Bug 2295401

(In reply to Grzegorz Grasza from comment #1)
> I'm closing this, since we are very close to the last 17.1 release and I
> won't be able to have a complete solution on time.
> 
> The quick workaround is running:
> 
> # openstack role delete Member
> 
> The issue with running this indiscriminately during an upgrade to 17.1 is
> that we don't know if the role was in any way modified between the upgrades.
> It might be best to leave running this command to the end user, in the hope
> that they know what they are doing (i.e. that they didn't do any changes to
> the Member role).

Can we add this to known issues into the documentation?
Thank you

Workaround likely triggered bug #2309586 in Heat

The workaround "works" in the sense that we fail later on now with:
~~~
2024-09-08 00:43:35.948587 | 9440c985-b930-3826-01ed-00000000262d |      FATAL | Check Keystone user assignment to roles status | undercloud | item=swift | error={"ansible_job_id": "98192925416.91408", "ansible_loop_var": "tripleo_keystone_resources_user_role_async_result_item", "attempts": 2, "changed": false, "finished": 1, "msg": "Role member is not valid", "results_file": "/root/.ansible_async/98192925416.91408", "started": 1, "stderr": "", "stderr_lines": [], "stdout": "", "stdout_lines": [], "tripleo_keystone_resources_user_role_async_result_item": {"ansible_job_id": "98192925416.91408", "ansible_loop_var": "tripleo_keystone_resources_data_user", "changed": true, "failed": 0, "finished": 0, "results_file": "/root/.ansible_async/98192925416.91408", "started": 1, "tripleo_keystone_resources_data_user": {"swift": {"project": "service"}}}}
~~~

Perhaps the customer should just tweak the following:
~~~
      keystone_resources:
        swift:
          endpoints:
            public: {get_param: [EndpointMap, CephRgwPublic, uri]}
            internal: {get_param: [EndpointMap, CephRgwInternal, uri]}
            admin: {get_param: [EndpointMap, CephRgwAdmin, uri]}
          users:
            swift:
              password: {get_param: SwiftPassword}
              roles:
                - admin
                - member
          region: {get_param: KeystoneRegion}
          service: 'object-store'
          roles:
            - member
            - ResellerAdmin
            - swiftoperator
~~~
to:
~~~
      keystone_resources:
        swift:
          endpoints:
            public: {get_param: [EndpointMap, CephRgwPublic, uri]}
            internal: {get_param: [EndpointMap, CephRgwInternal, uri]}
            admin: {get_param: [EndpointMap, CephRgwAdmin, uri]}
          users:
            swift:
              password: {get_param: SwiftPassword}
              roles:
                - admin
                - member
          region: {get_param: KeystoneRegion}
          service: 'object-store'
          roles:
            - Member <===================================================================
            - ResellerAdmin
            - swiftoperator
~~~

Unless we can make the ansible module case insensitive ?   I've tried reproducing this with the CLI and I can't , it's just with ansible that I can reproduce this issue .   When I try to assign Admin instead of admin to a user in my 17.1 lab, it works but somehow ansible just doesn't like this.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (RHOSP 17.1.4 bug fix and enhancement advisory), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2024:9974

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days