[SRU] Backport Fix barbican client with application credentials/trusts to Ussuri/Victoria

Bug #2035180 reported by David Negreira
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Ubuntu Cloud Archive
Fix Released
Undecided
Unassigned
Ussuri
Triaged
Medium
Unassigned
Victoria
Triaged
Medium
Unassigned
Wallaby
Triaged
Medium
Unassigned
octavia (Ubuntu)
Fix Released
Undecided
Unassigned
Focal
Incomplete
Medium
David Negreira

Bug Description

[Impact]

* Users cannot add an HTTPS endpoint with octavia/barbican when using application credentials (it returns http error 500).

[Test Case]

* Full details of commands in comment #10, summary below.
* Add a user in a project
* Add the admin role to the user in the project
* Create application credentials
* Create a barbican certificate store
* Create octavia loadbalancer and listener with the application credentials

[Where problems could occur]

 * Users might not be able to create load balancers or attach a listener to a load balancer.

[Other Info]

 * Original story: https://storyboard.openstack.org/#!/story/2007619
 * Upstream fix and backports: https://review.opendev.org/q/Id77ce36f59b71d309f153e5c1d44059f162ee440
 * Current upstream fix for octavia/Ussuri: https://review.opendev.org/c/openstack/octavia/+/894548
 * Current upstream fix for octavia/Victoria:https://review.opendev.org/c/openstack/octavia/+/894547

Tags: patch
no longer affects: octavia
no longer affects: octavia (Ubuntu)
description: updated
Revision history for this message
Edward Hope-Morley (hopem) wrote :

this is just a placeholder atm until the upstream backports are merged

Revision history for this message
David Negreira (dnegreira) wrote :
Revision history for this message
David Negreira (dnegreira) wrote :
Revision history for this message
David Negreira (dnegreira) wrote :

The upstream fixes have been merged, and this is now ready to be reviewed.

I have attached the following debdiffs:

* lp2035180-octavia-focal.debdiff - Ubuntu Focal
* lp2035180-octavia-bionic-ussuri.debdiff - UCA Bionic-Ussuri
* lp2035180-octavia-focal-victoria.debdiff - UCA Focal-Victoria

Revision history for this message
David Negreira (dnegreira) wrote :
Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "lp2035180-octavia-focal.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

tags: added: patch
Revision history for this message
Mauricio Faria de Oliveira (mfo) wrote :

Duplicating the contents from pastebin for documentation purposes.
Please always use comments/attachments (in case external links break in the future, but this needs to be revisited/reviewed; e.g., when analyzing regressions or related work :)

Revision history for this message
Mauricio Faria de Oliveira (mfo) wrote :
Download full text (14.3 KiB)

(originally in https://pastebin.ubuntu.com/p/458fsc9ffz/ )

ubuntu@dnegreira-bastion:~/stsstack-bundles/openstack$ openstack project list
+----------------------------------+----------+
| ID | Name |
+----------------------------------+----------+
| 424d928b34b640e0a36a8a2e3fdc6f09 | demo |
| 507dbc22af73459b853e3766c35c8b64 | admin |
| cab27753566d42029be264f36ba2b8e4 | admin |
| d212590292cf4a60b445c6d6343ccfbc | services |
| ec0fb8a582714d54aaa71fef843e1dea | alt_demo |
| fe131c6831fc477ea15e27d46c28fe2f | services |
+----------------------------------+----------+
ubuntu@dnegreira-bastion:~/stsstack-bundles/openstack$ openstack domain list
+----------------------------------+----------------+---------+--------------------+
| ID | Name | Enabled | Description |
+----------------------------------+----------------+---------+--------------------+
| 201b2ebc79db4c73bf5e72b548327830 | service_domain | True | Created by Juju |
| 9a9ba9e3fb704f24a45098c605f6b4fb | admin_domain | True | Created by Juju |
| default | Default | True | The default domain |
+-------------------...

description: updated
description: updated
description: updated
Revision history for this message
Mauricio Faria de Oliveira (mfo) wrote :

Hey David,

Thanks for the patches and SRU template, it looks good and to the point.

1) I'd just suggest to add more detail to 'Where problems could occur section'
(e.g., why is that a possible regression, and if there are other cases where
it wouldn't apply, say http only, or if a workaround is available if needed).

Regarding the debdiffs and .patch files -- mostly good too! Just a few points:

2) The version increment in Ubuntu stable releases is almost always '0.1'
(vs. '1' in Ubuntu development releases), see guide in [1].
For the Cloud Archive, the number in the ~cloudX suffix is incremented
(with '1' instead of '0.1' now :) instead of another ubuntuX(.Y) scheme at the end).

3) Some of the changelogs have an extra empty line before the signature.
Ah, and you may set TZ= for dch to pick up your timezone if you want.)
Bug number and patch file name format look good!

4) The git commit/patch format provides most fields (see Standard Fields in DEP3 [2];
e.g., Description/Subject, Origin/Author/From, Bug-Ubuntu), and only 'Origin:' and
'Bug-Ubuntu:' are usually required for Ubuntu SRUs, in addition.

Origin: ideally points to the commit merged upstream (instead of a review/issue/pr),
and has the 'backport' keyword (vs. 'upstream') only if changes were needed for the
patch to apply in the Ubuntu package (instead of whether the upstream commit itself
is a backport of an upstream change introduced in later versions).

Thanks again,
Mauricio

[1] https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Update_the_packaging
[2] https://dep-team.pages.debian.net/deps/dep3/

Changed in octavia (Ubuntu Focal):
status: New → Incomplete
importance: Undecided → Medium
assignee: nobody → David Negreira (dnegreira)
Revision history for this message
Mauricio Faria de Oliveira (mfo) wrote :

Ah, it would be nice to note in Impact and/or Other Info (depending on the level of detail) in which version in Ubuntu the fix is introduced (i.e., so we can mark the devel release task as Fix Released) -- in this case it seems to be Jammy, but having it documented is great! Thanks.

Changed in cloud-archive:
status: New → Fix Released
Changed in octavia (Ubuntu):
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.