StackStorm / StackStorm/st2

st2client error when installing pack with a restricted user

Open
#5,303 20 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

stale
Dominant language
Python
Stars
6.5k
Forks
787
No merged PRs in 30d

Description

SUMMARY

I have a restricted user that should only have permissions to install packs. The pack install works fine but the client returns a python error

Traceback (most recent call last):
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2client/shell.py", line 408, in run
    func(args)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2client/commands/resource.py", line 48, in decorate
    return func(*args, **kwargs)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2client/commands/pack.py", line 274, in run_and_print
    packs = instance.result['output']['packs_list']
AttributeError: 'Execution' object has no attribute 'result'

If I do the install with an admin level user everything is fine. The other issue here is that the pack gets installed just fine. The API logs has no errors and produces a 200 response (I do not have it in debug mode).

image

STACKSTORM VERSION

Paste the output of st2 --version: st2 3.4.1, on Python 3.6.8

OS, environment, install method

Post what OS you are running this on, along with any other relevant information/

  • OL7
  • HA install with a controller node running web, redis, rabbitmq, and mongo and 2 cluster nodes running everything else.

Steps to reproduce the problem

Create a user with the following role and install a pack:

name: pack_management
description: Allows a user to install, register, and modify packs only
permission_grants:
  -
    permission_types:
       - "pack_list"
       - "pack_install"
       - "pack_uninstall"
       - "pack_create"
       - "pack_register"
       - "pack_config"
       - "pack_search"
       - "runner_type_list"
  -
    resource_uid: "action:packs:install"
    permission_types:
       - "action_execute"
       - "action_view"
  -
    resource_uid: "action:packs:uninstall"
    permission_types:
       - "action_execute"
       - "action_view"
  -
    resource_uid: "action:packs:delete"
    permission_types:
       - "action_execute"
       - "action_view"
  -
    resource_uid: "action:packs:setup_virtualenv"
    permission_types:
       - "action_execute"
       - "action_view"
  -
    resource_uid: "action:packs:get"
    permission_types:
       - "action_execute"
       - "action_view"
  -
    resource_uid: "action:packs:get_config"
    permission_types:
       - "action_execute"
       - "action_view"
  -
    resource_uid: "action:packs:get_pack_dependencies"
    permission_types:
       - "action_execute"
       - "action_view"
  -
    resource_uid: "action:packs:get_pack_warnings"
    permission_types:
       - "action_execute"
       - "action_view"
  -
    resource_uid: "action:packs:download"
    permission_types:
       - "action_execute"
       - "action_view"
  -
    resource_uid: "action:packs:show"
    permission_types:
       - "action_execute"
       - "action_view"
  -
    resource_uid: "action:packs:unload"
    permission_types:
       - "action_execute"
       - "action_view"
  -
    resource_uid: "action:packs:update_virtualenv"
    permission_types:
       - "action_execute"
       - "action_view"
  -
    resource_uid: "action:packs:virtualenv_prerun"
    permission_types:
       - "action_execute"
       - "action_view"

Expected Results

While the package does in fact get installed, the output should reflect it:

<redacted-admin-user>@<redacted> ~ $ st2 pack install bitbucket

For the "bitbucket" pack, the following content will be registered:

actions   |  16
rules     |  1
sensors   |  1
aliases   |  0
triggers  |  0

Installation may take a while for packs with many items.

        [ succeeded ] init_task
        [ succeeded ] download_pack
        [ succeeded ] make_a_prerun
        [ succeeded ] get_pack_dependencies
        [ succeeded ] check_dependency_and_conflict_list
        [ succeeded ] install_pack_requirements
        [ succeeded ] get_pack_warnings
        [ succeeded ] register_pack

+-------------+-----------------------------------------------+
| Property    | Value                                         |
+-------------+-----------------------------------------------+
| ref         | bitbucket                                     |
| name        | bitbucket                                     |
| description | Pack which allows integration with Bitbucket. |
| version     | 1.0.1                                         |
| author      | Aamir                                         |
+-------------+-----------------------------------------------+

Actual Results

While the package does in fact get installed there's a python error for a missing attribute on an object.

