Bug 1314725 - missing heat_stack_owner role after installation
missing heat_stack_owner role after installation
Status: CLOSED ERRATA
Product: Red Hat OpenStack
Classification: Red Hat
Component: python-tripleoclient (Show other bugs)
8.0 (Liberty)
Unspecified Unspecified
unspecified Severity high
: Upstream M2
: 11.0 (Ocata)
Assigned To: RHOS Maint
tkammer
: Automation, AutomationBlocker
Depends On:
Blocks: 1314732
  Show dependency treegraph
 
Reported: 2016-03-04 05:47 EST by tkammer
Modified: 2017-05-17 15:27 EDT (History)
11 users (show)

See Also:
Fixed In Version: python-tripleoclient-5.3.0-4.el7ost
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1314732 (view as bug list)
Environment:
Last Closed: 2017-05-17 15:27:41 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
OpenStack gerrit 384820 None None None 2016-11-03 15:02 EDT

  None (edit)
Description tkammer 2016-03-04 05:47:20 EST
Description of problem:
There is a missing role after deploying OSP8 with osp-director.
[root@undercloud ~]# openstack role list
+----------------------------------+-----------------+
| ID                               | Name            |
+----------------------------------+-----------------+
| 0beece53fc7c4d3d880b58d4b92d21cb | swiftoperator   |
| 573ee117f1d5468b8fe8a998193d03a9 | admin           |
| 9fe2ff9ee4384b1894a90878d3e92bab | _member_        |
| c8f0127d2032450581edf45e5ef766c9 | ResellerAdmin   |
| fddcf2fa6e6541c5922c414453383381 | heat_stack_user |
+----------------------------------+-----------------+

The role "heat_stack_owner" is also referenced in the tempest-deployer-input.conf file provided by the osp-director:
stack_owner_role = heat_stack_owner

This causes the following tempest tests to fail:
tempest.api.orchestration.stacks.test_templates_negative.TemplateYAMLNegativeTestJSON
tempest.api.orchestration.stacks.test_environment.StackEnvironmentTest
tempest.api.orchestration.stacks.test_stacks.StacksTestJSON
tempest.api.orchestration.stacks.test_templates.TemplateAWSTestJSON
tempest.api.orchestration.stacks.test_nova_keypair_resources.NovaKeyPairResourcesAWSTest
tempest.api.orchestration.stacks.test_limits.TestServerStackLimits
tempest.api.orchestration.stacks.test_nova_keypair_resources.NovaKeyPairResourcesYAMLTest
tempest.api.orchestration.stacks.test_swift_resources.SwiftResourcesTestJSON
tempest.api.orchestration.stacks.test_templates_negative.TemplateAWSNegativeTestJSON
tempest.api.orchestration.stacks.test_resource_types.ResourceTypesTest
tempest.api.orchestration.stacks.test_non_empty_stack.StacksTestJSON
tempest.api.orchestration.stacks.test_soft_conf.TestSoftwareConfig
tempest.api.orchestration.stacks.test_templates.TemplateYAMLTestJSON
tempest.api.orchestration.stacks.test_volumes.CinderResourcesTest

How reproducible:
100%

Steps to Reproduce:
1. deploy OSP8 using osp-director
2. run the above tests
Comment 2 Mike Burns 2016-04-07 17:14:44 EDT
This bug did not make the OSP 8.0 release.  It is being deferred to OSP 10.
Comment 3 Attila Fazekas 2016-10-10 10:02:58 EDT
https://review.openstack.org/#/c/155636/

AFAIK heat does not needs that role since long.

tempest-deployer-input.conf should not contain any heat specific role, unless the default user roles ([auth]tempest_roles) are not sufficient for a user to fully utilize heat.
Comment 4 Attila Fazekas 2016-10-11 02:35:45 EDT
The deployer-input-config actually has the 'heat_stack_user' for stack_owner_role in my case which is the opposite role!
It will not work for sure, that role is for heat for special usage, tempest should not ever get this role name, and especially should not try to create regular test users with this role. 

The heat_stack_user is deny almost everything role.
Comment 5 Jaromir Coufal 2016-10-11 09:18:46 EDT
Assigning to OpsTools to update Tempest tests.
Comment 6 Attila Fazekas 2016-10-11 09:36:03 EDT
This might help: https://review.openstack.org/#/c/384820/
Comment 7 Christian Schwede (cschwede) 2016-11-03 15:02:00 EDT
Fix has been merged upstream, and is included in the latest python-tripleoclient build.
Comment 10 Leonid Natapov 2017-02-02 10:23:02 EST
python-tripleoclient-6.0.1-0.20170127055753.8ea289c.el7ost.noarch
Comment 11 errata-xmlrpc 2017-05-17 15:27:41 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1245

Note You need to log in before you can comment on or make changes to this bug.