Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix metric aggregates as non-admin #1441

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

Callum027
Copy link
Contributor

When using the aggregates API with a metric ID, the RBAC policy project_id:%(resource.project_id)s" fails to authenticate a non-admin user that is part of the project the metric is also part of via its resource relationship.

This patch fixes two issues preventing this from working:

  • Set details=True when listing specified metrics to ensure the joined load with the Metric and Resource models is done.
  • Add support for processing oslo.db SQLAlchemy models in gnocchi.rest.api.flatten_dict_to_keypairs to make sure nested attributes are added to the list of targets passed to the policy enforcer.

@Callum027 Callum027 force-pushed the fix-metric-aggregates-nonadmin branch 3 times, most recently from 37bda98 to fac64a4 Compare February 11, 2025 07:30
@Callum027
Copy link
Contributor Author

Seems like the GitHub Actions runners are having issues.

       Exception in thread Thread-2 (thread_compiler):
      Traceback (most recent call last):
        File "/usr/lib/python3.12/threading.py", line 1073, in _bootstrap_inner
          self.run()
        File "/usr/lib/python3.12/threading.py", line 1010, in run
          self._target(*self._args, **self._kwargs)
        File "/tmp/pip-install-nqpvtzih/uwsgi_8ef73bf3d5474636b57bf345332b6745/uwsgiconfig.py", line 116, in thread_compiler
          ret = subprocess.call(cmdline, shell=True)
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        File "/usr/lib/python3.12/subprocess.py", line 389, in call
          with Popen(*popenargs, **kwargs) as p:
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^
        File "/usr/lib/python3.12/subprocess.py", line 1026, in __init__
          self._execute_child(args, executable, preexec_fn, close_fds,
        File "/usr/lib/python3.12/subprocess.py", line 1955, in _execute_child
          raise child_exception_type(errno_num, err_msg, err_filename)
      OSError: [Errno 14] Bad address: '/bin/sh'

When using the aggregates API with a metric ID, the RBAC policy
`project_id:%(resource.project_id)s"` fails to authenticate a
non-admin user that is part of the project the metric is also
part of via its resource relationship.

This patch fixes two issues preventing this from working:

* Set `details=True` when listing specified metrics to ensure
  the joined load with the `Metric` and `Resource` models is done.
* Add support for processing oslo.db SQLAlchemy models in
  `gnocchi.rest.api.flatten_dict_to_keypairs` to make sure nested
  attributes are added to the list of targets passed to the
  policy enforcer.
@Callum027 Callum027 force-pushed the fix-metric-aggregates-nonadmin branch from fac64a4 to dfe176b Compare February 11, 2025 07:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants