EC2 API supports deprecated authorize and revoke methods, and not recommended methods

Bug #704645 reported by Ryan Lane
20
This bug affects 3 people
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Fix Released
Medium
John Tran

Bug Description

The recommended method of authorizing and revoking security group rules, as defined here:

http://docs.amazonwebservices.com/AWSSDKforPHP/latest/#m=AmazonEC2/revoke_security_group_ingress

specifies an IpPermissions data structure should be used. The EC2 API in Nova does not support this.

Related branches

Revision history for this message
Thierry Carrez (ttx) wrote :

I think it matches what Boto 1.9 uses, which is apparently not the latest.

Changed in nova:
importance: Undecided → Low
status: New → Confirmed
Revision history for this message
Thierry Carrez (ttx) wrote :

Though it apparently still matches what Amazon recommends to do:
http://docs.amazonwebservices.com/AWSEC2/latest/UserGuide/index.html?using-network-security.html

Revision history for this message
Ryan Lane (rlane) wrote :

I love how that method is deprecated, but they still recommend its use.

I guess I'll keep this low priority in my attempts to add support.

Revision history for this message
Bernhard M. Wiedemann (ubuntubmw) wrote :

boto-2.0b4 no more works with nova-api since
boto commit e94096d7aeb803ea69947fd722ce4ca2aa969cff
Author: Mitch Garnaat <email address hidden>
Date: Tue Nov 16 08:39:47 2010 -0500

nova/api.log has
(nova.api): TRACE: File "/usr/lib64/python2.6/site-packages/nova/api/ec2/cloud.py", line 473, in authorize_security_group_ingress
(nova.api): TRACE: values = self._revoke_rule_args_to_dict(context, **kwargs)
(nova.api): TRACE: TypeError: _revoke_rule_args_to_dict() got an unexpected keyword argument 'ip_permissions'

euca-authorize -P tcp -p 22 default
just writes
UnknownError: An unknown error has occurred. Please try your request again.

Revision history for this message
Thierry Carrez (ttx) wrote :

Raising importance

Changed in nova:
importance: Low → Medium
John Tran (jtran)
Changed in nova:
assignee: nobody → John Tran (jtran)
Revision history for this message
John Tran (jtran) wrote :

euca2ools also depends on boto , so if you upgrade boto to any variant of 2.0x, that changes the authorize and revoke methods to use the IpPermissions data structure upon submission.

Bernhard, therefore your euca2ools will work if you revert back to boto1.9x.

Thierry, I'm playing w/ the nova api code so that it supports the IpPermissions, however, should I keep in consideration for the methods to be backwards compatible w/ the deprecated data structure? If I make the method only support the IpPermission structure, that means anyone w/ boto1.9 will have problems.

Revision history for this message
John Tran (jtran) wrote :

I've submitted a blueprint to propose upgrading to boto2.0x. https://blueprints.launchpad.net/nova/+spec/upgrade-to-boto2.0

John Tran (jtran)
Changed in nova:
assignee: John Tran (jtran) → nobody
Revision history for this message
John Tran (jtran) wrote :

I thought about this again , and considered that since the eucatools I was testing against nova was on the same box, I made the wrong assumption that boto needed to be upgraded on the nova side but I understand now that the boto upgrade only affects the client. I've created a branch that modifies the authorize & revoke ingress methods to accomodate either the deprecated method of params or the new aws spec'd method.

Changed in nova:
assignee: nobody → John Tran (jtran)
status: Confirmed → In Progress
Revision history for this message
Dave Walker (davewalker) wrote :

@John, It surely does need to be upgraded on the nova side for the test suite to pass?

Thanks.

Revision history for this message
John Tran (jtran) wrote :

Dave, it shouldn't need to upgrade boto on the nova side.

Thierry Carrez (ttx)
Changed in nova:
milestone: none → diablo-3
status: In Progress → Fix Committed
Thierry Carrez (ttx)
Changed in nova:
milestone: diablo-3 → 2011.3
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.