Synchronise wallaby with upstream

nova/network/neutron.py

@@ -3567,7 +3567,7 @@ def get_segment_ids_for_network(
         if not self._has_segment_extension(context):
             return []
 
-        client = get_client(context)
+        client = get_client(context, admin=True)
         try:
             # NOTE(sbauza): We can't use list_segments() directly because the
             # API is borked and returns both segments but also segmentation IDs
@@ -3579,7 +3579,7 @@ def get_segment_ids_for_network(
                 'Failed to get segment IDs for network %s' % network_id) from e
         # The segment field of an unconfigured subnet could be None
         return [subnet['segment_id'] for subnet in subnets
-                                     if subnet['segment_id'] is not None]
+                                     if subnet.get('segment_id') is not None]
 
     def get_segment_id_for_subnet(
         self,
@@ -3597,7 +3597,7 @@ def get_segment_id_for_subnet(
         if not self._has_segment_extension(context):
             return None
 
-        client = get_client(context)
+        client = get_client(context, admin=True)
         try:
             subnet = client.show_subnet(subnet_id)['subnet']
         except neutron_client_exc.NeutronClientException as e:

nova/tests/unit/network/test_neutron.py

@@ -6323,11 +6323,12 @@ def test_get_segment_ids_for_network_passes(self, mock_client):
             res = self.api.get_segment_ids_for_network(
                 self.context, uuids.network_id)
         self.assertEqual([uuids.segment_id], res)
+        mock_client.assert_called_once_with(self.context, admin=True)
         mocked_client.list_subnets.assert_called_once_with(
             network_id=uuids.network_id, fields='segment_id')
 
     @mock.patch.object(neutronapi, 'get_client')
-    def test_get_segment_ids_for_network_with_no_segments(self, mock_client):
+    def test_get_segment_ids_for_network_with_segments_none(self, mock_client):
         subnets = {'subnets': [{'segment_id': None}]}
         mocked_client = mock.create_autospec(client.Client)
         mock_client.return_value = mocked_client
@@ -6338,6 +6339,23 @@ def test_get_segment_ids_for_network_with_no_segments(self, mock_client):
             res = self.api.get_segment_ids_for_network(
                 self.context, uuids.network_id)
         self.assertEqual([], res)
+        mock_client.assert_called_once_with(self.context, admin=True)
+        mocked_client.list_subnets.assert_called_once_with(
+            network_id=uuids.network_id, fields='segment_id')
+
+    @mock.patch.object(neutronapi, 'get_client')
+    def test_get_segment_ids_for_network_with_no_segments(self, mock_client):
+        subnets = {'subnets': [{}]}
+        mocked_client = mock.create_autospec(client.Client)
+        mock_client.return_value = mocked_client
+        mocked_client.list_subnets.return_value = subnets
+        with mock.patch.object(
+            self.api, '_has_segment_extension', return_value=True,
+        ):
+            res = self.api.get_segment_ids_for_network(
+                self.context, uuids.network_id)
+        self.assertEqual([], res)
+        mock_client.assert_called_once_with(self.context, admin=True)
         mocked_client.list_subnets.assert_called_once_with(
             network_id=uuids.network_id, fields='segment_id')
 
@@ -6353,6 +6371,7 @@ def test_get_segment_ids_for_network_fails(self, mock_client):
             self.assertRaises(exception.InvalidRoutedNetworkConfiguration,
                               self.api.get_segment_ids_for_network,
                               self.context, uuids.network_id)
+            mock_client.assert_called_once_with(self.context, admin=True)
 
     def test_get_segment_id_for_subnet_no_segment_ext(self):
         with mock.patch.object(
@@ -6374,6 +6393,7 @@ def test_get_segment_id_for_subnet_passes(self, mock_client):
             res = self.api.get_segment_id_for_subnet(
                 self.context, uuids.subnet_id)
         self.assertEqual(uuids.segment_id, res)
+        mock_client.assert_called_once_with(self.context, admin=True)
         mocked_client.show_subnet.assert_called_once_with(uuids.subnet_id)
 
     @mock.patch.object(neutronapi, 'get_client')
@@ -6388,6 +6408,7 @@ def test_get_segment_id_for_subnet_with_no_segment(self, mock_client):
             self.assertIsNone(
                 self.api.get_segment_id_for_subnet(self.context,
                                                    uuids.subnet_id))
+            mock_client.assert_called_once_with(self.context, admin=True)
 
     @mock.patch.object(neutronapi, 'get_client')
     def test_get_segment_id_for_subnet_fails(self, mock_client):
@@ -6401,6 +6422,7 @@ def test_get_segment_id_for_subnet_fails(self, mock_client):
             self.assertRaises(exception.InvalidRoutedNetworkConfiguration,
                               self.api.get_segment_id_for_subnet,
                               self.context, uuids.subnet_id)
+            mock_client.assert_called_once_with(self.context, admin=True)
 
     @mock.patch.object(neutronapi.LOG, 'debug')
     def test_get_port_pci_slot(self, mock_debug):

releasenotes/notes/bug-1970383-segment-scheduling-permissions-92ba907b10a9eb1c.yaml

@@ -0,0 +1,7 @@
+---
+fixes:
+  - |
+    `Bug #1970383 <https://bugs.launchpad.net/nova/+bug/1970383>`_: Fixes a
+    permissions error when using the
+    'query_placement_for_routed_network_aggregates' scheduler variable, which
+    caused a traceback on instance creation for non-admin users.