nova 32.2.0__tar.gz → 32.2.1__tar.gz

{nova-32.2.0 → nova-32.2.1}/.zuul.yaml

@@ -823,8 +823,6 @@
            # common jobs will be enough along with nova functional
            # and unit tests.
            irrelevant-files: *policies-irrelevant-files
-        - grenade-skip-level-always:
-            irrelevant-files: *policies-irrelevant-files
         - nova-grenade-multinode:
             irrelevant-files: *policies-irrelevant-files
         - tempest-ipv6-only:
@@ -857,8 +855,6 @@
               - nova/virt/libvirt/vif.py
         - tempest-integrated-compute:
             irrelevant-files: *policies-irrelevant-files
-        - grenade-skip-level-always:
-            irrelevant-files: *policies-irrelevant-files
         - nova-grenade-multinode:
            irrelevant-files: *policies-irrelevant-files
         - tempest-ipv6-only:

{nova-32.2.0 → nova-32.2.1}/AUTHORS

@@ -945,6 +945,7 @@ Matthew Sherborne <msherborne@gmail.com>
 Matthew Treinish <mtreinish@kortar.org>
 Matthew Treinish <treinish@linux.vnet.ibm.com>
 Mauro S. M. Rodrigues <maurosr@linux.vnet.ibm.com>
+Max Lamprecht <max.lamprecht@stackit.cloud>
 Maxim Monin <maximmonin@gmail.com>
 Maxim Nestratov <mnestratov@parallels.com>
 Maxim Nestratov <mnestratov@virtuozzo.com>
@@ -1600,6 +1601,7 @@ chinmay <chinmaya-bharadwaj.a@hp.com>
 chohoor <chohoor@gmail.com>
 chris fattarsi <chris.fattarsi@pistoncloud.com>
 csatari <gergely.csatari@nokia.com>
+cw0306-lee <cw0306.lee@samsung.com>
 da52700 <li.jingjing3@zte.com.cn>
 daisy-ycguo <daisy.ycguo@gmail.com>
 daisy-ycguo <guoyingc@cn.ibm.com>

{nova-32.2.0 → nova-32.2.1}/ChangeLog

@@ -1,6 +1,16 @@
 CHANGES
 =======
 
+32.2.1
+------
+
+* Strip internal \_nova-prefixed scheduler hints on create
+* [CI][stable-only] Remove grenade-skip-level
+* Fix error when multiple security group in a project with same name
+* Add reproducer test for bug 2105896
+* Fix resize to unpermitted flavors
+* fix: device\_by\_alias should respect config type
+
 32.2.0
 ------
 

{nova-32.2.0/nova.egg-info → nova-32.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nova
-Version: 32.2.0
+Version: 32.2.1
 Summary: Cloud computing fabric controller
 Home-page: https://docs.openstack.org/nova/latest/
 Author: OpenStack

{nova-32.2.0 → nova-32.2.1}/nova/compute/api.py

@@ -2240,6 +2240,10 @@ class API:
                 msg = _('The requested availability zone is not available')
                 raise exception.InvalidRequest(msg)
 
+        if scheduler_hints:
+            scheduler_hints = {k: v for k, v in scheduler_hints.items()
+                               if not k.startswith('_nova')}
+
         filter_properties = scheduler_utils.build_filter_properties(
             scheduler_hints, forced_host, forced_node, flavor)
 
@@ -4248,7 +4252,7 @@ class API:
             new_flavor = current_flavor
         else:
             new_flavor = flavors.get_flavor_by_flavor_id(
-                flavor_id, read_deleted="no")
+                flavor_id, ctxt=context, read_deleted="no")
             # NOTE(wenping): We use this instead of the 'block_accelerator'
             # decorator since the operation can differ depending on args,
             # and for resize we have two flavors to worry about, we should

