{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/2573","repository_url":"https://api.github.com/repos/ansible/ansible-modules-core","labels_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/2573/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/2573/comments","events_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/2573/events","html_url":"https://github.com/ansible/ansible-modules-core/issues/2573","id":119156320,"number":2573,"title":"OpenStack modules: os_router fails where quantum succeeds","user":{"login":"suonto","id":6807917,"avatar_url":"https://avatars.githubusercontent.com/u/6807917?v=3","gravatar_id":"","url":"https://api.github.com/users/suonto","html_url":"https://github.com/suonto","followers_url":"https://api.github.com/users/suonto/followers","following_url":"https://api.github.com/users/suonto/following{/other_user}","gists_url":"https://api.github.com/users/suonto/gists{/gist_id}","starred_url":"https://api.github.com/users/suonto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/suonto/subscriptions","organizations_url":"https://api.github.com/users/suonto/orgs","repos_url":"https://api.github.com/users/suonto/repos","events_url":"https://api.github.com/users/suonto/events{/privacy}","received_events_url":"https://api.github.com/users/suonto/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ansible/ansible-modules-core/labels/bug_report","name":"bug_report","color":"fbca04"},{"url":"https://api.github.com/repos/ansible/ansible-modules-core/labels/cloud","name":"cloud","color":"c7def8"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-11-27T09:01:50Z","updated_at":"2016-03-21T20:08:01Z","closed_at":"2016-03-21T20:08:01Z","body":"**os_router module fails to do, what is possible with quantum_router_gateway module.**\r\n\r\nThe error is POLICY_UNALLOWED. Furthermore, I believe the **root of the issue is** that you are passing enable_snat value always, which is neither required for the operation nor allowed for non-admin users. You may want to look at this heat issue: https://bugs.launchpad.net/heat/+bug/1306593.\r\n The rule causing this issue is probably:\r\n\"create_router:external_gateway_info:enable_snat\": \"rule:admin_only\"\r\nAlso, I hope you are not apssing external_fixed_ips if it is empty, because it leads to a similar issue:\r\n\"create_router:external_gateway_info:external_fixed_ips\": \"rule:admin_only\".\r\n\r\nThis code works:\r\n\r\n    - name: Create router\r\n      tags: router\r\n      os_router:\r\n        state: present\r\n        name: auto-router\r\n        auth:\r\n          auth_url: \"{{ auth_url }}\"\r\n          username: \"{{ username }}\"\r\n          password: \"{{ password }}\"\r\n          project_name: \"{{ project_name }}\"\r\n        interfaces:\r\n          - auto-subnet\r\n        endpoint_type: internal\r\n\r\n    - name: Attach gateway\r\n      tags: gateway\r\n      quantum_router_gateway:\r\n        state: present\r\n        router_name: auto-router\r\n        auth_url: \"{{ auth_url }}\"\r\n        login_username: \"{{ username }}\"\r\n        login_password: \"{{ password }}\"\r\n        login_tenant_name: \"{{ project_name }}\"\r\n        network_name: ext-net\r\n\r\nThis does not work:\r\n\r\n    - name: Create router\r\n      tags: router\r\n      os_router:\r\n        state: present\r\n        name: auto-router\r\n        auth:\r\n          auth_url: \"{{ auth_url }}\"\r\n          username: \"{{ username }}\"\r\n          password: \"{{ password }}\"\r\n          project_name: \"{{ project_name }}\"\r\n        # POLICY NOT ALLOWED ERROR FROM NEXT LINE\r\n        network: \"{{ ext-net-id }}\"\r\n        interfaces:\r\n          - auto-subnet\r\n        endpoint_type: internal\r\n\r\nPOLICY (taken from here: https://github.com/openstack/neutron/blob/stable/liberty/etc/policy.json):\r\n\r\n    {\r\n        \"context_is_admin\":  \"role:admin\",\r\n        \"owner\": \"tenant_id:%(tenant_id)s\",\r\n        \"admin_or_owner\": \"rule:context_is_admin or rule:owner\",\r\n        \"context_is_advsvc\":  \"role:advsvc\",\r\n        \"admin_or_network_owner\": \"rule:context_is_admin or tenant_id:%(network:tenant_id)s\",\r\n        \"admin_owner_or_network_owner\": \"rule:admin_or_network_owner or rule:owner\",\r\n        \"admin_only\": \"rule:context_is_admin\",\r\n        \"regular_user\": \"\",\r\n        \"shared\": \"field:networks:shared=True\",\r\n        \"shared_firewalls\": \"field:firewalls:shared=True\",\r\n        \"shared_firewall_policies\": \"field:firewall_policies:shared=True\",\r\n        \"shared_subnetpools\": \"field:subnetpools:shared=True\",\r\n        \"shared_address_scopes\": \"field:address_scopes:shared=True\",\r\n        \"external\": \"field:networks:router:external=True\",\r\n        \"default\": \"rule:admin_or_owner\",\r\n\r\n        \"create_subnet\": \"rule:admin_or_network_owner\",\r\n        \"get_subnet\": \"rule:admin_or_owner or rule:shared\",\r\n        \"update_subnet\": \"rule:admin_or_network_owner\",\r\n        \"delete_subnet\": \"rule:admin_or_network_owner\",\r\n\r\n        \"create_subnetpool\": \"\",\r\n        \"create_subnetpool:shared\": \"rule:admin_only\",\r\n        \"get_subnetpool\": \"rule:admin_or_owner or rule:shared_subnetpools\",\r\n        \"update_subnetpool\": \"rule:admin_or_owner\",\r\n        \"delete_subnetpool\": \"rule:admin_or_owner\",\r\n\r\n        \"create_address_scope\": \"\",\r\n        \"create_address_scope:shared\": \"rule:admin_only\",\r\n        \"get_address_scope\": \"rule:admin_or_owner or rule:shared_address_scopes\",\r\n        \"update_address_scope\": \"rule:admin_or_owner\",\r\n        \"update_address_scope:shared\": \"rule:admin_only\",\r\n        \"delete_address_scope\": \"rule:admin_or_owner\",\r\n\r\n        \"create_network\": \"\",\r\n        \"get_network\": \"rule:admin_or_owner or rule:shared or rule:external or rule:context_is_advsvc\",\r\n        \"get_network:router:external\": \"rule:regular_user\",\r\n        \"get_network:segments\": \"rule:admin_only\",\r\n        \"get_network:provider:network_type\": \"rule:admin_only\",\r\n        \"get_network:provider:physical_network\": \"rule:admin_only\",\r\n        \"get_network:provider:segmentation_id\": \"rule:admin_only\",\r\n        \"get_network:queue_id\": \"rule:admin_only\",\r\n        \"create_network:shared\": \"rule:admin_only\",\r\n        \"create_network:router:external\": \"rule:admin_only\",\r\n        \"create_network:segments\": \"rule:admin_only\",\r\n        \"create_network:provider:network_type\": \"rule:admin_only\",\r\n        \"create_network:provider:physical_network\": \"rule:admin_only\",\r\n        \"create_network:provider:segmentation_id\": \"rule:admin_only\",\r\n        \"update_network\": \"rule:admin_or_owner\",\r\n        \"update_network:segments\": \"rule:admin_only\",\r\n        \"update_network:shared\": \"rule:admin_only\",\r\n        \"update_network:provider:network_type\": \"rule:admin_only\",\r\n        \"update_network:provider:physical_network\": \"rule:admin_only\",\r\n        \"update_network:provider:segmentation_id\": \"rule:admin_only\",\r\n        \"update_network:router:external\": \"rule:admin_only\",\r\n        \"delete_network\": \"rule:admin_or_owner\",\r\n\r\n        \"network_device\": \"field:port:device_owner=~^network:\",\r\n        \"create_port\": \"\",\r\n        \"create_port:device_owner\": \"not rule:network_device or rule:admin_or_network_owner or rule:context_is_advsvc\",\r\n        \"create_port:mac_address\": \"rule:admin_or_network_owner or rule:context_is_advsvc\",\r\n        \"create_port:fixed_ips\": \"rule:admin_or_network_owner or rule:context_is_advsvc\",\r\n        \"create_port:port_security_enabled\": \"rule:admin_or_network_owner or rule:context_is_advsvc\",\r\n        \"create_port:binding:host_id\": \"rule:admin_only\",\r\n        \"create_port:binding:profile\": \"rule:admin_only\",\r\n        \"create_port:mac_learning_enabled\": \"rule:admin_or_network_owner or rule:context_is_advsvc\",\r\n        \"create_port:allowed_address_pairs\": \"rule:admin_or_network_owner\",\r\n        \"get_port\": \"rule:admin_owner_or_network_owner or rule:context_is_advsvc\",\r\n        \"get_port:queue_id\": \"rule:admin_only\",\r\n        \"get_port:binding:vif_type\": \"rule:admin_only\",\r\n        \"get_port:binding:vif_details\": \"rule:admin_only\",\r\n        \"get_port:binding:host_id\": \"rule:admin_only\",\r\n        \"get_port:binding:profile\": \"rule:admin_only\",\r\n        \"update_port\": \"rule:admin_or_owner or rule:context_is_advsvc\",\r\n        \"update_port:device_owner\": \"not rule:network_device or rule:admin_or_network_owner or rule:context_is_advsvc\",\r\n        \"update_port:mac_address\": \"rule:admin_only or rule:context_is_advsvc\",\r\n        \"update_port:fixed_ips\": \"rule:admin_or_network_owner or rule:context_is_advsvc\",\r\n        \"update_port:port_security_enabled\": \"rule:admin_or_network_owner or rule:context_is_advsvc\",\r\n        \"update_port:binding:host_id\": \"rule:admin_only\",\r\n        \"update_port:binding:profile\": \"rule:admin_only\",\r\n        \"update_port:mac_learning_enabled\": \"rule:admin_or_network_owner or rule:context_is_advsvc\",\r\n        \"update_port:allowed_address_pairs\": \"rule:admin_or_network_owner\",\r\n        \"delete_port\": \"rule:admin_owner_or_network_owner or rule:context_is_advsvc\",\r\n\r\n        \"get_router:ha\": \"rule:admin_only\",\r\n        \"create_router\": \"rule:regular_user\",\r\n        \"create_router:external_gateway_info:enable_snat\": \"rule:admin_only\",\r\n        \"create_router:distributed\": \"rule:admin_only\",\r\n        \"create_router:ha\": \"rule:admin_only\",\r\n        \"get_router\": \"rule:admin_or_owner\",\r\n        \"get_router:distributed\": \"rule:admin_only\",\r\n        \"update_router:external_gateway_info:enable_snat\": \"rule:admin_only\",\r\n        \"update_router:distributed\": \"rule:admin_only\",\r\n        \"update_router:ha\": \"rule:admin_only\",\r\n        \"delete_router\": \"rule:admin_or_owner\",\r\n\r\n        \"add_router_interface\": \"rule:admin_or_owner\",\r\n        \"remove_router_interface\": \"rule:admin_or_owner\",\r\n\r\n        \"create_router:external_gateway_info:external_fixed_ips\": \"rule:admin_only\",\r\n        \"update_router:external_gateway_info:external_fixed_ips\": \"rule:admin_only\",\r\n\r\n        \"create_firewall\": \"\",\r\n        \"get_firewall\": \"rule:admin_or_owner\",\r\n        \"create_firewall:shared\": \"rule:admin_only\",\r\n        \"get_firewall:shared\": \"rule:admin_only\",\r\n        \"update_firewall\": \"rule:admin_or_owner\",\r\n        \"update_firewall:shared\": \"rule:admin_only\",\r\n        \"delete_firewall\": \"rule:admin_or_owner\",\r\n\r\n        \"create_firewall_policy\": \"\",\r\n        \"get_firewall_policy\": \"rule:admin_or_owner or rule:shared_firewall_policies\",\r\n        \"create_firewall_policy:shared\": \"rule:admin_or_owner\",\r\n        \"update_firewall_policy\": \"rule:admin_or_owner\",\r\n        \"delete_firewall_policy\": \"rule:admin_or_owner\",\r\n\r\n        \"insert_rule\": \"rule:admin_or_owner\",\r\n        \"remove_rule\": \"rule:admin_or_owner\",\r\n\r\n        \"create_firewall_rule\": \"\",\r\n        \"get_firewall_rule\": \"rule:admin_or_owner or rule:shared_firewalls\",\r\n        \"update_firewall_rule\": \"rule:admin_or_owner\",\r\n        \"delete_firewall_rule\": \"rule:admin_or_owner\",\r\n\r\n        \"create_qos_queue\": \"rule:admin_only\",\r\n        \"get_qos_queue\": \"rule:admin_only\",\r\n\r\n        \"update_agent\": \"rule:admin_only\",\r\n        \"delete_agent\": \"rule:admin_only\",\r\n        \"get_agent\": \"rule:admin_only\",\r\n\r\n        \"create_dhcp-network\": \"rule:admin_only\",\r\n        \"delete_dhcp-network\": \"rule:admin_only\",\r\n        \"get_dhcp-networks\": \"rule:admin_only\",\r\n        \"create_l3-router\": \"rule:admin_only\",\r\n        \"delete_l3-router\": \"rule:admin_only\",\r\n        \"get_l3-routers\": \"rule:admin_only\",\r\n        \"get_dhcp-agents\": \"rule:admin_only\",\r\n        \"get_l3-agents\": \"rule:admin_only\",\r\n        \"get_loadbalancer-agent\": \"rule:admin_only\",\r\n        \"get_loadbalancer-pools\": \"rule:admin_only\",\r\n        \"get_agent-loadbalancers\": \"rule:admin_only\",\r\n        \"get_loadbalancer-hosting-agent\": \"rule:admin_only\",\r\n\r\n        \"create_floatingip\": \"rule:regular_user\",\r\n        \"create_floatingip:floating_ip_address\": \"rule:admin_only\",\r\n        \"update_floatingip\": \"rule:admin_or_owner\",\r\n        \"delete_floatingip\": \"rule:admin_or_owner\",\r\n        \"get_floatingip\": \"rule:admin_or_owner\",\r\n\r\n        \"create_network_profile\": \"rule:admin_only\",\r\n        \"update_network_profile\": \"rule:admin_only\",\r\n        \"delete_network_profile\": \"rule:admin_only\",\r\n        \"get_network_profiles\": \"\",\r\n        \"get_network_profile\": \"\",\r\n        \"update_policy_profiles\": \"rule:admin_only\",\r\n        \"get_policy_profiles\": \"\",\r\n        \"get_policy_profile\": \"\",\r\n\r\n        \"create_metering_label\": \"rule:admin_only\",\r\n        \"delete_metering_label\": \"rule:admin_only\",\r\n        \"get_metering_label\": \"rule:admin_only\",\r\n\r\n        \"create_metering_label_rule\": \"rule:admin_only\",\r\n        \"delete_metering_label_rule\": \"rule:admin_only\",\r\n        \"get_metering_label_rule\": \"rule:admin_only\",\r\n\r\n        \"get_service_provider\": \"rule:regular_user\",\r\n        \"get_lsn\": \"rule:admin_only\",\r\n        \"create_lsn\": \"rule:admin_only\",\r\n\r\n        \"create_flavor\": \"rule:admin_only\",\r\n        \"update_flavor\": \"rule:admin_only\",\r\n        \"delete_flavor\": \"rule:admin_only\",\r\n        \"get_flavors\": \"rule:regular_user\",\r\n        \"get_flavor\": \"rule:regular_user\",\r\n        \"create_service_profile\": \"rule:admin_only\",\r\n        \"update_service_profile\": \"rule:admin_only\",\r\n        \"delete_service_profile\": \"rule:admin_only\",\r\n        \"get_service_profiles\": \"rule:admin_only\",\r\n        \"get_service_profile\": \"rule:admin_only\",\r\n\r\n        \"get_policy\": \"rule:regular_user\",\r\n        \"create_policy\": \"rule:admin_only\",\r\n        \"update_policy\": \"rule:admin_only\",\r\n        \"delete_policy\": \"rule:admin_only\",\r\n        \"get_policy_bandwidth_limit_rule\": \"rule:regular_user\",\r\n        \"create_policy_bandwidth_limit_rule\": \"rule:admin_only\",\r\n        \"delete_policy_bandwidth_limit_rule\": \"rule:admin_only\",\r\n        \"update_policy_bandwidth_limit_rule\": \"rule:admin_only\",\r\n        \"get_rule_type\": \"rule:regular_user\",\r\n\r\n        \"restrict_wildcard\": \"(not field:rbac_policy:target_tenant=*) or rule:admin_only\",\r\n        \"create_rbac_policy\": \"\",\r\n        \"create_rbac_policy:target_tenant\": \"rule:restrict_wildcard\",\r\n        \"update_rbac_policy\": \"rule:admin_or_owner\",\r\n        \"update_rbac_policy:target_tenant\": \"rule:restrict_wildcard and rule:admin_or_owner\",\r\n        \"get_rbac_policy\": \"rule:admin_or_owner\",\r\n        \"delete_rbac_policy\": \"rule:admin_or_owner\"\r\n    }\r\n    "},"comment":{"url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/comments/199453525","html_url":"https://github.com/ansible/ansible-modules-core/issues/2573#issuecomment-199453525","issue_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/2573","id":199453525,"user":{"login":"Shrews","id":925883,"avatar_url":"https://avatars.githubusercontent.com/u/925883?v=3","gravatar_id":"","url":"https://api.github.com/users/Shrews","html_url":"https://github.com/Shrews","followers_url":"https://api.github.com/users/Shrews/followers","following_url":"https://api.github.com/users/Shrews/following{/other_user}","gists_url":"https://api.github.com/users/Shrews/gists{/gist_id}","starred_url":"https://api.github.com/users/Shrews/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Shrews/subscriptions","organizations_url":"https://api.github.com/users/Shrews/orgs","repos_url":"https://api.github.com/users/Shrews/repos","events_url":"https://api.github.com/users/Shrews/events{/privacy}","received_events_url":"https://api.github.com/users/Shrews/received_events","type":"User","site_admin":false},"created_at":"2016-03-21T20:08:01Z","updated_at":"2016-03-21T20:08:01Z","body":"Not sure why this one wasn't closed earlier, but since the enable_snat issue was fixed long ago, I believe it fixes this issue (as it did the duplicate), and am properly closing this now."}}