Bug 1303723 - Service heat does not have required endpoint in service catalog for the resource type OS::Heat::StructuredDeployment
Service heat does not have required endpoint in service catalog for the resou...
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-heat (Show other bugs)
8.0 (Liberty)
Unspecified Unspecified
unspecified Severity unspecified
: ga
: 8.0 (Liberty)
Assigned To: Rabi Mishra
Omri Hochman
Depends On:
  Show dependency treegraph
Reported: 2016-02-01 13:34 EST by Jiri Stransky
Modified: 2016-04-27 01:22 EDT (History)
10 users (show)

See Also:
Fixed In Version: openstack-heat-5.0.1-2.el7ost
Doc Type: Bug Fix
Doc Text:
Previously, heat would leave the context roles empty when loading the stored context. When signaling heat used the stored context (trust scoped token), and if the context did not have any roles, it failed. Consequently, the process failed with the error 'trustee has no delegated roles'. This fix addresses this issue by populating roles when loading the stored context. As a result, loading the auth ref, and populating the roles from the token will confirm that any RBAC performed on the context roles will work as expected, and that the stack update succeeds.
Story Points: ---
Clone Of:
Last Closed: 2016-04-07 17:27:18 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
os-collect-config (380.98 KB, text/x-vhdl)
2016-02-01 13:34 EST, Jiri Stransky
no flags Details
heat-engine log snippet (10.36 KB, text/plain)
2016-02-01 13:36 EST, Jiri Stransky
no flags Details
heat-api-cfn 10k lines (2.65 MB, text/plain)
2016-02-01 13:43 EST, Jiri Stransky
no flags Details

  None (edit)
Description Jiri Stransky 2016-02-01 13:34:57 EST
Created attachment 1120227 [details]

Description of problem:

Hit when trying to upgrade from OSP 7 to OSP 8.

Os-collect-config is trying to report back to heat using the CFN API, but gets a 500 error response:

ResourceTypeUnavailable: Service heat does not have required endpoint in service catalog for the resource type OS::Heat::StructuredDeployment

Attaching relevant logs.

Heat version used:

[stack@instack ~]$ rpm -q openstack-heat-api openstack-heat-engine openstack-heat-common
Comment 2 Jiri Stransky 2016-02-01 13:36 EST
Created attachment 1120228 [details]
heat-engine log snippet
Comment 3 Jiri Stransky 2016-02-01 13:43 EST
Created attachment 1120231 [details]
heat-api-cfn 10k lines
Comment 4 Jiri Stransky 2016-02-01 13:47:41 EST
Interesting is the error from the attached heat-engine log snippet:

2016-02-01 10:53:24.233 11434 ERROR heat.engine.resource Forbidden: Trustee has no delegated roles. (Disable debug mode to suppress these details.) (HTTP 403) (Request-ID: req-2223404b-43da-467d-8482-b3ec73bb18f8)

Is that something that could be fixed by some additional configuration of the undercloud? If so, please try to give some hints and retarget to instack-undercloud.
Comment 9 Amit Ugol 2016-04-07 13:10:11 EDT
Following the internal mail thread, upgrades are working better now => this is verified.
Comment 10 errata-xmlrpc 2016-04-07 17:27:18 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.