{nova-32.2.0 → nova-32.2.1}/nova/network/neutron.py

@@ -24,6 +24,8 @@ import inspect
 import time
 import typing as ty
 
+from collections import defaultdict
+
 from keystoneauth1 import loading as ks_loading
 from neutronclient.common import exceptions as neutron_client_exc
 from neutronclient.v2_0 import client as clientv20
@@ -831,12 +833,12 @@ class API:
         :raises nova.exception.SecurityGroupNotFound: If a given security group
             is not found.
         """
-        # Initialize two dictionaries to map security group names and IDs to
-        # their corresponding IDs
-        name_to_id = {}
+        # Map security group names to their IDs (a name can have
+        # multiple IDs since Neutron does not enforce uniqueness)
+        name_to_id = defaultdict(list)
         # NOTE(sean-k-mooney): using a dict here instead of a set is faster
         # probably due to l1 code cache misses due to the introduction
-        # of set lookup in addition to dict lookups making the branch
+        # of set lookups in addition to dict lookups making the branch
         # prediction for the second for loop less reliable.
         id_to_id = {}
 
@@ -844,14 +846,8 @@ class API:
         for user_security_group in user_security_groups:
             name = user_security_group['name']
             sg_id = user_security_group['id']
-
-            # Check for duplicate names and raise an exception if found
-            if name in name_to_id:
-                raise exception.NoUniqueMatch(
-                    _("Multiple security groups found matching"
-                      " '%s'. Use an ID to be more specific.") % name)
-            # Map the name to its corresponding ID
-            name_to_id[name] = sg_id
+            # Append the ID to the list for this name
+            name_to_id[name].append(sg_id)
             # Map the ID to itself for easy lookup
             id_to_id[sg_id] = sg_id
 
@@ -860,16 +856,19 @@ class API:
 
         # Iterate over the requested security groups
         for security_group in security_groups:
-            # Check if the security group is in the name-to-ID dictionary
-            # as if a user names the security group the same as
-            # another's security groups uuid, the name takes priority.
-            if security_group in name_to_id:
-                security_group_ids.append(name_to_id[security_group])
-            # Check if the security group is in the ID-to-ID dictionary
-            elif security_group in id_to_id:
+            # Check UUID first since it is always unique
+            if security_group in id_to_id:
                 security_group_ids.append(id_to_id[security_group])
-            # Raise an exception if the security group is not found in
-            # either dictionary
+            # Then check by name
+            elif security_group in name_to_id:
+                # If there are multiple IDs for this name, raise exception
+                if len(name_to_id[security_group]) > 1:
+                    raise exception.NoUniqueMatch(
+                        _("Multiple security groups found matching"
+                          " '%s'. Use an ID to be more specific.")
+                        % security_group)
+                security_group_ids.append(name_to_id[security_group][0])
+            # Raise an exception if the security group is not found
             else:
                 raise exception.SecurityGroupNotFound(
                     security_group_id=security_group)

{nova-32.2.0 → nova-32.2.1}/nova/tests/functional/test_servers.py

@@ -2090,6 +2090,43 @@ class ServerMovingTests(integrated_helpers.ProviderUsageBaseTestCase):
 
         self._delete_and_check_allocations(server)
 
+    def test_resize_with_private_flavor(self):
+        """Ensure a non-admin user cannot resize to a private flavor that
+        has not been granted access to their project.
+        """
+        source_hostname = self.compute1.host
+
+        server = self._boot_and_check_allocations(
+            self.flavor1, source_hostname)
+
+        # Create a private flavor and grant access to a different project.
+        private_flavor_body = {'flavor': {
+            'name': 'private_flavor',
+            'ram': 1024,
+            'vcpus': 1,
+            'disk': 10,
+            'os-flavor-access:is_public': False,
+        }}
+        private_flavor = self.admin_api.post_flavor(private_flavor_body)
+        self.admin_api.api_post(
+            'flavors/%s/action' % private_flavor['id'],
+            {'addTenantAccess': {'tenant': 'other-project'}})
+
+        # Use a non-admin API client to attempt the resize.
+        non_admin_api = self.api_fixture.api
+        non_admin_api.microversion = self.microversion
+
+        resize_req = {
+            'resize': {
+                'flavorRef': private_flavor['id']
+            }
+        }
+        ex = self.assertRaises(
+            client.OpenStackApiException,
+            non_admin_api.post_server_action,
+            server['id'], resize_req)
+        self.assertEqual(400, ex.response.status_code)
+
     def test_resize_delete_while_verify(self):
         """Test scenario where the server is deleted while in the
         VERIFY_RESIZE state and ensures the allocations are properly

