request to create policy rule fails, but after server restart the same request creates policy rule

Bug #1435842 reported by Radek Pospisil
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
congress
Fix Released
Undecided
Unassigned

Bug Description

devstack, congress last commit 92b3acea9ba238b8bc2938115d91ff7c6aef5e64

After some time congress server fails to create new policy.

Steps (I received the same behavior in last two days. Anyway not sure if you will be able to reproduce the defect using these steps):

* create rules in murano_system policy as listed in https://wiki.openstack.org/wiki/PolicyGuidedFulfillmentDemo
* play with Murano to deploy environments as described in the wiki above
* after that create Murano environment with application hello world (in GIT repository referenced in the wiki above)
** Murano env deployment fails because policy rules do not allow it, so I have to add rule to allow hello world application in murano, but It failed with following error
devstack@mydpha061:~$ openstack congress policy rule create murano_system 'allowedApp("io.murano.apps.java.HelloWorld", "demo")'
/usr/local/lib/python2.7/dist-packages/novaclient/v1_1/__init__.py:30: UserWarning: Module novaclient.v1_1 is deprecated (taken as a basis for novaclien t.v2). The preferable way to get client class or object you can find in novaclient.client module.
  warnings.warn("Module novaclient.v1_1 is deprecated (taken as a basis for "
ERROR: openstack Element already exists (HTTP 409) (Request-ID: req-a17a5a88-f3d3-4364-92d6-d6f1169939ba)

** If I restart the congress server, then the same request creates rule.

devstack@mydpha061:~$ openstack congress policy rule create murano_system 'allowedApp("io.murano.apps.java.HelloWorld", "demo")'
/usr/local/lib/python2.7/dist-packages/novaclient/v1_1/__init__.py:30: UserWarning: Module novaclient.v1_1 is deprecated (taken as a basis for novaclien t.v2). The preferable way to get client class or object you can find in novaclient.client module.
  warnings.warn("Module novaclient.v1_1 is deprecated (taken as a basis for "
+---------+------------------------------------------------------+
| Field | Value |
+---------+------------------------------------------------------+
| comment | None |
| id | e18358c5-d373-4160-bf65-cf8d455cdc3f |
| name | None |
| rule | allowedApp("io.murano.apps.java.HelloWorld", "demo") |
+---------+------------------------------------------------------+

In the log, there is an error captured:

2015-03-24 13:24:32.411 15740 DEBUG congress.api.application [req-a17a5a88-f3d3-4364-92d6-d6f1169939ba None] Handling request 'POST /v1/policies/murano_system/rules' with CollectionHandler(/v1/policies/(?P<policy_id>[^/]+)/rules$) __call
2015-03-24 13:24:32.413 15740 DEBUG congress.dse.deepsix [req-a17a5a88-f3d3-4364-92d6-d6f1169939ba None] engine:: process_policy_update [<congress.datalog.compile.Event object at 0x7ff0e48119b0>] log_debug /opt/stack/congress/congress/ds
2015-03-24 13:24:32.417 15740 DEBUG congress.datalog.base [req-a17a5a88-f3d3-4364-92d6-d6f1169939ba None] RT : Updating with <congress.datalog.utility.iterstr object at 0x7ff0de892750> log /opt/stack/congress/congress/datalog/base.py:
2015-03-24 13:24:32.417 15740 DEBUG congress.datalog.base [req-a17a5a88-f3d3-4364-92d6-d6f1169939ba None] muran : update_would_cause_errors <congress.datalog.utility.iterstr object at 0x7ff0de892750> log /opt/stack/congress/congress/data
2015-03-24 13:24:32.418 15740 ERROR congress.api.webservice [req-a17a5a88-f3d3-4364-92d6-d6f1169939ba None] Error occurred
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice Traceback (most recent call last):
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice File "/opt/stack/congress/congress/api/webservice.py", line 392, in create_member
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice item, request.params, id_, context=context)
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice File "/opt/stack/congress/congress/api/rule_model.py", line 128, in add_item
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice changes = self.change_rule(rule, context)
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice File "/opt/stack/congress/congress/api/rule_model.py", line 180, in change_rule
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice (permitted, changes) = self.engine.process_policy_update([event])
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice File "/opt/stack/congress/congress/policy_engines/agnostic.py", line 1199, in process_policy_update
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice result = self.update(events)
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice File "/opt/stack/congress/congress/policy_engines/agnostic.py", line 444, in update
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice return self._update_obj(sequence, target)
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice File "/opt/stack/congress/congress/policy_engines/agnostic.py", line 592, in _update_obj
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice if self.global_dependency_graph.has_cycle():
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice File "/opt/stack/congress/congress/datalog/utility.py", line 233, in has_cycle
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice self.depth_first_search()
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice File "/opt/stack/congress/congress/datalog/utility.py", line 141, in depth_first_search
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice self.dfs(node)
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice File "/opt/stack/congress/congress/datalog/utility.py", line 169, in dfs
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice if self.nodes[edge.node].begin is None:
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice KeyError: u'murano:objects'
2015-03-24 13:24:32.418 15740 TRACE congress.api.webservice
2015-03-24 13:24:32.419 15740 INFO eventlet.wsgi.server [req-a17a5a88-f3d3-4364-92d6-d6f1169939ba None] 16.60.142.48 - - [24/Mar/2015 13:24:32] "POST /v1/policies/murano_system/rules HTTP/1.1" 409 307 0.106381

description: updated
description: updated
description: updated
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to congress (master)

Reviewed: https://review.openstack.org/167824
Committed: https://git.openstack.org/cgit/stackforge/congress/commit/?id=59f95702949108df9553cacc2403a90be1490942
Submitter: Jenkins
Branch: master

commit 59f95702949108df9553cacc2403a90be1490942
Author: Tim Hinrichs <email address hidden>
Date: Wed Mar 25 15:00:59 2015 -0700

    Fix for graph dependency bug

    There were 2 separate, but closely related bugs that caused
    an uncaught exception when checking for cycles through rules
    via the dependency graph computation.

    Bug 1: initialize_tables() doesn't change the dependency graph,
           but update() (i.e. insert/delete/update) does.
    Bug 2: modifying the dependency graph even when the update
           is a noop

    These bugs made it possible to delete a node in the (refcounted
    version of the) dependency graph, even though there was still an
    edge pointing to that node. Running DFS on such a graph causes
    an uncaught exception.

    This change eliminates the bugs and adds tests to catch such
    problems in the future.

    Closes-bug: 1435842
    Change-Id: Ibb0034338d3d2464f0ecf34935c706f51ac44110

Changed in congress:
status: New → Fix Committed
Tim Hinrichs (thinrichs)
Changed in congress:
milestone: none → kilo-3
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.