Fix deletion of floating IPs with managed DNS records

Neutron's Designate external DNS driver does not pass
edit_managed=True when constructing the admin designateclient.
When a floating IP has associated managed DNS records in
Designate, deleting the floating IP fails with HTTP 500 because
Designate rejects the deletion with "Managed records may not be
deleted".

Pass edit_managed=True only to the admin_client, which has admin
credentials and passes Designate's edit_managed_records policy
check. The regular user client must not set this flag because
Designate requires SYSTEM_ADMIN role for it. For forward DNS
deletion of managed records, fall back to admin_client when the
user client gets a BadRequest from Designate.

Closes-Bug: #2149807
Assisted-By: Claude Code 4.6 Opus
Change-Id: Iedf0f26708560fe063a71925d5d39542ca181154
Signed-off-by: Omer <oschwart@redhat.com>
(cherry picked from commit 44d061a)

Author: oschwart

neutron/services/externaldns/drivers/designate/driver.py

@@ -46,7 +46,8 @@ def get_clients(context):
     client = d_client.Client(session=_SESSION, auth=auth)
     admin_auth = loading.load_auth_from_conf_options(CONF, 'designate')
     admin_client = d_client.Client(session=_SESSION, auth=admin_auth,
-                                   endpoint_override=CONF.designate.url)
+                                   endpoint_override=CONF.designate.url,
+                                   edit_managed=True)
     return client, admin_client
 
 
@@ -149,7 +150,12 @@ def delete_record_set(self, context, dns_domain, dns_name, records):
                     dns_name, dns_domain), records, client)
 
         for _id in ids_to_delete:
-            client.recordsets.delete(dns_domain, _id)
+            # Try user client first: admin_client can't see user-owned zones.
+            # Fall back to admin_client for managed records (edit_managed).
+            try:
+                client.recordsets.delete(dns_domain, _id)
+            except d_exc.BadRequest:
+                admin_client.recordsets.delete(dns_domain, _id)
         if not CONF.designate.allow_reverse_dns_lookup:
             return
 

neutron/tests/unit/services/externaldns/drivers/designate/test_driver.py

@@ -314,6 +314,51 @@ def test_delete_record_set_zone_not_found(self):
             'test', ['192.168.0.10']
         )
 
+    @mock.patch.object(driver, '_SESSION', new=mock.Mock())
+    @mock.patch.object(driver, 'd_client')
+    @mock.patch('keystoneauth1.token_endpoint.Token')
+    @mock.patch('keystoneauth1.loading.load_auth_from_conf_options')
+    @mock.patch.object(driver, 'get_clients',
+                       side_effect=driver.get_clients)
+    def test_admin_client_passes_edit_managed(
+            self, mock_get_clients, mock_load_auth, mock_token,
+            mock_d_client):
+        mock_get_clients(self.context)
+        self.assertEqual(2, mock_d_client.Client.call_count)
+        user_call, admin_call = mock_d_client.Client.call_args_list
+        self.assertNotIn('edit_managed', user_call.kwargs)
+        self.assertTrue(admin_call.kwargs.get('edit_managed'))
+
+    @mock.patch.object(driver, '_SESSION', new=mock.Mock())
+    @mock.patch.object(driver, 'd_client')
+    @mock.patch('keystoneauth1.token_endpoint.Token')
+    @mock.patch.object(driver, 'get_all_projects_client',
+                       side_effect=driver.get_all_projects_client)
+    def test_all_projects_client_no_edit_managed(
+            self, mock_get_all, mock_token, mock_d_client):
+        mock_get_all(self.context)
+        call = mock_d_client.Client.call_args
+        self.assertNotIn('edit_managed', call.kwargs)
+
+    def test_delete_managed_record_falls_back_to_admin(self):
+        self.client.recordsets.list.return_value = [
+            {'id': 123, 'records': ['192.168.0.10']}
+        ]
+        self.client.recordsets.delete.side_effect = d_exc.BadRequest
+
+        cfg.CONF.set_override(
+            'allow_reverse_dns_lookup', False, group='designate'
+        )
+
+        self.driver.delete_record_set(
+            self.context, 'example.test.', 'test', ['192.168.0.10']
+        )
+
+        self.client.recordsets.delete.assert_called_once_with(
+            'example.test.', 123)
+        self.admin_client.recordsets.delete.assert_called_once_with(
+            'example.test.', 123)
+
     def test_ipv4_ptr_is_misconfigured(self):
         self.assertRaises(
             ValueError,

releasenotes/notes/fix-fip-delete-managed-dns-records-a1b2c3d4e5f6.yaml

@@ -0,0 +1,9 @@
+---
+fixes:
+  - |
+    Fixed an issue where deleting a floating IP with ``dns_name`` and
+    ``dns_domain`` set would fail with a 500 error when the associated
+    Designate DNS records were managed. The Designate external DNS driver
+    now passes ``edit_managed=True`` to the designateclient, allowing
+    deletion of managed records. For more information see bug
+    `2149807 <https://bugs.launchpad.net/neutron/+bug/2149807>`_.