set_updated()
             return
 
@@ -232,9 +253,98 @@ class FlavorHandler(OpenStackHandler):
         )
         self._delete_flavor()
         self.flavor = self._create_flavor(resource, description, extra_specs)
+        self._update_allowed_projects(desired_project_ids)
         self._set_facts(ctx)
         ctx.set_updated()
 
+    def _flavor_accesses(self) -> list[dict[str, str]]:
+        if self.flavor.is_public:
+            return []
+        return list(self._connection.compute.get_flavor_access(self.flavor))
+
+    @staticmethod
+    def _project_id_from_access(access: dict[str, str]) -> str | None:
+        return access.get("tenant_id") or access.get("project_id")
+
+    def _get_project(self, project: dict[str, str]):
+        domain_name = project["domain"]
+        domain = self._connection.identity.find_domain(domain_name)
+        if domain is None:
+            raise SkipResource(f"The domain {domain_name} does not exist.")
+
+        project_name = project["name"]
+        openstack_project = self._connection.identity.find_project(
+            project_name,
+            domain_id=domain.id,
+        )
+        if openstack_project is None:
+            raise SkipResource(
+                f"The project {project_name} does not exist in domain {domain_name}."
+            )
+        return openstack_project
+
+    def _current_allowed_projects(self, resource: Flavor) -> list[dict[str, str]]:
+        if resource.is_public:
+            return []
+
+        projects = []
+        for access in self._flavor_accesses():
+            project_id = self._project_id_from_access(access)
+            if project_id is None:
+                continue
+
+            project = self._connection.identity.find_project(
+                project_id, ignore_missing=True
+            )
+            if project is None:
+                # Nova keeps the access row when the project is deleted in Keystone.
+                # Report it as an unknown grant so the update revokes it.
+                projects.append({"name": project_id, "domain": ""})
+                continue
+            domain = self._connection.identity.find_domain(
+                project.domain_id, ignore_missing=True
+            )
+            projects.append(
+                {"name": project.name, "domain": domain.name if domain else ""}
+            )
+        return sorted(
+            projects, key=lambda project: (project["domain"], project["name"])
+        )
+
+    def _desired_project_ids(self, resource: Flavor) -> set[str]:
+        """Resolve every desired project before touching the flavor, so an
+        unresolvable project skips the resource instead of leaving it half
+        applied (flavor created/recreated but with a partial access list).
+        """
+        if resource.is_public and resource.allowed_projects:
+            raise ValueError(
+                "Project access can only be configured on a private flavor."
+            )
+        return {self._get_project(project).id for project in resource.allowed_projects}
+
+    def _update_allowed_projects(self, desired_project_ids: set[str]) -> None:
+        current_project_ids = {
+            project_id
+            for access in self._flavor_accesses()
+            if (project_id := self._project_id_from_access(access)) is not None
+        }
+
+        for project_id in desired_project_ids - current_project_ids:
+            if hasattr(self._connection.compute, "flavor_add_tenant_access"):
+                self._connection.compute.flavor_add_tenant_access(
+                    self.flavor, project_id
+                )
+            else:
+                self._connection.compute.add_flavor_access(self.flavor, project_id)
+
+        for project_id in current_project_ids - desired_project_ids:
+            if hasattr(self._connection.compute, "flavor_remove_tenant_access"):
+                self._connection.compute.flavor_remove_tenant_access(
+                    self.flavor, project_id
+                )
+            else:
+                self._connection.compute.remove_flavor_access(self.flavor, project_id)
+
     def _set_facts(self, ctx):
         ctx.set_fact("flavor_id", self.flavor.id)
         ctx.set_fact("is_disabled", str(self.flavor.is_disabled))

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.2}/inmanta_plugins/openstack/compute/virtual_machine.py

@@ -17,7 +17,7 @@ Contact: code@inmanta.com
 """
 
 import time
-import traceback
+from collections.abc import Callable
 from typing import Any
 
 from inmanta import ast
@@ -30,7 +30,7 @@ from inmanta.agent.handler import (
 )
 from inmanta.execute import proxy
 from inmanta.resources import resource
-from openstack.exceptions import NotFoundException, ResourceFailure, ResourceTimeout
+from openstack.exceptions import NotFoundException
 
 from inmanta_plugins.openstack.common.base import (
     NotUniqueException,
@@ -191,17 +191,15 @@ class VirtualMachine(OpenstackResource):
 
