domain-setup action fails when using keystone v3 api

[Liam Young]

The domain-setup action uses the credentials of the heat-cfn_heat user. However, this user lacks the Admin role so is unable to query or manage domains. This means that the domain-setup action fails. I think the keystone charm could be updated to grant domain admin to the service users or the heat charm could grow a identity-admin relation. If the latter is implemented then Bug #1593160 will need fixing first.

Workaround is ti create the domain manually:
openstack role add --domain admin_domain --user heat-cfn_heat Admin

[Edward Hope-Morley (hopem)]

We now have a service_domain for this very purpose so this can fixed with:

diff --git a/templates/admin-openrc-v3 b/templates/admin-openrc-v3
index e5ee6aa..f6fb90d 100644
--- a/templates/admin-openrc-v3
+++ b/templates/admin-openrc-v3
@@ -4,7 +4,7 @@ export OS_PASSWORD={{ admin_password }}
 export OS_AUTH_URL={{ auth_protocol }}://{{ auth_host }}:{{ auth_port }}/v3
 export OS_USERNAME={{ admin_user }}
 export OS_TENANT_NAME={{ admin_tenant_name }}
-export OS_PROJECT_DOMAIN_ID=default
-export OS_USER_DOMAIN_ID=default
+export OS_PROJECT_DOMAIN_NAME=service_domain
+export OS_USER_DOMAIN_NAME=service_domain
 export OS_PROJECT_NAME={{ admin_tenant_name }}
 export OS_IDENTITY_API_VERSION=3

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/434807

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/434807
Committed: https://git.openstack.org/cgit/openstack/charm-heat/commit/?id=040a42d51ad6c38ad1cfee9394ba5f062d87d449
Submitter: Jenkins
Branch: master

commit 040a42d51ad6c38ad1cfee9394ba5f062d87d449
Author: Edward Hope-Morley <email address hidden>
Date: Thu Feb 16 10:53:18 2017 +0000

    Use service-domain for domain setup action

    Change-Id: Ieced5c7552a45874ad920c0e0e1ab1cd44c73d00
    Closes-Bug: 1593164