Allow managers to request host placement#14
Conversation
Project managers need to request a specific compute host while still letting Nova run scheduler filters. Grant only the requested-destination server create policy. Ordinary create and start permissions remain covered by Nova defaults.
|
@JohnGarbutt Heads up on this one 🙏 |
| from oslo_policy import policy | ||
| from unikorn_openstack_policy import base | ||
|
|
||
| SERVER_CREATE_REQUESTED_DESTINATION = 'compute:servers:create:requested_destination' |
There was a problem hiding this comment.
annoyingly, I think we need forced_host instead:
https://github.com/openstack/nova/blob/74094a8e8afaec3eb89c43df3b16d093d8ee9f91/nova/api/openstack/compute/servers.py#L791
There was a problem hiding this comment.
Ah, wait a second, this is a question, requested_destination would be better, what API call are we making?
There was a problem hiding this comment.
I asked the machine about that and it was very confident that requested_destination was the right way to do it 🤖
Shall I just do both :-)
There was a problem hiding this comment.
The region service uses hypervisor_hostname in the compute create request -- should it do something different?
Reservation needs project managers to use Nova's legacy forced-host create policy for the same scoped placement flow already allowed through requested_destination. Granting that override keeps explicit host placement usable while preserving the inherited Nova admin behavior.
|
Apologues John, it's the "require rebasing; invalidate reviews when rebased" combo. |
2 participants
Project managers need to request a specific compute host while still letting Nova run scheduler filters. Nova checks the policy
requested_destinationwhen a server creation request specifies the host: this is how nscaledev/uni-region#488 gives the UNI region service the ability to boot specific machines.Ordinary create (also checked by Nova) and start permissions remain covered by Nova defaults.