Install the dashboard in OpenStack Installation Guide for Red Hat Enterprise Linux, CentOS, and Fedora - havana

[Tom Fifield]

OPENSTACK_KEYSTONE_DEFAULT_ROLE = "Member" in the config file should be set to OPENSTACK_KEYSTONE_DEFAULT_ROLE = "admin"

-----------------------------------
Built: 2014-01-03T13:40:41 00:00
git SHA: 9ad96c1083e1bed1a0582d54c7bc99dc84208fa4
URL: http://docs.openstack.org/havana/install-guide/install/yum/content/install_dashboard.html
source File: file:/home/jenkins/workspace/openstack-install-deploy-guide-fedora/doc/install-guide/section_dashboard-install.xml
xml:id: install_dashboard

[Anne Gentle (annegentle)]

Is this actually a bug with the packaging, since rhel installs do the configuring for you?

[Tom Fifield (fifieldt)]

I think so, but we could also claim that some other such configuration steps currently documented are bugs with the packaging (eg api-paste stuff with centos) :) I don't think it changes the need for us to fix it if upstream is going to take eg a couple months to get something pushed out.

It is a valid point, but it might be better to collect them all as a whole and just dump in in their tracker then, so they only need to cut one package to fix things up.

Thoughts?

[Stephen Gordon (sgordon)]

This isn't a RHEL/CentOS/SL packaging decision, it's the default per:

    http://git.openstack.org/cgit/openstack/horizon/tree/openstack_dashboard/local/local_settings.py.example#n129

It used to be _member_ instead of Member but the "special" value changed (I think in Havana but don't quote me on that it might have been Grizzly). So what's the driver for changing it to admin and why only on this platform?

[Stephen Gordon (sgordon)]

/methinks the actual issue here is that the Member role is never created in this guide? This should be impacting other platforms as well unless they are overwriting the default (which probably has other impacts).

[David Lyle (david-lyle)]

The default role in keystone, as seen in devstack is "Member". That's what Horizon is targeting.

[David Lyle (david-lyle)]

Looking through the keystone code, I don't see where this role is bootstrapped, this may purely be a devstack introduction. The defaults in keystone are either member or _member_

[Stephen Gordon (sgordon)]

Confirmed with Andreas that SUSE also uses the upstream default (Member) for this setting.

[Stephen Gordon (sgordon)]

We discussed on IRC and it seems the correct change to the docs is to add a step where we create a "normal" user and the member role. There is still the open question though of whether that role should be called _member_ (and Horizon updated) or Member (and Keystone updated) - the former seems like it would be more palatable but either way I think there would be upgrade impact.

See also:

https://bugzilla.redhat.com/show_bug.cgi?id=984294#c4
https://wiki.openstack.org/wiki/ReleaseNotes/Grizzly (search for _member_)

[Stephen Gordon (sgordon)]

Based on those release notes plus the keystone SQL it seems like the answer is _member_ (which will automagically be created when creating the Keystone DB) - that probably means changing the Horizon defaults and devstack though?

[Stephen Gordon (sgordon)]

Looks like it was already done in Horizon:

https://review.openstack.org/#/c/60462/

[Stephen Gordon (sgordon)]

So, two actions here:

1) For Havana we should add an instruction to change OPENSTACK_KEYSTONE_DEFAULT_ROLE to "Member".

2) For Icehouse we don't *need* to add anything but discussing with Andreas and Matt on IRC we should add a step to create a "normal" user with the "_member_" role just as an example of how to create normal users.

[Stephen Gordon (sgordon)]

3) Just noticed that review is only for puppet/packstack stuff - so there is still the need to get the default in the horizon project fixed up.

[Stephen Gordon (sgordon)]

Updated action for docs as I made a few typos and mistakes above:

1) For Havana and Icehouse we should add an instruction to change OPENSTACK_KEYSTONE_DEFAULT_ROLE to "_member_" and add this role to admin user.

2) For Icehouse we should add an instruction to create a "normal" user with the "_member_" role.

In all cases post-Grizzly the _member_ role will already exist in the Keystone DB as it is created by the DB initialization/sync.

[Matt Kassawara (ionosphere80)]

I was hoping to add instructions for creating a "normal" tenant and user to Havana since base network creation on Neutron depends on both "admin" and "normal" tenants.

[Stephen Gordon (sgordon)]

Horizon fix has been proposed here:

https://bugs.launchpad.net/horizon/+bug/1264228
https://review.openstack.org/#/c/64137/

[Matt Kassawara (ionosphere80)]

Stephen,

For clarification... should the installation guide for Keystone add the "admin" user to both the "admin" and "_member_" roles?

[Stephen Gordon (sgordon)]

Yes, but please note per assignment I'm happy to take this one.

[Matt Kassawara (ionosphere80)]

Understood... I'm just tracking it for potential patches on #1264174 and clarifications to "Create the base Neutron networks" which relies on both "admin" and "user" tenants.

[Stephen Gordon (sgordon)]

Still hanging on the Horizon change being approved.

[Matt Kassawara (ionosphere80)]

I'm installing Icehouse on Ubuntu using the Icehouse-Staging PPA and found the 'OPENSTACK_KEYSTONE_DEFAULT_ROLE' key still configured with "Member".

[Stephen Gordon (sgordon)]

When was the PPA built?

[Matt Kassawara (ionosphere80)]

The horizon package indicates 1/27.

[Stephen Gordon (sgordon)]

Change still appears to be in trunk, so seems like a bug in the packaging.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/79166

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/79166
Committed: https://git.openstack.org/cgit/openstack/openstack-manuals/commit/?id=4d9e25e91cd38ab26952ec09067d799ff2154ffd
Submitter: Jenkins
Branch: master

commit 4d9e25e91cd38ab26952ec09067d799ff2154ffd
Author: Stephen Gordon <email address hidden>
Date: Sat Mar 8 15:47:36 2014 -0500

    Add instructions for "normal" user creation

    Added instructions for adding a "normal" user named "demo" with access
    to the dashboard but no administrative functions. Restructured the
    section into procedures to support this and make the task split
    clearer.

    Change-Id: Iebfec133e44447fad2149ea815c749468b57c763
    Closes-Bug: #1266391

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-manuals 15.0.0 release.