Bug 1025872

Summary: openstack-db --init --service keystone --password somepass fails with CRITICAL error - access denied
Product: [Community] RDO Reporter: Edward Walter <ewalter>
Component: openstack-utilsAssignee: Pádraig Brady <pbrady>
Status: CLOSED WORKSFORME QA Contact: Ami Jeain <ajeain>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: b24warbaby, lars, mfuruta, pbrady, sdpagent, yeylon
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-03-18 20:51:04 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Edward Walter 2013-11-01 19:18:45 UTC
Description of problem:

Following RDO installation instructions here:
http://docs.openstack.org/havana/install-guide/install/yum/content/keystone-install.html

Attempting to initialize the keystone database fails with a database error.  This happens whether specifying localhost, the short hostname or the fully qualified domain name as the controller.  Attempting to create the db tables and grants manually causes "openstack-db --init" to exit because the database table already exists.

Version-Release number of selected component (if applicable):

[root@buena-stack Desktop]# rpm -qa |grep keystone
python-keystoneclient-0.4.1-3.el6.noarch
python-keystone-2013.2-1.el6.noarch
openstack-keystone-2013.2-1.el6.noarch

[root@buena-stack Desktop]# rpm -qf `which openstack-db`
openstack-utils-2013.2-1.el6.1.noarch

How reproducible:

Consistently reproducible

Steps to Reproduce:
1. openstack-config --set /etc/keystone/keystone.conf sql connection mysql://keystone:mykeystonepassword@buena-stack/keystone
2. openstack-db --drop --service keystone
3. openstack-db --init --service keystone --password mykeystonepassword

Actual results:

[root@buena-stack ~]# openstack-config --set /etc/keystone/keystone.conf sql connection mysql://keystone:mykeystonepassword@buena-stack/keystone

[root@buena-stack ~]# openstack-db --init --service keystone --password mykeystonepassword
Please enter the password for the 'root' MySQL user: 
Verified connectivity to MySQL.
Creating 'keystone' database.
Updating 'keystone' database password in /etc/keystone/keystone.conf
Initializing the keystone database, please wait...
2013-11-01 12:07:31.638 3563 CRITICAL keystone [-] (OperationalError) (1045, "Access denied for user 'keystone'@'localhost' (using password: YES)") None None
ERROR 1146 (42S02) at line 1: Table 'keystone.migrate_version' doesn't exist
Final sanity check failed.
Please file a bug report on bugzilla.redhat.com against the openstack-keystone package.

Expected results:

Some kind of success/confirmation message.

Additional info:

OS was successfully updated from Centos 6.3 -> 6.4 and rebooted immediately before this.

Comment 1 Edward Walter 2013-11-01 20:06:04 UTC
It looks like this is a problem in keystone-manage.  I did the following:

[root@buena-stack Desktop]# mysql -e "create database keystone;"
[root@buena-stack Desktop]# mysql -e "create user 'keystone'@'localhost' identified by 'mykeystonepassword';"
[root@buena-stack Desktop]# mysql -e "create user 'keystone'@'%' identified by 'mykeystonepassword';"
[root@buena-stack Desktop]# mysql -e "grant all on keystone.* to 'keystone'@'localhost';"        
[root@buena-stack Desktop]# mysql -e "grant all on keystone.* to 'keystone'@'%';"
[root@buena-stack Desktop]# mysql -e "flush privileges;"

[root@buena-stack ~]# runuser -s /bin/sh keystone -c "keystone-manage db_sync"
2013-11-01 16:03:47.404 15316 CRITICAL keystone [-] (OperationalError) (1045, "Access denied for user 'keystone'@'localhost' (using password: YES)") None None

[root@buena-stack ~]# rpm -qf `which keystone-manage`
openstack-keystone-2013.2-1.el6.noarch

Comment 2 b24warbaby 2014-06-21 14:45:00 UTC
What does the "mykeystonepassword"  mean ?

I am stuck with the same issue ; 


[root@ab763 ~]# /usr/bin/openstack-db --drop --service keystone
Please enter the password for the 'root' MySQL user: 
Verified connectivity to MySQL.
Dropping 'keystone' database.
Complete!
[root@ab763 ~]# openstack-db --init --service keystone --password password
Please enter the password for the 'root' MySQL user: 
Verified connectivity to MySQL.
Creating 'keystone' database.
Updating 'keystone' database password in /etc/keystone/keystone.conf
Initializing the keystone database, please wait...
Traceback (most recent call last):
  File "/usr/bin/keystone-manage", line 51, in <module>
    cli.main(argv=sys.argv, config_files=config_files)
  File "/opt/stack/keystone/keystone/cli.py", line 189, in main
    default_config_files=config_files)
  File "/usr/lib/python2.6/site-packages/oslo/config/cfg.py", line 1659, in __call__
    raise ConfigFilesNotFoundError(self._namespace._files_not_found)
oslo.config.cfg.ConfigFilesNotFoundError: Failed to read some config files: /etc/keystone/keystone.conf
ERROR 1146 (42S02) at line 1: Table 'keystone.migrate_version' doesn't exist
Final sanity check failed.
Please file a bug report on bugzilla.redhat.com against the openstack-keystone package.
[root@ab763 ~]# 




I copied the manual steps to a script:





root@ab763 ~]# cat fix1.sh 

mysql -e "create database keystone;"
mysql -e "create user 'keystone'@'localhost' identified by 'mypasswd';"
mysql -e "create user 'keystone'@'%' identified by 'mypasswd';"
mysql -e "grant all on keystone.* to 'keystone'@'localhost';"        
mysql -e "grant all on keystone.* to 'keystone'@'%';"
mysql -e "flush privileges;"

runuser -s /bin/sh keystone -c "keystone-manage db_sync"


yeilds:


[root@ab763 ~]# ./fix1.sh 
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)
Traceback (most recent call last):
  File "/usr/bin/keystone-manage", line 51, in <module>
    cli.main(argv=sys.argv, config_files=config_files)
  File "/opt/stack/keystone/keystone/cli.py", line 189, in main
    default_config_files=config_files)
  File "/usr/lib/python2.6/site-packages/oslo/config/cfg.py", line 1659, in __call__
    raise ConfigFilesNotFoundError(self._namespace._files_not_found)
oslo.config.cfg.ConfigFilesNotFoundError: Failed to read some config files: /etc/keystone/keystone.conf

Comment 3 b24warbaby 2014-06-21 14:47:11 UTC
[root@ab763 ~]# 
[root@ab763 ~]# rpm -qf `which keystone-manage`
openstack-keystone-2014.1.1-1.el6.noarch
[root@ab763 ~]#

Comment 4 Pádraig Brady 2014-06-23 08:53:18 UTC
This could be a permissions issue. I.E. /etc/keystone/keystone.conf is not accessible to the keystone user?

Can you give the output from:  namei -l /etc/keystone/keystone.conf

Was keystone installed ever, outside of rpm package management on this system?

Comment 5 Lars Kellogg-Stedman 2015-03-18 20:51:04 UTC
I am not able to reproduce this issue with current packages (RDO Juno).  Given the age of the original request I am closing this issue.