Bug 2185118
| Summary: | auth_config_hook ignores some OS_* variables from rc files | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Juan Pablo Marti <jmarti> |
| Component: | python-openstackclient | Assignee: | OSP Team <rhos-maint> |
| Status: | CLOSED NEXTRELEASE | QA Contact: | Nobody <nobody> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 17.0 (Wallaby) | CC: | apevec, jmarti, jpichon, lhh, rdopiera, tkajinam |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-04-20 14:40:56 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Additional info: After installing python-openstackclient 6.2.0 from pip in a venv I don't see the problem: Steps I followed: $ python -m venv virtenv/ $ source virtenv/bin/activate $ python -m pip install python-openstackclient $ openstack --version openstack 6.2.0 $ source RHOSPVirtLabrc $ openstack server list (empty output, so no error) Looks like the problem is resolved then, should I close the issue? Hi Radomir! No, the problem is not solved. Forcing a newer version of python-openstackclient (unsupported) using pip showed no error in that specific command. But we need to fix that behavior for the RHOSP 17.0 corresponding release. If we fix it now, the fix will be released in the next version anyways. Yeah, no problem. |
Description of problem: When sourcing a custom rc file for a user/project created for a domain different from Default, openstack commands fail with: ~~~ keystoneauth1.exceptions.http.Unauthorized: The request you have made requires authentication. (HTTP 401) (Request-ID: req-5e4d45db-b14a-4514-92d9-bd7934fc6925) clean_up ListServer: The request you have made requires authentication. (HTTP 401) (Request-ID: req-5e4d45db-b14a-4514-92d9-bd7934fc6925) ~~~ The custom rc file is a copy from the generated overcloudrc changing OS_USERNAME, OS_PROJECT_NAME, OS_USER_DOMAIN_NAME, OS_PROJECT_DOMAIN_NAME and OS_PASSWORD for the values created for that user/project/domain. The contents are (masking the password): ~~~ (overcloud) [stack@undercloud ~]$ cat RHOSPVirtLabrc # Clear any old environment that may conflict. for key in $( set | awk '{FS="="} /^OS_/ {print $1}' ); do unset $key ; done export OS_USERNAME=test-admin export OS_PROJECT_NAME=test-project export OS_USER_DOMAIN_NAME=RHOSPVirtLab export OS_PROJECT_DOMAIN_NAME=RHOSPVirtLab export OS_NO_CACHE=True export OS_CLOUD=overcloud export no_proxy=10.0.0.254,192.168.24.41 export PYTHONWARNINGS='ignore:Certificate has no, ignore:A true SSLContext object is not available' export OS_AUTH_TYPE=password export OS_PASSWORD=****** export OS_AUTH_URL=http://10.0.0.254:5000 export OS_IDENTITY_API_VERSION=3 export OS_COMPUTE_API_VERSION=2.latest export OS_IMAGE_API_VERSION=2 export OS_VOLUME_API_VERSION=3 export OS_REGION_NAME=regionOne # Add OS_CLOUD to PS1 if [ -z "${CLOUDPROMPT_ENABLED:-}" ]; then export PS1=${PS1:-""} export PS1=\${OS_CLOUD:+"(\$OS_CLOUD)"}\ $PS1 export CLOUDPROMPT_ENABLED=1 fi ~~~ Version-Release number of selected component (if applicable): $ openstack --version openstack 5.5.1 How reproducible: Creating or downloading from horizon the rc file corresponding to a user/project from a domain different from Default. Steps to Reproduce: 1. Create a Domain (openstack domain create RHOSPVirtLab) 2. Create a project for that domain (openstack project create --domain RHOSPVirtLab test-project) 3. Create a user in that project (openstack user create --domain RHOSPVirtLab --project test-project --project-domain RHOSPVirtLab --password ****** --description "Test project admin" test-admin) 4. Assign the admin role for that user at domain level and project level (openstack role add --domain RHOSPVirtLab --user test-admin --user-domain RHOSPVirtLab admin; openstack role add --project test-project --user test-admin --user-domain RHOSPVirtLab admin) 5. Copy the overcloudrc file to RHOSPVirtLabrc and change the values of the required variables. 6. Source the RHOSPVirtLabrc file. 7. Attempt an openstack command (for example openstack server list) Actual results: The request you have made requires authentication. (HTTP 401) (Request-ID: req-5e4d45db-b14a-4514-92d9-bd7934fc6925) Expected results: The valid output of the command Additional info: Using the --debug flag from the openstack command, you can see: ~~~ Auth plugin password selected auth_config_hook(): {'api_timeout': None, 'verify': True, 'cacert': '', 'cert': None, 'key': None, 'baremetal_status_code_retries': '5', 'baremetal_introspection_status_code_retries': '5', 'image_status_code_retries': '5', 'disable_vendor_agent': {}, 'interface': 'public', 'floating_ip_source': 'neutron', 'image_api_use_tasks': False, 'image_format': 'qcow2', 'message': '', 'network_api_version': '2', 'object_store_api_version': '1', 'secgroup_source': 'neutron', 'status': 'active', 'auth': {'auth_url': 'http://10.0.0.254:5000', 'password': '***', 'username': 'admin', 'user_domain_name': 'Default', 'project_domain_name': 'Default', 'project_name': 'admin'}, 'identity_api_version': '3', 'region_name': 'regionOne', 'volume_api_version': '3', 'additional_user_agent': [('osc-lib', '2.3.1')], 'verbose_level': 3, 'deferred_help': False, 'debug': True, 'cloud': 'overcloud', 'default_domain': 'default', 'timing': False, 'inspector_api_version': '1', 'auth_url': 'http://10.0.0.254:5000', 'username': 'test-admin', 'password': '***', 'beta_command': False, 'compute_api_version': '2.latest', 'image_api_version': '2', 'orchestration_api_version': '1', 'baremetal_api_version': '1.69', 'queues_api_version': '2', 'workflow_api_version': '2', 'database_api_version': '1', 'loadbalancer_api_version': '2.0', 'data_processing_api_version': '1.1', 'share_api_version': '2.63', 'dns_api_version': '2', 'container_infra_api_version': '1', 'alarming_api_version': '2', 'key_manager_api_version': '1', 'tripleoclient_api_version': '2', 'metrics_api_version': '1', 'placement_api_version': '1.0', 'auth_type': 'password', ': []} Using auth plugin: password Using parameters {'auth_url': 'http://10.0.0.254:5000', 'project_name': 'admin', 'project_domain_name': 'Default', 'username': 'test-admin', 'user_domain_name': 'Default', 'password': '***'} ~~~ So some values of the specific OS_* variables are being ignored.