openstack limit list --service passes service object instead of service UUID

Bug #2161546 reported by Sravan Sajeev
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
python-openstackclient
Fix Released
Undecided
Amit Mahajan

Bug Description

Summary
-------
The openstack limit list --service <service> command fails with a 400 BadRequest when filtering unified limits by service.

The client appears to pass the full service resource object instead of only the service UUID as service_id when calling the Keystone unified limits API.

Environment
-----------
OpenStack release: 2026.1 / Gazpacho-based
python-openstackclient version: 9.x
Keystone unified limits API enabled

Steps to Reproduce
------------------
1. Source OpenStack admin credentials:

   source admin-openrc

2. Run the unified limits list command filtered by service:

   openstack limit list --service keystone

Expected Result
---------------
The command should complete successfully.

If no unified limits are configured, it should return an empty list.

If limits are configured for the requested service, it should return the limits filtered by that service.

Actual Result
-------------
The command fails with a 400 BadRequest from Keystone.

Example error:

   BadRequestException: 400: Client Error for url:
   http://<keystone-endpoint>/v3/limits?service_id=description&service_id=is_enabled&service_id=links&service_id=name&service_id=type&service_id=id&service_id=location,
   Invalid input for field/attribute service_id. Value: description. 'description' is not a 'uuid'

The request URL shows that multiple service_id query parameters are generated from fields of the service object instead of using the service UUID.

Reproducibility
---------------
Reproducible

The issue is observed when running:

   openstack limit list --service keystone

with python-openstackclient 9.x.

Impact
------
Unified limits listing by service is broken in the OpenStack CLI.

This affects users and validation workflows that need to list registered limits or project limits filtered by service.

The system remains otherwise usable, but this specific CLI workflow fails.

Relevant Error
--------------
The generated Keystone API request contains invalid service_id values:

   service_id=description
   service_id=is_enabled
   service_id=links
   service_id=name
   service_id=type
   service_id=id
   service_id=location

Keystone expects service_id to be a UUID, not service object attribute names.

Root Cause / Analysis
---------------------
The issue appears to be in python-openstackclient identity v3 limit list handling.

In:

   openstackclient/identity/v3/limit.py

the ListLimit command appears to assign the result of the service lookup directly to service_id.

Conceptually, the problematic behavior is:

   kwargs["service_id"] = common_utils.find_service_sdk(
       identity_client, parsed_args.service
   )

This passes the full service resource object to the SDK request path.

The expected behavior is to pass only the resolved service UUID:

   kwargs["service_id"] = common_utils.find_service_sdk(
       identity_client, parsed_args.service
   ).id

The create limit path appears to use the service object's id field correctly. The list limit path should behave consistently.

Suggested Fix
-------------
Update the ListLimit command handling in:

   openstackclient/identity/v3/limit.py

so that the --service argument resolves to the service resource id before being assigned to service_id.

Expected correction:

   service_id should be set to the resolved service resource id, not to the full service resource object.

After the fix, this command should complete successfully:

   openstack limit list --service keystone

The generated Keystone API request should contain a single service_id query parameter whose value is the UUID of the requested service.

Workaround
----------
No workaround is currently known for using the --service filter.

If applicable, unified limits can still be listed without filtering by service:

   openstack limit list

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to python-openstackclient (master)
Changed in python-openstackclient:
status: New → In Progress
Amit Mahajan (a-mahajan)
Changed in python-openstackclient:
assignee: nobody → Amit Mahajan (a-mahajan)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to python-openstackclient (master)

Reviewed: https://review.opendev.org/c/openstack/python-openstackclient/+/998353
Committed: https://opendev.org/openstack/python-openstackclient/commit/f179a1f6121737cfc981516ec2a9610cc96c02be
Submitter: "Zuul (22348)"
Branch: master

commit f179a1f6121737cfc981516ec2a9610cc96c02be
Author: Amit Mahajan <email address hidden>
Date: Wed Jul 22 14:35:12 2026 -0400

    Fix limit list --service passing object instead of ID

    In ListLimit.take_action(), find_service_sdk() returns a Service
    object but the result is assigned directly to kwargs["service_id"]
    without extracting the .id attribute. This causes the SDK to
    serialize all object attributes as individual query parameters,
    resulting in a 400 BadRequest from Keystone.

    The fix appends .id to match the pattern used in CreateLimit and
    region_id in the same file.

    Also adds a unit test for the --service filter path.

    Closes-Bug: 2161546

    Change-Id: I916a33822f812ac095242017e94d945efd71f157
    Signed-off-by: Amit Mahajan <email address hidden>

Changed in python-openstackclient:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/python-openstackclient 10.3.0

This issue was fixed in the openstack/python-openstackclient 10.3.0 Hibiscus release.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.