Cannot create a new resource from non-admin user, using Heat template

[Yaroslav Lobankov]

VERSION:
  feature_groups:
    - mirantis
  production: "docker"
  release: "6.1"
  api: "1.0"
  build_number: "200"
  build_id: "2015-03-15_22-54-44"
  nailgun_sha: "713e6684f9f54e29acfe6b8ebf641b9de2292628"
  python-fuelclient_sha: "cc64fff91fb0d78e5a02e7b93ceff224296f84fb"
  astute_sha: "93e427ac49109fa3fd8b0e1d0bb3d14092be2e8c"
  fuellib_sha: "553cb0cffa40a5f57313f962b6ec6a9bd89306ba"
  ostf_sha: "e86c961ceacfa5a8398b6cbda7b70a5f06afb476"
  fuelmain_sha: "c97fd8a789645bda48d06da224f994f8b52d82f5"

ENVIRONMENT:
HA mode, CentOS, Neutron with GRE segmentation, Cinder LVM, Sahara and Ceilometer are enabled, 3 (controller + mongo), 1 (compute + cinder)

HOW TO REPRODUCE:
Log into one of the controllers and execute the following commands:
# . openrc
# keystone tenant-create --name demo
# keystone user-create --tenant demo --name demo --pass demo

Now go to the OpenStack dashboard.
Log in as "demo" user.
Create a Heat stack, using the following template http://paste.openstack.org/show/192630/

EXPECTED RESULT:
The heat stack has been successfully created.

ACTUAL RESULT:
The heat stack has not been created and has status "Failed". See screenshot-1.

HOW TO FIX THE ISSUE:
First of all you should execute the following commands on the controller:
# keystone role-create --name heat_stack_owner
# keystone user-role-add --role heat_stack_owner --user demo --tenant demo

Further you should edit file /etc/heat/heat.conf on all controllers: comment the option "trusts_delegated_roles" to use the default value. Further you should restart heat-engine via pcs:
pcs resource disable p_openstack-heat-engine
pcs resource enable p_openstack-heat-engine

Now try to create the same stack. The stack will be successfully created. See screenshot-2.

[Pavlo Shchelokovskyy (pshchelo)]

The heat_stack_owner role is a relic from the past. Everything should work without it in Juno, with __member__ role being enough to create such stacks via trusts delegation. I have tested our current code on a 6.1 deployed env, and after heat-engine restart everything seem to work as expected. Probably we are setting these trusts-related options too late during the deployment, so that additional heat-engine restart is needed.

[Anastasia Kuznetsova (akuznetsova)]

Seems like heat puppets have to be fixed by adding one more heat engine restart or moving heat engine restart and executing it a little bit later.

[Yaroslav Lobankov (ylobankov)]

The fix https://review.openstack.org/#/c/166852/

[Anastasia Kuznetsova (akuznetsova)]

Verified on 221 ISO