{nova-32.2.0 → nova-32.2.1}/nova/tests/unit/compute/test_api.py

@@ -220,6 +220,24 @@ class _ComputeAPIUnitTestMixIn(object):
         list_obj.obj_reset_changes()
         return list_obj
 
+    @mock.patch('nova.scheduler.utils.build_filter_properties')
+    def test_create_strips_internal_scheduler_hints(self,
+                                                    mock_build_filter):
+        mock_build_filter.side_effect = (
+            test.TestingException('stop early'))
+        flavor = self._create_flavor()
+        self.assertRaises(
+            test.TestingException,
+            self.compute_api.create,
+            self.context, flavor, 'image_id',
+            scheduler_hints={
+                '_nova_check_type': 'rebuild',
+                '_nova_future': 'something',
+                'group': 'valid-group-uuid',
+            })
+        actual_hints = mock_build_filter.call_args[0][0]
+        self.assertEqual({'group': 'valid-group-uuid'}, actual_hints)
+
     @mock.patch(
         'nova.network.neutron.API.is_remote_managed_port',
         new=mock.Mock(return_value=False),
@@ -2172,6 +2190,7 @@ class _ComputeAPIUnitTestMixIn(object):
 
         if flavor_id_passed:
             mock_get_flavor.assert_called_once_with('new-flavor-id',
+                                                    ctxt=self.context,
                                                     read_deleted='no')
 
         if not (flavor_id_passed and same_flavor):
@@ -2380,7 +2399,9 @@ class _ComputeAPIUnitTestMixIn(object):
         self.assertRaises(exception.FlavorNotFound,
                           self.compute_api.resize, self.context,
                           fake_inst, flavor_id='flavor-id')
-        mock_get_flavor.assert_called_once_with('flavor-id', read_deleted='no')
+        mock_get_flavor.assert_called_once_with('flavor-id',
+                                                ctxt=self.context,
+                                                read_deleted='no')
         # Should never reach these.
         mock_count.assert_not_called()
         mock_limit.assert_not_called()
@@ -2413,7 +2434,8 @@ class _ComputeAPIUnitTestMixIn(object):
         self.assertRaises(exception.FlavorMemoryTooSmall,
                           self.compute_api.resize, self.context,
                           fake_inst, flavor_id=new_flavor.id)
-        mock_get_flavor.assert_called_once_with(200, read_deleted='no')
+        mock_get_flavor.assert_called_once_with(200, ctxt=self.context,
+                                                read_deleted='no')
         # Should never reach these.
         mock_count.assert_not_called()
         mock_limit.assert_not_called()
@@ -2441,7 +2463,9 @@ class _ComputeAPIUnitTestMixIn(object):
         self.assertRaises(exception.FlavorNotFound,
                           self.compute_api.resize, self.context,
                           fake_inst, flavor_id='flavor-id')
-        mock_get_flavor.assert_called_once_with('flavor-id', read_deleted='no')
+        mock_get_flavor.assert_called_once_with('flavor-id',
+                                                ctxt=self.context,
+                                                read_deleted='no')
         # Should never reach these.
         mock_count.assert_not_called()
         mock_limit.assert_not_called()
@@ -2540,7 +2564,9 @@ class _ComputeAPIUnitTestMixIn(object):
                           fake_inst, flavor_id='flavor-id')
 
         mock_save.assert_not_called()
-        mock_get_flavor.assert_called_once_with('flavor-id', read_deleted='no')
+        mock_get_flavor.assert_called_once_with('flavor-id',
+                                                ctxt=self.context,
+                                                read_deleted='no')
         mock_upsize.assert_called_once_with(test.MatchType(objects.Flavor),
                                             test.MatchType(objects.Flavor))
         # mock.ANY might be 'instances', 'cores', or 'ram'
@@ -2616,6 +2642,7 @@ class _ComputeAPIUnitTestMixIn(object):
             self.assertEqual('1, 512', e.kwargs['used'])
             self.assertEqual('1, 512', e.kwargs['allowed'])
             mock_get_flavor.assert_called_once_with('fake_flavor_id',
+                                                    ctxt=self.context,
                                                     read_deleted="no")
         else:
             self.fail("Exception not raised")
@@ -2642,6 +2669,7 @@ class _ComputeAPIUnitTestMixIn(object):
                           'fake_flavor_id')
 
         mock_get_flavor.assert_called_once_with('fake_flavor_id',
+                                                ctxt=self.context,
                                                 read_deleted="no")
         mock_enforce.assert_called_once_with(
             self.context, "fake", mock_get_flavor.return_value, False, 1, 1)

