[heat] [updates] Resource group with a nested wait condition handle fails on create

[Timur Nurlygayanov]

We need to fix the following bug in MOS 6.1 updates:
https://bugs.launchpad.net/heat/+bug/1402894

Fix for stable/juno:
https://review.openstack.org/#/c/182446/

So, we need to include the fix from the stable upstream branch to MOS 6.1 updates branch.

Steps To Reproduce:
1. Create the following templates:

slave.yaml:

heat_template_version: 2013-05-23

resources:
  wait_condition:
    type: OS::Heat::WaitCondition
    properties:
      handle: { get_resource: wait_handle }
      count: 1
      timeout: 600

  wait_handle:
    type: OS::Heat::WaitConditionHandle

master.yaml:

heat_template_version: 2013-05-23

resources:
  cluster:
    type: OS::Heat::ResourceGroup
    properties:
      count: 2
      resource_def:
        type: slave.yaml

2. To reproduce, just run: heat stack-create test -f master.yaml

Observed Result:
Deployment of heat stack will fail with the error, in Heat logs we will see the following traceback:
...

2014-12-16 02:51:34.381 INFO heat.engine.resource [-] CREATE: HeatWaitConditionHandle "wait_condition_handle" [f8d5816146344bcba8e2539f09a73da1] Stack "blah3-cluster-d3wjowmze6mh-1-arutohsvjpqb" [63b36781-7287-482c-ae30-196d86da0433]
2014-12-16 02:51:34.381 TRACE heat.engine.resource Traceback (most recent call last):
2014-12-16 02:51:34.381 TRACE heat.engine.resource File "/opt/stack/heat/heat/engine/resource.py", line 459, in _action_recorder
2014-12-16 02:51:34.381 TRACE heat.engine.resource yield
2014-12-16 02:51:34.381 TRACE heat.engine.resource File "/opt/stack/heat/heat/engine/resource.py", line 529, in _do_action
2014-12-16 02:51:34.381 TRACE heat.engine.resource yield self.action_handler_task(action, args=handler_args)
2014-12-16 02:51:34.381 TRACE heat.engine.resource File "/opt/stack/heat/heat/engine/scheduler.py", line 295, in wrapper
2014-12-16 02:51:34.381 TRACE heat.engine.resource step = next(subtask)
2014-12-16 02:51:34.381 TRACE heat.engine.resource File "/opt/stack/heat/heat/engine/resource.py", line 500, in action_handler_task
2014-12-16 02:51:34.381 TRACE heat.engine.resource handler_data = handler(*args)
2014-12-16 02:51:34.381 TRACE heat.engine.resource File "/opt/stack/heat/heat/engine/resources/wait_condition.py", line 149, in handle_create
2014-12-16 02:51:34.381 TRACE heat.engine.resource token = self._user_token()
2014-12-16 02:51:34.381 TRACE heat.engine.resource File "/opt/stack/heat/heat/engine/stack_user.py", line 66, in _user_token
2014-12-16 02:51:34.381 TRACE heat.engine.resource project_id=project_id, password=password)
2014-12-16 02:51:34.381 TRACE heat.engine.resource File "/opt/stack/heat/heat/common/heat_keystoneclient.py", line 408, in stack_domain_user_token
2014-12-16 02:51:34.381 TRACE heat.engine.resource authenticated=False)
2014-12-16 02:51:34.381 TRACE heat.engine.resource File "/usr/local/lib/python2.7/dist-packages/keystoneclient/session.py", line 438, in post
2014-12-16 02:51:34.381 TRACE heat.engine.resource return self.request(url, 'POST', **kwargs)
2014-12-16 02:51:34.381 TRACE heat.engine.resource File "/usr/local/lib/python2.7/dist-packages/keystoneclient/utils.py", line 318, in inner
2014-12-16 02:51:34.381 TRACE heat.engine.resource return func(*args, **kwargs)
2014-12-16 02:51:34.381 TRACE heat.engine.resource File "/usr/local/lib/python2.7/dist-packages/keystoneclient/session.py", line 354, in request
2014-12-16 02:51:34.381 TRACE heat.engine.resource raise exceptions.from_response(resp, method, url)
2014-12-16 02:51:34.381 TRACE heat.engine.resource Unauthorized: Could not find user: blah3-cluster-d3wjowmze6mh-1-arutohsvjpqb-wait_condition_handle-coov3oce6jhx (Disable debug mode to suppress these details.) (HTTP 401)

[Timur Nurlygayanov (tnurlygayanov)]

Alexander Nevenchannyy, could you please add links to commits with the fixes, because status of the issue In Progress but we have no any commits with the fixes yet, probably it is some issue with infra, but in this case we need to add links to the commits manually.

Thank you!

[Vitaly Sedelnik (vsedelnik)]

Fix Committed for 6.0-updates - the fix is already in 6.0-updates branch

[Vitaly Sedelnik (vsedelnik)]

The review for 6.0-updates - https://review.fuel-infra.org/#/c/10097/4

[Vitaly Sedelnik (vsedelnik)]

The review for 6.1 is https://review.fuel-infra.org/#/c/10098/2

[Timur Nurlygayanov (tnurlygayanov)]

Vitaly, thank you!

[Vadim Rovachev (vrovachev)]

Verified on 6.0.
Btw if you want to heat example in bug worked, then need to run command on any controller node:
. openrc
heat-keystone-setup-domain --stack-domain-admin-password=123qwe

(Thank Denis Meltsaykin for this guide)
If you use ubuntu OS for 6.0 env, then before run command need to add file heat-keystone-setup-domain to /usr/bin/
File you can download in upstream: https://github.com/openstack/heat/blob/master/bin/heat-keystone-setup-domain
And replace line 21 from "from oslo_config import cfg" to "from oslo.config import cfg"

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/10098
Submitter: Vitaly Sedelnik <email address hidden>
Branch: openstack-ci/fuel-6.1/2014.2

Commit: cb38e2468a38c58f0aef4c70ce96392b8f27f2e6
Author: Miguel Grinberg <email address hidden>
Date: Tue Aug 18 21:35:18 2015

Authenticate the domain user with id instead of username

This change makes the authentication process that requests a domain user
token provide user_id and password instead of username and password.
Authenticating with the user_id is more reliable, as that works even when
the username is truncated or modified in any other way before it is passed
to Keystone.

Conflicts:
 heat/common/heat_keystoneclient.py

Closes-bug: #1481197
Change-Id: I7b2897c2be1e4ad7f55549449b1791991572a7f1

[Vadim Rovachev (vrovachev)]

Verified on 6.1.
Used packages:
{heat-api-cfn,heat-engine,heat-api,heat-api-cloudwatch,python-heat}=2014.2.2-1~u14.04+mos10
in mirror:
http://mirror.fuel-infra.org/mos/snapshots/ubuntu-latest/ mos6.1-proposed/main amd64 Packages