 @provider("openstack::VirtualMachine", name="openstack")
 class VirtualMachineHandler(OpenStackHandler):
-    @cache(timeout=1, cache_none=False)
     def _get_server(self, ctx, resource):
         project_id = self.get_project_id(resource, resource.project)
-        server = self.get_server_by_name(resource.name, project_id)
-        if resource.project != resource.admin_project_name:
-            ctx.exception(
-                f"Unable to retrieve server list with a scoped login on project {resource.admin_project_name}, "
-                f"for project {resource.project}. This only works with admin credentials.",
-                traceback=traceback.format_exc(),
+        server = self.get_project_server(resource, resource.name, project_id)
+        if server is None:
+            ctx.debug(
+                "No server named %(name)s found in project %(project)s.",
+                name=resource.name,
+                project=resource.project,
             )
-            return None
         return server
 
     @cache(timeout=10, cache_none=False)
@@ -298,21 +296,18 @@ class VirtualMachineHandler(OpenStackHandler):
             self._connection.compute.create_keypair(**keypair_args)
             ctx.info(f"Created a new keypair with name {resource.key_name}")
 
-    def _server_with_name_exists(self, resource):
-        project_id = self.get_project_id(resource, resource.project)
-        server = self.get_server_by_name(resource.name, project_id)
-        return server is not None
+    def _bound_ports(self) -> list:
+        """Ports that are still bound to self.server."""
+        return list(self._connection.network.ports(device_id=self.server.id))
 
-    def _raise_server_error(self, ctx: HandlerContext, log_message: str) -> None:
-        """Re-fetch self.server, log its Nova fault, and raise.
+    def _raise_server_error(
+        self, ctx: HandlerContext, server: Any, log_message: str
+    ) -> None:
+        """Log the Nova fault of `server` and raise.
 
-        Used both when a server is found in ERROR state by read_resource and
-        when it transitions to ERROR during a build. Re-fetching is necessary
-        because the list API used by get_server_by_name may omit the fault body.
         The ERROR-state server must be deleted (manually or via purge) before
         Inmanta will attempt to recreate it.
         """
-        server = self._connection.compute.get_server(self.server.id)
         fault = getattr(server, "fault", None) or {}
         msg = fault.get("message", "unknown error")
         details = fault.get("details", "")
@@ -320,12 +315,42 @@ class VirtualMachineHandler(OpenStackHandler):
             log_message,
             fault_message=msg,
             fault_details=details,
-            server_id=self.server.id,
+            server_id=server.id,
         )
         raise Exception(
-            f"Server {self.server.id} ({self.server.name}) is in ERROR state: {msg}"
+            f"Server {server.id} ({server.name}) is in ERROR state: {msg}"
         ) from None
 
+    def _poll_server(self, ctx: HandlerContext, operation: str) -> Any:
+        """Fetch self.server by id, None when it is not found.
+
+        Raises when Nova left it in ERROR state. An ERROR server that still has
+        a task state is left alone, Nova is still working on it.
+        """
+        try:
+            server = self._connection.compute.get_server(self.server.id)
+        except NotFoundException:
+            return None
+        if server.status == "ERROR" and not server.task_state:
+            self._raise_server_error(
+                ctx, server, f"VM entered ERROR state during {operation}"
+            )
+        return server
+
+    def _wait_until(
+        self, condition: Callable[[], bool], timeout: int, interval: int = 2
+    ) -> bool:
+        """Poll `condition` every `interval` seconds until it returns True.
+
+        Returns False when `timeout` seconds pass before the condition is met.
+        """
+        deadline = time.monotonic() + timeout
+        while not condition():
+            if time.monotonic() >= deadline:
+                return False
+            time.sleep(interval)
+        return True
+
     def _wait_for_status(
         self,
         ctx: HandlerContext,
@@ -339,40 +364,31 @@ class VirtualMachineHandler(OpenStackHandler):
         and is only used to build the error messages.
 
