Bug 1503806

Summary: OSP11 -> OSP12 upgrade: logging in to Horizon dashboard fails: IOError: [Errno 13] Permission denied: '/etc/openstack-dashboard/nova_policy.json'
Product: Red Hat OpenStack Reporter: Marius Cornea <mcornea>
Component: openstack-tripleo-heat-templatesAssignee: Beth White <beth.white>
Status: CLOSED ERRATA QA Contact: Ola Pavlenko <opavlenk>
Severity: urgent Docs Contact:
Priority: high    
Version: 12.0 (Pike)CC: apannu, beth.white, dbecker, jpichon, jschluet, mburns, morazi, rhel-osp-director-maint
Target Milestone: betaKeywords: Triaged
Target Release: 12.0 (Pike)   
Hardware: Unspecified   
OS: Unspecified   
Fixed In Version: openstack-tripleo-heat-templates-7.0.3-7.el7ost Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-12-13 22:17:19 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Marius Cornea 2017-10-18 19:34:43 UTC
Description of problem:
OSP11 -> OSP12 upgrade: logging to Horizon dashboard fails after credentials input showing the 'Something went wrong!' page

Checking the container logs we can see:

[root@controller-0 stack]# docker exec -it horizon tail -f /var/log/horizon/horizon.log
    enforcer = _get_enforcer()
  File "/usr/lib/python2.7/site-packages/openstack_auth/policy.py", line 56, in _get_enforcer
  File "/usr/lib/python2.7/site-packages/oslo_policy/policy.py", line 537, in load_rules
  File "/usr/lib/python2.7/site-packages/oslo_policy/policy.py", line 675, in _load_policy_file
    self._file_cache, path, force_reload=force_reload)
  File "/usr/lib/python2.7/site-packages/oslo_policy/_cache_handler.py", line 41, in read_cached_file
    with open(filename) as fap:
IOError: [Errno 13] Permission denied: '/etc/openstack-dashboard/nova_policy.json'

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Deploy an OSP11 split stack environment with 3 controller, 3 messaging, 3 db, 2 networker, 2 compute, 3 ceph nodes
2. Upgrade to OSP12

3. Open in the browser the Horizon public URL

4. Input the credenaitls and log in

Actual results:
Something went wrong!

An unexpected error has occurred. Try refreshing the page. If that doesn't help, contact your local administrator.

Expected results:
The dashboard shows up.

Additional info:

https://review.openstack.org/#/c/507408/ was applied on the system as a fix for bug 1492135

Comment 1 Marius Cornea 2017-10-18 19:37:15 UTC
[root@controller-0 stack]# docker exec -it horizon ls -l /etc/openstack-dashboard
total 100
-rw-r-----. 1 horizon horizon  5283 Sep 29 18:03 cinder_policy.json
drwxr-xr-x. 2 horizon horizon  4096 Oct 17 20:23 enabled
-rw-r-----. 1 horizon horizon  1361 Sep 29 18:03 glance_policy.json
-rw-r-----. 1 horizon horizon  4544 Sep 29 18:03 heat_policy.json
-rw-r-----. 1 horizon horizon  9822 Sep 29 18:03 keystone_policy.json
-rwxr-xr-x. 1 apache  apache  30534 Oct 18 15:35 local_settings
drwxr-x---. 2 horizon horizon  4096 Oct 17 20:23 local_settings.d
-rw-r-----. 1 horizon horizon  9551 Sep 29 18:03 neutron_policy.json
-rw-r-----. 1 horizon horizon 15717 Sep 29 18:03 nova_policy.json

Comment 2 Beth White 2017-10-26 09:51:14 UTC
Backport to pike https://review.openstack.org/#/c/515105

Comment 4 Beth White 2017-11-09 14:09:50 UTC
backport to pike merged

Comment 9 errata-xmlrpc 2017-12-13 22:17:19 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.