{nova-32.2.0 → nova-32.2.1}/nova/tests/unit/network/test_neutron.py

@@ -9433,6 +9433,101 @@ class TestNeutronPortSecurity(test.NoDBTestCase):
             [mock.call(fields=['id', 'name'], tenant_id=uuids.project_id),
              mock.call(fields=['id', 'name'], shared=True)])
 
+    def test__process_security_groups_unique_uuids(self):
+        instance = objects.Instance(project_id=uuids.project_id)
+        mock_neutron = mock.Mock(spec=client.Client)
+        mock_neutron.list_security_groups.side_effect = [
+            {
+                'security_groups': [
+                    {
+                        'id': uuids.sg1,
+                        'name': 'nonunique-name',
+                    }
+                ]
+            },
+            {
+                'security_groups': [
+                    {
+                        'id': uuids.sg2,
+                        'name': 'nonunique-name',
+                    }
+                ]
+            }
+        ]
+        mock_neutron.list_extensions.return_value = {
+            'extensions': [{'alias': constants.SG_SHARED_FILTER}]}
+        api = neutronapi.API()
+
+        # Bug 2105896: it is ok for security groups to have the same
+        # name if we request them by uuid.
+        result = api._process_security_groups(
+            instance, mock_neutron, [uuids.sg1, uuids.sg2])
+
+        self.assertEqual([uuids.sg1, uuids.sg2], result)
+        mock_neutron.list_security_groups.assert_has_calls(
+            [mock.call(fields=['id', 'name'], tenant_id=uuids.project_id),
+             mock.call(fields=['id', 'name'], shared=True)])
+
+    def test__process_security_groups_non_unique_match_same_tenant(self):
+        """Test that duplicate names within the same tenant are handled.
+
+        When two SGs in the same tenant have the same name, requesting
+        by name should raise NoUniqueMatch, but requesting by UUID
+        should succeed.
+        """
+        instance = objects.Instance(project_id=uuids.project_id)
+        mock_neutron = mock.Mock(spec=client.Client)
+        mock_neutron.list_security_groups.return_value = {
+            'security_groups': [
+                {
+                    'id': uuids.sg1,
+                    'name': 'nonunique-name',
+                },
+                {
+                    'id': uuids.sg2,
+                    'name': 'nonunique-name',
+                }
+            ]
+        }
+        mock_neutron.list_extensions.return_value = {
+            'extensions': [{'alias': constants.SG_SHARED_FILTER}]}
+        api = neutronapi.API()
+
+        # Requesting by name should raise NoUniqueMatch
+        ex = self.assertRaises(
+            exception.NoUniqueMatch, api._process_security_groups,
+            instance, mock_neutron, ["nonunique-name"])
+        self.assertIn("nonunique-name", str(ex))
+
+    def test__process_security_groups_unique_uuids_same_tenant(self):
+        """Test that duplicate names within the same tenant are accepted
+        when requested by UUID (bug 2105896).
+        """
+        instance = objects.Instance(project_id=uuids.project_id)
+        mock_neutron = mock.Mock(spec=client.Client)
+        mock_neutron.list_security_groups.return_value = {
+            'security_groups': [
+                {
+                    'id': uuids.sg1,
+                    'name': 'nonunique-name',
+                },
+                {
+                    'id': uuids.sg2,
+                    'name': 'nonunique-name',
+                }
+            ]
+        }
+        mock_neutron.list_extensions.return_value = {
+            'extensions': [{'alias': constants.SG_SHARED_FILTER}]}
+        api = neutronapi.API()
+
+        result = api._process_security_groups(
+            instance, mock_neutron, [uuids.sg1, uuids.sg2])
+        self.assertEqual([uuids.sg1, uuids.sg2], result)
+        # Only one call since both SGs are in the tenant list
+        mock_neutron.list_security_groups.assert_called_once_with(
+            fields=['id', 'name'], tenant_id=uuids.project_id)
+
     @mock.patch.object(neutronapi.API, 'get_instance_nw_info')
     @mock.patch.object(neutronapi.API, '_update_port_dns_name')
     @mock.patch.object(neutronapi.API, '_create_port_minimal')