         Nova may briefly return a 404 for the instance while a resize is being
-        applied; such transient NotFoundException errors are tolerated and polling
-        resumes until the status is reached or the timeout elapses.
+        applied, this is treated as not ready yet.
         """
-        deadline = time.monotonic() + timeout
-        while True:
-            remaining = deadline - time.monotonic()
-            if remaining <= 0:
-                self._raise_status_timeout(ctx, status, timeout)
-            try:
-                self.server = self._connection.compute.wait_for_server(
-                    self.server, status=status, wait=max(1, int(remaining))
-                )
-                return
-            except ResourceFailure:
-                self._raise_server_error(
-                    ctx, f"VM entered ERROR state during {operation}"
-                )
-            except ResourceTimeout:
-                self._raise_status_timeout(ctx, status, timeout)
-            except NotFoundException:
-                # The instance is temporarily not retrievable (e.g. mid-resize);
-                # give it a moment and keep polling until the deadline.
-                time.sleep(2)
+
+        def has_status() -> bool:
+            server = self._poll_server(ctx, operation)
+            if server is None:
+                return False
+            self.server = server
+            return server.status == status
+
+        if not self._wait_until(has_status, timeout):
+            self._raise_status_timeout(ctx, status, operation, timeout)
 
     def _raise_status_timeout(
-        self, ctx: HandlerContext, status: str, timeout: int
+        self, ctx: HandlerContext, status: str, operation: str, timeout: int
     ) -> None:
-        try:
-            server = self._connection.compute.get_server(self.server.id)
-            current_status = getattr(server, "status", "unknown")
-            task_state = getattr(server, "task_state", "unknown")
-        except NotFoundException:
+        # Fetch again so the error shows the state at timeout, not the last
+        # successful poll.
+        server = self._poll_server(ctx, operation)
+        if server is None:
             current_status = "not_found"
             task_state = "unknown"
+        else:
+            current_status = server.status
+            task_state = server.task_state
         ctx.error(
             f"Timed out waiting for VM to reach {status}",
             timeout_seconds=timeout,
@@ -385,6 +401,27 @@ class VirtualMachineHandler(OpenStackHandler):
             f"(status={current_status}, task_state={task_state})"
         ) from None
 
+    def _raise_ports_timeout(self, ctx: HandlerContext, timeout: int) -> None:
+        ports = [
+            {
+                "id": port.id,
+                "name": port.name,
+                "status": port.status,
+                "device_owner": port.device_owner,
+            }
+            for port in self._bound_ports()
+        ]
+        ctx.error(
+            "Timed out waiting for the ports of the deleted VM to be released",
+            timeout_seconds=timeout,
+            ports=ports,
+            server_id=self.server.id,
+        )
+        raise Exception(
+            f"Server {self.server.id} is deleted but its ports are still bound after "
+            f"{timeout}s: {', '.join(port['id'] for port in ports)}"
+        ) from None
+
     def _get_server_flavor_name(self, server) -> str:
         """Return the flavor name of `server`.
 
@@ -436,14 +473,24 @@ class VirtualMachineHandler(OpenStackHandler):
         """
         This method will check what the status of the give resource is on
         openstack.
+
+        A server in ERROR state raises, unless it is being deleted or purged.
         """
         self.server = self._get_server(ctx, resource)
         if self.server is None:
             raise ResourcePurged()
 
-        if self.server.status == "ERROR":
+        # A server that is being deleted, or that is to be purged, goes away anyway.
+        if (
+            self.server.status == "ERROR"
+            and self.server.task_state != "deleting"
+            and not resource.purged
+        ):
             self._raise_server_error(
-                ctx, "Server is in ERROR state; delete it to allow redeployment"
+                ctx,
+                self.server,
+                "Server is in ERROR state. Please check the OpenStack console for details. "
+                "Deployment cannot continue, please repair the server manually!",
             )
 
         resource.purged = False
@@ -497,6 +544,8 @@ class VirtualMachineHandler(OpenStackHandler):
             metadata=resource.metadata,
             files=resource.personality,
         )
+        # With block devices the boot disk, and its image, come from the mapping.
+        # image_id is only for booting from an image on local disk.
         if resource.block_devices:
             args["block_device_mapping_v2"] = list(resource.block_devices)
         else:
@@ -527,32 +576,36 @@ class VirtualMachineHandler(OpenStackHandler):
 
     def delete_resource(self, ctx: HandlerContext, resource: VirtualMachine) -> None:
         self._connection.compute.delete_server(self.server, ignore_missing=True)
+        timeout = 120
 
-        def is_server_deletion_finished() -> bool:
-            ports = list(self._connection.network.ports(device_id=self.server.id))
-            if ports:
-                return False
-            return self._get_server(ctx, resource) is None
+        def is_server_deleted() -> bool:
+            return self._poll_server(ctx, "delete") is None
 