Here is the full output of st2client in debug:

<redacted>@<redacted> ~ $ st2 --debug pack install bitbucket
/opt/stackstorm/st2/lib/python3.6/site-packages/urllib3/connectionpool.py:988: InsecureRequestWarning: Unverified HTTPS request is being made to host '<redacted>'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
  InsecureRequestWarning,
# -------- begin 139988789087704 request ----------
curl -X POST -H  'User-Agent: python-requests/2.23.0' -H  'Accept-Encoding: gzip, deflate' -H  'Accept: */*' -H  'Connection: keep-alive' -H  'St2-Api-Key: <redacted>' -H  'content-type: application/json' -H  'Content-Length: 21' --data-binary '{"pack": "bitbucket"}' https://<redacted>/api/v1/packs/index/search
# -------- begin 139988789087704 response ----------
{
    "author": "Aamir",
    "content": {
        "actions": {
            "count": 16,
            "resources": [
                "archive_repo",
                "associate_ssh_key",
                "create_issue",
                "create_repo",
                "create_service",
                "delete_issues",
                "delete_repo",
                "delete_services",
                "delete_ssh_key",
                "list_branches",
                "list_issues",
                "list_repos",
                "list_services",
                "list_ssh_keys",
                "update_issue",
                "update_service"
            ]
        },
        "rules": {
            "count": 1,
            "resources": [
                "post_receive_webhook"
            ]
        },
        "sensors": {
            "count": 1,
            "resources": [
                "RepositorySensor"
            ]
        },
        "tests": {
            "count": 1,
            "resources": [
                "test_repository_sensor.py"
            ]
        }
    },
    "contributors": [
        "Edward Medvedev <edward.medvedev@gmail.com>",
        "Hiroyasu OHYAMA <user.localhost2000@gmail.com>"
    ],
    "description": "Pack which allows integration with Bitbucket.",
    "email": "raza.aamir01@gmail.com",
    "keywords": [
        "bitbucket",
        "vcs",
        "mercurial",
        "git",
        "source control"
    ],
    "name": "bitbucket",
    "python_versions": [
        "3"
    ],
    "ref": "bitbucket",
    "repo_url": "https://github.com/StackStorm-Exchange/stackstorm-bitbucket",
    "stackstorm_version": ">=2.1.0",
    "version": "1.0.1",
    "versions": [
        "1.0.1",
        "1.0.0",
        "0.6.0",
        "0.5.5",
        "0.5.4",
        "0.5.3",
        "0.5.2",
        "0.5.1",
        "0.5.0",
        "0.4.0",
        "0.3.0",
        "0.1.1",
        "0.1.0"
    ]
}
# -------- end 139988789087704 response ------------


For the "bitbucket" pack, the following content will be registered:

actions   |  16
rules     |  1
sensors   |  1
aliases   |  0
triggers  |  0

Installation may take a while for packs with many items.
/opt/stackstorm/st2/lib/python3.6/site-packages/urllib3/connectionpool.py:988: InsecureRequestWarning: Unverified HTTPS request is being made to host '<redacted>'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
  InsecureRequestWarning,
# -------- begin 139988789087704 request ----------
curl -X POST -H  'User-Agent: python-requests/2.23.0' -H  'Accept-Encoding: gzip, deflate' -H  'Accept: */*' -H  'Connection: keep-alive' -H  'St2-Api-Key: <redacted>' -H  'content-type: application/json' -H  'Content-Length: 68' --data-binary '{"packs": ["bitbucket"], "force": false, "skip_dependencies": false}' https://<redacted>/api/v1/packs/install
# -------- begin 139988789087704 response ----------
{
    "execution_id": "60ef415ea91f4aa725e83776"
}
# -------- end 139988789087704 response ------------

/opt/stackstorm/st2/lib/python3.6/site-packages/urllib3/connectionpool.py:988: InsecureRequestWarning: Unverified HTTPS request is being made to host '<redacted>'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
  InsecureRequestWarning,
# -------- begin 139988789087480 request ----------
curl -X GET -H  'User-Agent: python-requests/2.23.0' -H  'Accept-Encoding: gzip, deflate' -H  'Accept: */*' -H  'Connection: keep-alive' -H  'St2-Api-Key: <redacted>' https://<redacted>/api/v1/executions/60ef415ea91f4aa725e83776
# -------- begin 139988789087480 response ----------
{
    "action": {
        "tags": [],
        "uid": "action:packs:install",
        "metadata_file": "actions/install.meta.yaml",
        "name": "install",
        "ref": "packs.install",
        "description": "Installs or upgrades a pack into local content repository, either by git URL or a short name matching an index entry. Will download pack, load the actions, sensors and rules from the pack. Note that install requires reboot of some st2 services.",
        "enabled": true,
        "entry_point": "workflows/install.yaml",
        "pack": "packs",
        "runner_type": "orquesta",
        "parameters": {
            "packs": {
                "type": "array",
                "items": {
                    "type": "string"
                },
                "required": true,
                "description": "Name of the pack in Exchange or a git repo URL."
            },
            "register": {
                "type": "string",
                "default": "all",
                "description": "Possible options are all, sensors, actions, rules, aliases, runners, triggers, rule_types, policiy_types, policies, configs."
            },
            "env": {
                "type": "object",
                "description": "Optional environment variables.",
                "required": false
            },
            "force": {
                "type": "boolean",
                "description": "Set to True to force install the pack and skip StackStorm version compatibility check and also delete and ignore lock file if one exists.",
                "required": false,
                "default": false
            },
            "skip_dependencies": {
                "type": "boolean",
                "description": "Set to True to skip pack dependency installations.",
                "required": false,
                "default": false
            },
            "timeout": {
                "default": 600,
                "required": false,
                "description": "Action timeout in seconds. Action will get killed if it doesn't finish in timeout",
                "type": "integer"
            }
        },
        "output_schema": {},
        "notify": {},
        "id": "60d1fe29f25c6f0e9fae68bb"
    },
    "runner": {
        "name": "orquesta",
        "description": "A runner for executing orquesta workflow.",
        "uid": "runner_type:orquesta",
        "enabled": true,
        "runner_package": "orquesta_runner",
        "runner_module": "orquesta_runner",
        "runner_parameters": {
            "notify": {
                "type": "array",
                "description": "List of tasks to trigger notifications for.",
                "uniqueItems": true,
                "items": {
                    "type": "string",
                    "minLength": 1,
                    "pattern": "^\\w+$"
                },
                "default": []
            }
        },
        "output_key": "output",
        "output_schema": {
            "errors": {
                "anyOf": [
                    {
                        "type": "object"
                    },
                    {
                        "type": "array"
                    }
                ]
            },
            "output": {
                "anyOf": [
                    {
                        "type": "object"
                    },
                    {
                        "type": "string"
                    },
                    {
                        "type": "integer"
                    },
                    {
                        "type": "number"
                    },
                    {
                        "type": "boolean"
                    },
                    {
                        "type": "array"
                    },
                    {
                        "type": "null"
                    }
                ]
            }
        },
        "id": "60cbaf90fdedc9dd45b59894"
    },
    "liveaction": {
        "action": "packs.install",
        "action_is_workflow": true,
        "parameters": {
            "packs": [
                "bitbucket"
            ]
        },
        "callback": {},
        "runner_info": {},
        "id": "60ef415ea91f4aa725e83775"
    },
    "status": "requested",
    "start_timestamp": "2021-07-14T19:56:14.808247Z",
    "parameters": {
        "packs": [
            "bitbucket"
        ]
    },
    "context": {
        "user": "<redacted-limted-user>",
        "pack": "packs",
        "rbac": {
            "user": "<redacted-limted-user>",
            "roles": [
                "pack_management"
            ]
        }
    },
    "log": [
        {
            "timestamp": "2021-07-14T19:56:14.000000Z",
            "status": "requested"
        }
    ],
    "web_url": "https://<redacted>/#/history/60ef415ea91f4aa725e83776/general",
    "id": "60ef415ea91f4aa725e83776"
}
# -------- end 139988789087480 response ------------

ERROR: 'Execution' object has no attribute 'result'

CLI settings:
----------------
Config file path: /home/st2/.st2/config
Client settings:
----------------
ST2_BASE_URL: https://<redacted>
ST2_AUTH_URL: https://<redacted>/auth/v1
ST2_API_URL: https://<redacted>/api/v1
ST2_STREAM_URL: https://<redacted>/stream/v1
ST2_AUTH_TOKEN: None

Proxy settings:
---------------
HTTP_PROXY:
HTTPS_PROXY:

Traceback (most recent call last):
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2client/shell.py", line 408, in run
    func(args)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2client/commands/resource.py", line 48, in decorate
    return func(*args, **kwargs)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2client/commands/pack.py", line 274, in run_and_print
    packs = instance.result['output']['packs_list']
AttributeError: 'Execution' object has no attribute 'result'

Thanks!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in st2client/commands/pack.py at run_and_print, where the missing result attribute is accessed, and review the execution response shown in the debug output. Reproduce the install with the restricted pack_management role and compare it with an admin install. Done means the pack still installs and st2client prints the expected installation result without an AttributeError.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.