{nova-32.2.0 → nova-32.2.1}/nova/tests/unit/virt/libvirt/test_guest.py

@@ -351,6 +351,20 @@ class GuestTestCase(test.NoDBTestCase):
 
         self.assertIsNone(self.guest.get_device_by_alias('nope'))
 
+    def test_get_device_by_alias_from_persistent_config(self):
+        with mock.patch.object(self.guest, 'get_all_devices') as mock_get_all:
+            mock_get_all.return_value = []
+
+            self.assertIsNone(self.guest.get_device_by_alias(
+                'qemu-disk1',
+                devtype=vconfig.LibvirtConfigGuestDisk,
+                from_persistent_config=True,
+            ))
+
+            mock_get_all.assert_called_once_with(
+                # check if we're querying the persistent config
+                vconfig.LibvirtConfigGuestDisk, True)
+
     def test_get_devices(self):
         xml = """
 <domain type='qemu'>

{nova-32.2.0 → nova-32.2.1}/nova/virt/libvirt/guest.py

@@ -434,7 +434,7 @@ class Guest(object):
 
     def get_device_by_alias(self, devalias, devtype=None,
                             from_persistent_config=False):
-        for dev in self.get_all_devices(devtype):
+        for dev in self.get_all_devices(devtype, from_persistent_config):
             if hasattr(dev, 'alias') and dev.alias == devalias:
                 return dev
 

{nova-32.2.0 → nova-32.2.1/nova.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nova
-Version: 32.2.0
+Version: 32.2.1
 Summary: Cloud computing fabric controller
 Home-page: https://docs.openstack.org/nova/latest/
 Author: OpenStack

{nova-32.2.0 → nova-32.2.1}/nova.egg-info/SOURCES.txt

@@ -3826,6 +3826,7 @@ releasenotes/notes/bug-2092570-fix-parameter-order-in-add_instance_info_to_node.
 releasenotes/notes/bug-2095364-ffbf67c0ae3f53b5.yaml
 releasenotes/notes/bug-2098496-move-pci-hostdevs-than-requested-0139018213f1be96.yaml
 releasenotes/notes/bug-2100588-fix-image-id-xml-after-unshelve-e5f6116043ba1c41.yaml
+releasenotes/notes/bug-2105896-2bebad3d9eacd346.yaml
 releasenotes/notes/bug-2112187-e1c1d40f090e421b.yaml
 releasenotes/notes/bug-2117170-disable-vmcoreinfo-when-memory-encryption-is-enabled-142e64f6b9ef3135.yaml
 releasenotes/notes/bug-2122036-hypervisor-uptime-performance-optimization-6f3a2c8e5d9b1a4e.yaml

nova-32.2.1/nova.egg-info/pbr.json

@@ -0,0 +1 @@
+{"git_version": "0e969c5246", "is_release": true}

nova-32.2.1/releasenotes/notes/bug-2105896-2bebad3d9eacd346.yaml

@@ -0,0 +1,11 @@
+---
+fixes:
+  - |
+    `Bug #2105896`_: Fix error when multiple security groups in a project
+    share the same name. The security group resolution now checks UUIDs
+    before names, ensuring that a request using a specific UUID is never
+    blocked by a naming collision. When a security group is requested by
+    name and multiple groups share that name, a ``NoUniqueMatch`` error is
+    raised prompting the user to use a UUID instead.
+
+    .. _Bug #2105896: https://launchpad.net/bugs/2105896

nova-32.2.0/nova.egg-info/pbr.json

@@ -1 +0,0 @@
-{"git_version": "47b93bfb93", "is_release": true}