Description of problem: There is a missing role after deploying OSP8 with osp-director. [root@undercloud ~]# openstack role list +----------------------------------+-----------------+ | ID | Name | +----------------------------------+-----------------+ | 0beece53fc7c4d3d880b58d4b92d21cb | swiftoperator | | 573ee117f1d5468b8fe8a998193d03a9 | admin | | 9fe2ff9ee4384b1894a90878d3e92bab | _member_ | | c8f0127d2032450581edf45e5ef766c9 | ResellerAdmin | | fddcf2fa6e6541c5922c414453383381 | heat_stack_user | +----------------------------------+-----------------+ The role "heat_stack_owner" is also referenced in the tempest-deployer-input.conf file provided by the osp-director: stack_owner_role = heat_stack_owner This causes the following tempest tests to fail: tempest.api.orchestration.stacks.test_templates_negative.TemplateYAMLNegativeTestJSON tempest.api.orchestration.stacks.test_environment.StackEnvironmentTest tempest.api.orchestration.stacks.test_stacks.StacksTestJSON tempest.api.orchestration.stacks.test_templates.TemplateAWSTestJSON tempest.api.orchestration.stacks.test_nova_keypair_resources.NovaKeyPairResourcesAWSTest tempest.api.orchestration.stacks.test_limits.TestServerStackLimits tempest.api.orchestration.stacks.test_nova_keypair_resources.NovaKeyPairResourcesYAMLTest tempest.api.orchestration.stacks.test_swift_resources.SwiftResourcesTestJSON tempest.api.orchestration.stacks.test_templates_negative.TemplateAWSNegativeTestJSON tempest.api.orchestration.stacks.test_resource_types.ResourceTypesTest tempest.api.orchestration.stacks.test_non_empty_stack.StacksTestJSON tempest.api.orchestration.stacks.test_soft_conf.TestSoftwareConfig tempest.api.orchestration.stacks.test_templates.TemplateYAMLTestJSON tempest.api.orchestration.stacks.test_volumes.CinderResourcesTest How reproducible: 100% Steps to Reproduce: 1. deploy OSP8 using osp-director 2. run the above tests
This bug did not make the OSP 8.0 release. It is being deferred to OSP 10.
https://review.openstack.org/#/c/155636/ AFAIK heat does not needs that role since long. tempest-deployer-input.conf should not contain any heat specific role, unless the default user roles ([auth]tempest_roles) are not sufficient for a user to fully utilize heat.
The deployer-input-config actually has the 'heat_stack_user' for stack_owner_role in my case which is the opposite role! It will not work for sure, that role is for heat for special usage, tempest should not ever get this role name, and especially should not try to create regular test users with this role. The heat_stack_user is deny almost everything role.
Assigning to OpsTools to update Tempest tests.
This might help: https://review.openstack.org/#/c/384820/
Fix has been merged upstream, and is included in the latest python-tripleoclient build.
python-tripleoclient-6.0.1-0.20170127055753.8ea289c.el7ost.noarch
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:1245