Stack users don't have heat_stack_user role

[Steven Hardy]

https://review.openstack.org/#/c/66646/2/heat/common/heat_keystoneclient.py

Has caused a regression due to expecting this keystoneclient patch which is not yet merged:

https://review.openstack.org/#/c/65985/

The logs show:

ERROR heat.common.keystoneclient [-] Failed to add user ua516789-user-c7hl5wxvl7fk to role heat_stack_user, check role exists!

The problem is keystoneclient doesn't support filtering by name yet, so we'll have to do a brute-force lookup locally until it does.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/68135

[Clint Byrum (clint-fewbar)]

Linking to TripleO so users can find it and cherry-pick the fix above.

[Thierry Carrez (ttx)]

Just failed tests, can't afford to wait for another run, so tagging icehouse-2 without this...

[Steven Hardy (shardy)]

> Just failed tests, can't afford to wait for another run, so tagging icehouse-2 without this...

:(

I've just kicked off a reverify, looks like https://bugs.launchpad.net/openstack-ci/+bug/1268732

[Matt Riedemann (mriedem)]

Yeah, if you check the logs on this filtered logstash query, 77% of the time the user role error doesn't fail the build, it's bug 1268732 that fails the build:

http://logstash.openstack.org/#eyJzZWFyY2giOiJtZXNzYWdlOlwiRmFpbGVkIHRvIGFkZCB1c2VyIGhlYXQtdGVtcGVzdC1cIiBBTkQgbWVzc2FnZTpcIiB0byByb2xlIGhlYXRfc3RhY2tfdXNlciwgY2hlY2sgcm9sZSBleGlzdHMhXCIgQU5EIGZpbGVuYW1lOlwibG9ncy9zY3JlZW4taC1lbmcudHh0XCIgQU5EIGJ1aWxkX3N0YXR1czpGQUlMVVJFIiwiZmllbGRzIjpbXSwib2Zmc2V0IjowLCJ0aW1lZnJhbWUiOiI2MDQ4MDAiLCJncmFwaG1vZGUiOiJjb3VudCIsInRpbWUiOnsidXNlcl9pbnRlcnZhbCI6MH0sInN0YW1wIjoxMzkwNTE2NDg2NTQwfQ==

We need an e-r query for bug 1268732.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/68135
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=a4cbd9cdb38ae38887323bad5dc434532bacee19
Submitter: Jenkins
Branch: master

commit a4cbd9cdb38ae38887323bad5dc434532bacee19
Author: Steven Hardy <email address hidden>
Date: Tue Jan 21 14:51:16 2014 +0000

    Fix adding heat_stack_user role via v3 API

    A regression was introduced via 301a894 because it expects
    keystoneclient functionality which is not yet merged/released,
    so instead of passing the name to roles.list() we must filter
    the results locally to lookup the role ID.

    The lack of filtering support is a general issue with the v3
    keystoneclient interfaces, so when it's fixed we can remove
    this workaround.

    Closes-Bug: #1271190
    Change-Id: I1b29cc131496e4b19493a8cd8e6d4ed913db0938