-        # Wait until the server has been deleted
-        count = 0
-        ctx.info("Waiting until server is deleted.")
-        while not is_server_deletion_finished() and count < 60:
-            time.sleep(1)
-            count += 1
+        # Nova releases the ports after the server is gone. A port that is still
+        # bound cannot be reused by a new server or by the NetworkPort handler.
+        def are_ports_released() -> bool:
+            return not self._bound_ports()
 
-        if count >= 60:
-            ctx.warning("Delete still in progress, giving up waiting.")
+        ctx.info("Waiting until server is deleted.")
+        if not self._wait_until(is_server_deleted, timeout):
+            self._raise_status_timeout(ctx, "DELETED", "delete", timeout)
+        if not self._wait_until(are_ports_released, timeout):
+            self._raise_ports_timeout(ctx, timeout)
 
+        ctx.info("Server was deleted.")
         ctx.set_purged()
 
     def update_resource(
         self, ctx: HandlerContext, changes: dict, resource: VirtualMachine
     ) -> None:
-
+        # read_resource lets through an ERROR server that is being deleted.
         if self.server.status == "ERROR":
             self._raise_server_error(
-                ctx, "Server is in ERROR state; delete it to allow redeployment"
+                ctx,
+                self.server,
+                "Server is in ERROR state, thus cannot be updated. "
+                "Please check the OpenStack console for details. "
+                "Deployment cannot continue, please repair the server manually!",
             )
 
         self.validate_allowed_fields(
@@ -580,7 +633,6 @@ class VirtualMachineHandler(OpenStackHandler):
                     self.server, remove_rule
                 )
 
-        self.server = self._get_server(ctx, resource)
         ctx.set_updated()
 
     def _set_facts(self, ctx):

{inmanta_module_openstack-6.1.0 → inmanta_module_openstack-6.1.2}/inmanta_plugins/openstack/model/_init.cf

@@ -173,8 +173,8 @@ entity GroupRole extends OpenStackResource:
     """
     string role
     string group_name
-    string group_domain="Default"
-    string domain=""
+    string group_domain = "Default"
+    string? domain = null
 end
 index GroupRole(project, group_name, group_domain, role, domain)
 
@@ -865,6 +865,7 @@ entity Flavor extends OpenStackResource:
         :attr description: A free-form description of the flavor. Unlike the other
             attributes, this one can be updated in place, without recreating the flavor.
             Leave it null to not manage the description at all.
+        :attr allowed_projects: Projects that can access this flavor when is_public is false
         :attr extra_specs: Set extra specs on a flavor. See https://docs.openstack.org/nova/rocky/admin/flavors.html
             This set is managed exhaustively: a spec present on the flavor but absent
             here is removed, so the default of an empty dict clears every spec. Set it
@@ -887,6 +888,38 @@ end
 
 implement Flavor using providerRequire
 
+Flavor.allowed_projects [0:] -- Project.allowed_flavors [0:]
+"""
+:rel allowed_projects: The projects that may use this flavor. Only meaningful when
+    ``is_public`` is false; setting it on a public flavor is an error, since Nova has
+    no access list for public flavors. The list is managed exhaustively: a grant on
+    the flavor but absent here is revoked, so the default of an empty relation clears
+    every grant.
+"""
+
+implementation flavorProjectAccessDependencies for Flavor:
+    for project in self.allowed_projects:
+        std::assert(
+            project.provider == self.provider,
+            "Flavor '{{name}}' is on provider '{{provider.name}}' but allowed project '{{project.name}}' is on another provider."
+        )
+        if not self.purged and not project.purged:
+            self.requires += project
+        end
+    end
+end
+
+implement Flavor using flavorProjectAccessDependencies
+
+implementation flavorProjectAccessOnPrivateOnly for Flavor:
+    std::assert(
+        self.is_public == false or std::count(self.allowed_projects) == 0,
+        "Flavor '{{name}}' is public, so it cannot have allowed_projects: Nova has no access list for public flavors."
+    )
+end
+
+implement Flavor using flavorProjectAccessOnPrivateOnly
+
 index HostAggregateMetadata(provider, aggregate, key)
 HostAggregateMetadata.provider [1] -- Provider.host_aggregate_metadata [0:]
 entity HostAggregateMetadata extends OpenStackResource: