neutron-common package configures auth options by itself

[Ivan Berezovskiy]

Steps to reproduce:
Deploy 9.0 environment.
Check keystone_authtoken section for neutron. It contains:
keystone_authtoken/auth_url = http://192.168.0.2:35357/

Try to reinstall neutron-common package with Dpkg::Options::="--force-confold":
DEBIAN_FRONTEND=noninteractive apt-get install --reinstall neutron-common -y -o Dpkg::Options::="--force-confold"

or run apt-get upgrade with same options when neutron-common package is going to be updated.

Expected results:
there are no changes in /etc/neutron/neutron.conf

Actual result:
keystone_authtoken/auth_url = http://127.0.0.1:35357/

Please remove this unwanted behavior. It breaks updates to 9.1.

[Ivan Berezovskiy (iberezovskiy)]

Neutron-common package version - 2:8.1.2-2~u14.04+mos74

[Ivan Berezovskiy (iberezovskiy)]

Please check also all other common package. E.g. cinder-common has similar issue.

[Igor Yozhikov (iyozhikov)]

Found issue in openstack-pkg-tool.
Http url related fix already applied to branch 9.0 by this pull request https://review.fuel-infra.org/#/c/25312/. And will be also proposed to the upstream.

Also it will require to rebuild almost all of CORE and PLATFORM projects for Ubuntu.
Full list of affected by this issue projects - is in elaboration.

[Thomas Goirand (thomas-goirand)]

FYI, a full fix to openstack-pkg-tools is there:

https://git.openstack.org/cgit/openstack/deb-openstack-pkg-tools/commit/?h=debian/newton&id=335bd0660836337ccb569f4df66557bf605f1526

This fix also make sure that the protocol is left untouch, and it also supports https (which previous version didn't support).

Also, it's worth noting that keystonemiddleware is currently lacking for an important patch in MOS, which made this bug appear:

https://anonscm.debian.org/cgit/openstack/python-keystonemiddleware.git/tree/debian/patches/re-add-missing-auth-options.patch

Without this patch, any service using --namespace keystonemiddleware.auth_token with oslo-config-generator will *NOT* have things like admin_user, admin_password, or admin_tenant_name in the generated .conf. Unfortunately, for a very complex reason (which is outside of the scope of this bug report), upstream will not accept such a patch (quickly: because they want to push for v3 type of auth, but pragmatically, we still need it...). I would *strongly* recommend applying such a patch to python-keystonemiddleware in MOS so we get the file generated correctly.

Once these 2 patches are applied, we can rebuild Neutron, and everything will be in order. I have checked myself that it works correctly if switching from -z to -n in the if statement (which is main the source of the issue).

Hoping this helps...

[Igor Yozhikov (iyozhikov)]

Projects affected by this bug have been rebuilt in 9.x https://review.fuel-infra.org/#/q/topic:os_pkg_tools_upd

[Kristina Berezovskaia (kkuznetsova)]

Verify on
CUSTOM_VERSION=snapshot #208
MAGNET_LINK=magnet:?xt=urn:btih:bfec808dd71ff42c5613a3527733d9012bb1fabc&dn=MirantisOpenStack-9.0.iso&tr=http%3A%2F%2Ftracker01-bud.infra.mirantis.net%3A8080%2Fannounce&tr=http%3A%2F%2Ftracker01-scc.infra.mirantis.net%3A8080%2Fannounce&tr=http%3A%2F%2Ftracker01-msk.infra.mirantis.net%3A8080%2Fannounce&ws=http%3A%2F%2Fvault.infra.mirantis.net%2FMirantisOpenStack-9.0.iso
FUEL_QA_COMMIT=0c21907598acb1da13a03183888d96e1313b74c9
UBUNTU_MIRROR_ID=ubuntu-2016-08-03-174238
CENTOS_MIRROR_ID=centos-7.2.1511-2016-05-31-083834
MOS_UBUNTU_MIRROR_ID=9.0-2016-09-01-112324
MOS_CENTOS_OS_MIRROR_ID=os-2016-06-23-135731
MOS_CENTOS_PROPOSED_MIRROR_ID=proposed-2016-09-01-112324
MOS_CENTOS_UPDATES_MIRROR_ID=updates-2016-06-23-135916
MOS_CENTOS_HOLDBACK_MIRROR_ID=holdback-2016-06-23-140047
MOS_CENTOS_HOTFIX_MIRROR_ID=hotfix-2016-07-18-162958
MOS_CENTOS_SECURITY_MIRROR_ID=security-2016-06-23-140002

Repeat steps from the bug's description. There are no changes in /etc/neutron/neutron.conf after reinstall neutron-common package