Strict project isolation for Nova - Mitaka

aggregate_projects_isolation.py

# All Rights Reserved.
#
#    Licensed under the Apache License, Version 2.0 (the "License"); you may
#    not use this file except in compliance with the License. You may obtain
#    a copy of the License at
#
#         http://www.apache.org/licenses/LICENSE-2.0
#
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#    License for the specific language governing permissions and limitations
#    under the License.

from oslo_config import cfg
from oslo_log import log as logging

from nova.scheduler import filters
from nova.scheduler.filters import utils


LOG = logging.getLogger(__name__)

isolated_opts = [
    cfg.ListOpt('isolated_projects',
                default=[],
                help='Projects to run on isolated host'),
]

CONF = cfg.CONF
CONF.register_opts(isolated_opts)


class AggregateProjectsIsolationFilter(filters.BaseHostFilter):
    """Isolate projects in specific aggregates."""

    # Aggregate data and tenant do not change within a request
    run_filter_once_per_request = True

    def host_passes(self, host_state, spec_obj):
        project_id = spec_obj.project_id

        metadata = utils.aggregate_metadata_get_by_host(
            host_state, key='filter_project_id')

        # If host has filter_project_id part of its aggregate metadatas,
        # it is reserved for those projects.
        if metadata != {}:
            configured_project_ids = metadata.get('filter_project_id')
            if configured_project_ids:
                return project_id in configured_project_ids

        # Host without filter_project_id can only run projects
        # not in the list of isolated project_id.
        return project_id not in CONF.isolated_projects