Bug 1545156

Summary: discover-tempest-config disables both identity api versions features when available
Product: Red Hat OpenStack Reporter: Pavel Sedlák <psedlak>
Component: python-tempestconfAssignee: Martin Kopec <mkopec>
Status: CLOSED ERRATA QA Contact: Chandan Kumar <chkumar>
Severity: medium Docs Contact:
Priority: medium    
Version: 13.0 (Queens)CC: acruz, jschluet, skatlapa, udesale, whayutin
Target Milestone: betaKeywords: AutomationBlocker, Triaged
Target Release: 13.0 (Queens)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: python-tempestconf-1.1.4-0.20180219181729.b031af6.el7ost Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-06-27 13:44:45 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Pavel Sedlák 2018-02-14 11:49:28 UTC
In osp13 (applies also on el7.4) simple deployment (1cont1comp1ceph),
tempest run skips all identity (keystone) tests due to
tempest.conf generated by discover-tempest-config tool has both
api v2 and v3 features disabled.

In OSP13 discover tempest config run as:
> source ~/keystonerc
> 
> /usr/bin/discover-tempest-config \
>  --deployer-input ~/ir-tempest-deployer-input.conf \
>  --debug -v --create \
>  --image http://rhos-qe-mirror-qeos.usersys.redhat.com/images/cirros-0.3.5-x86_64-disk.img \
>  identity.uri $OS_AUTH_URL identity.admin_password $OS_PASSWORD scenario.img_dir ~/tempest-dir/etc \
>  image.http_image http://rhos-qe-mirror-qeos.usersys.redhat.com/images/cirros-0.3.5-x86_64-uec.tar.gz \
>  identity.region regionOne \
>  orchestration.stack_owner_role heat_stack_owner \
>  --out ~/tempest-dir/etc/tempest.conf

tempest.conf identity features:
> [identity-feature-enabled]
> api_v2 = False
> api_v3 = False
> api_extensions = ,https:

openstack catalog list section:
> | keystone   | identity        | regionOne                                                                    |
> |            |                 |   admin: http://192.168.24.8:35357                                           |
> |            |                 | regionOne                                                                    |
> |            |                 |   internal: http://172.17.1.15:5000                                          |
> |            |                 | regionOne                                                                    |
> |            |                 |   public: http://10.0.0.106:5000                                             |

curl http://10.0.0.6:5000 | jq .:
> {
>   "versions": {
>     "values": [
>       {
>         "links": [
>           {
>             "rel": "self",
>             "href": "http://10.0.0.106:5000/v3/"
>           }
>         ],
>         "id": "v3.9",
>         "media-types": [
>           {
>             "type": "application/vnd.openstack.identity-v3+json",
>             "base": "application/json"
>           }
>         ],
>         "updated": "2018-02-28T00:00:00Z",
>         "status": "stable"
>       },
>       {
>         "links": [
>           {
>             "rel": "self",
>             "href": "http://10.0.0.106:5000/v2.0/"
>           },
>           {
>             "rel": "describedby",
>             "type": "text/html",
>             "href": "https://docs.openstack.org/"
>           }
>         ],
>         "id": "v2.0",
>         "media-types": [
>           {
>             "type": "application/vnd.openstack.identity-v2.0+json",
>             "base": "application/json"
>           }
>         ],
>         "updated": "2016-08-04T00:00:00Z",
>         "status": "deprecated"
>       }
>     ]
>   }
> }

For comparison diff of keystone reply (this json above) with osp12 deployment where it works correctly is:
> 8c8
> <             "href": "http://10.0.0.106:5000/v3/"
> ---
> >             "href": "http://10.0.0.105:5000/v3/"
> 11c11
> <         "id": "v3.9",
> ---
> >         "id": "v3.8",
> 18c18
> <         "updated": "2018-02-28T00:00:00Z",
> ---
> >         "updated": "2017-02-22T00:00:00Z",
> 25c25
> <             "href": "http://10.0.0.106:5000/v2.0/"
> ---
> >             "href": "http://10.0.0.105:5000/v2.0/"
so seems change in ip, updated field and v3.8->v3.8, rest is same.




~/ir-tempest-deployer-input.conf is not touching identity features:
> [auth]
> use_dynamic_credentials = true
> tempest_roles = swiftoperator
> 
> [compute]
> region = regionOne
> 
> [compute-feature-enabled]
> console_output = True
> attach_encrypted_volume = False
> 
> [identity]
> region = regionOne
> 
> [image]
> region = regionOne
> 
> [network]
> region = regionOne
> 
> [object-storage]
> region = regionOne
> 
> [orchestration]
> stack_owner_role = swiftoperator
> region = regionOne
> 
> [volume]
> backend1_name = tripleo_iscsi
> region = regionOne
> storage_protocol = ceph
> 
> [volume-feature-enabled]
> bootable = true
> 
> [data-processing-feature-enabled]
> plugins = ambari,cdh,mapr

Comment 1 Martin Kopec 2018-02-14 17:12:12 UTC
The problem was found in discovering identity versions [1], python-tempestconf returns an empty list when URL of the identity service doesn't contain "v2". There is proposed patch which should resolve the issue [2].

[1] https://github.com/openstack/python-tempestconf/blob/5fa5f9c51d196c4c046c28eee865f6f34d8750a1/config_tempest/api_discovery.py#L162

[2] https://review.openstack.org/#/c/544517/

Comment 2 Martin Kopec 2018-02-17 13:14:41 UTC
One additional note:
identity api_v2 is deprecated in Queens, so it won't be discovered by python-tempestconf, only v3 versions will be discovered. However, if you still want to run api.v2 tests, you need to either manually edit tempest.conf or pass a new parameter, for example:

> source ~/keystonerc
> 
> /usr/bin/discover-tempest-config \
>  --deployer-input ~/ir-tempest-deployer-input.conf \
>  --debug -v --create \
>  --image http://rhos-qe-mirror-qeos.usersys.redhat.com/images/cirros-0.3.5-x86_64-disk.img \
>  identity.uri $OS_AUTH_URL identity.admin_password $OS_PASSWORD scenario.img_dir ~/tempest-dir/etc \
>  image.http_image http://rhos-qe-mirror-qeos.usersys.redhat.com/images/cirros-0.3.5-x86_64-uec.tar.gz \
>  identity.region regionOne \
>  orchestration.stack_owner_role heat_stack_owner \
>  identity-feature-enabled.api_v2 True \
>  --out ~/tempest-dir/etc/tempest.conf

By adding  `identity-feature-enabled.api_v2 True` you will force discover-tempest-config to enable api_v2.

Comment 8 errata-xmlrpc 2018-06-27 13:44:45 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:2086