Heat stacks can only be deployed by admin users in RHEL OSP 5

Solution In Progress - Updated -

Environment

  • Red Hat Enterprise Linux Openstack Platform 5 (RHEL OSP) on RHEL 6
  • Red Hat Enterprise Linux Openstack Platform 5 (RHEL OSP) on RHEL 7

Issue

  • Heat stacks can only be deployed by admin users in RHEL OSP 5

Resolution

This is resolved by RHEA-2014:0846

  • The domain should be created via the python-openstackclient client :
# yum install python-openstackclient -y

# openstack --os-token <atoken> --os-url=http://<KS_IP>:5000/v3 \ 
     --os-identity-api-version=3 domain create heat \
     --description "Owns users and projects created by heat"
  • This returns a domain ID, referred to as 'stack_user_domain id' below:
# openstack --os-token <atoken> --os-url=http://<KS_IP>:5000/v3 \
    --os-identity-api-version=3 user create heat_domain_admin \
    --password <password> --domain <stack_user_domain id>

# openstack --os-token <atoken> --os-url=http://<KS_IP>:5000/v3 \
    --os-identity-api-version=3 role add --user heat_domain_admin \
    --password <password> \
    --domain <stack_user_domain id> admin
  • The domain ID, username and password should be updated in heat.conf like this:
[DEFAULT]
stack_domain_admin_password = password
stack_domain_admin = heat_domain_admin
stack_user_domain = <domain id returned from domain create above>
  • Restart the openstack-heat-engine service.
# systemctl restart openstack-heat-engine
  • Now try to create the stack once again.
# . keystonerc_demo
(demo) # heat stack-create -f autoscaling.yaml -P 'database_flavor=2;image=4ca190db-ffaf-4008-a52b-c9d34f0debea;key=lyarwood;flavor=2;subnet_id=a81d243f-632e-4087-8eb0-fcf88d6e3c96;database_name=wordpress' test
[..]
(demo) # heat stack-list
+--------------------------------------+------------+-----------------+----------------------+
| id                                   | stack_name | stack_status    | creation_time        |
+--------------------------------------+------------+-----------------+----------------------+
| ba02c3f2-e6b7-45d2-ad3e-8f051cf16eac | test       | CREATE_COMPLETE | 2014-06-03T16:45:08Z |
+--------------------------------------+------------+-----------------+----------------------+

Root Cause

packstack requires heat update for domain users
Bugzilla 1076172 covered by RHEA-2014:0846

Diagnostic Steps

# . keystonerc_demo
(demo) # heat stack-create -f autoscaling.yaml -P 'database_flavor=2;image=4ca190db-ffaf-4008-a52b-c9d34f0debea;key=lyarwood;flavor=2;subnet_id=a81d243f-632e-4087-8eb0-fcf88d6e3c96;database_name=wordpress' test
[..]
(demo) # tailf /var/log/heat/engine.log
2014-06-03 12:13:20.902 18270 INFO heat.engine.resource [-] creating PoolMember "member" Stack "test-web_server_group-p22hg76awjsl-p7j62hiwc3yy-xuvqh6c3ovch" [ab1987da-26a1-47d2-ac6a-f385e6902026]
2014-06-03 12:13:22.661 18270 INFO heat.engine.resource [-] creating AutoScalingPolicy "web_server_scaleup_policy" Stack "test" [ad042d29-de69-4e60-bc33-e1b0a43dd959]
2014-06-03 12:13:22.668 18270 WARNING heat.common.keystoneclient [-] Falling back to legacy non-domain project, configure domain in heat.conf
2014-06-03 12:13:22.679 18270 WARNING heat.common.keystoneclient [-] Falling back to legacy non-domain user create, configure domain in heat.conf
2014-06-03 12:13:22.680 18270 INFO urllib3.connectionpool [-] Starting new HTTP connection (1): 192.168.122.74
2014-06-03 12:13:22.686 18270 ERROR heat.engine.resource [-] CREATE : AutoScalingPolicy "web_server_scaleup_policy" Stack "test" [ad042d29-de69-4e60-bc33-e1b0a43dd959]
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource Traceback (most recent call last):
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/heat/engine/resource.py", line 417, in _do_action
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     handle())
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/heat/engine/resources/autoscaling.py", line 967, in handle_create
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     super(ScalingPolicy, self).handle_create()
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/heat/engine/signal_responder.py", line 46, in handle_create
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     super(SignalResponder, self).handle_create()
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/heat/engine/stack_user.py", line 38, in handle_create
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     self._create_user()
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/heat/engine/stack_user.py", line 51, in _create_user
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     project_id=self.stack.stack_user_project_id)
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/heat/common/heat_keystoneclient.py", line 323, in create_stack_domain_user
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     return self.create_stack_user(username=username, password=password)
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/heat/common/heat_keystoneclient.py", line 288, in create_stack_user
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     roles_list = self.client.roles.list()
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/keystoneclient/utils.py", line 318, in inner
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     return func(*args, **kwargs)
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/keystoneclient/v3/roles.py", line 108, in list
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     return super(RoleManager, self).list(**kwargs)
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 66, in func
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     return f(*args, **new_kwargs)
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 339, in list
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     self.collection_key)
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 106, in _list
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     resp, body = self.client.get(url)
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/keystoneclient/httpclient.py", line 590, in get
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     return self._cs_request(url, 'GET', **kwargs)
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/keystoneclient/httpclient.py", line 582, in _cs_request
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     return self.request(url, method, **kwargs)
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/keystoneclient/httpclient.py", line 564, in request
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     resp = super(HTTPClient, self).request(url, method, **kwargs)
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/keystoneclient/baseclient.py", line 21, in request
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     return self.session.request(url, method, **kwargs)
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/keystoneclient/utils.py", line 318, in inner
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     return func(*args, **kwargs)
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource   File "/usr/lib/python2.7/site-packages/keystoneclient/session.py", line 266, in request
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource     raise exceptions.from_response(resp, method, url)
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource Forbidden: You are not authorized to perform the requested action, identity:list_roles. (HTTP 403)
2014-06-03 12:13:22.686 18270 TRACE heat.engine.resource 
2014-06-03 12:13:22.708 18270 WARNING heat.engine.service [-] Stack create failed, status FAILED

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.