rbac: default rbac rules are not created after enabling rbac

[Senthilnathan Murugappan]

On 3.2-8 the cluster was initially provisioned with 'cloud-admin' as aaa_mode which is default.
Later on aaa_mode was set to rbac and the api service was restarted and observed that default-global-acl got created however the default rbac rules are not set.

{
    "api-access-list": {
        "api_access_list_entries": {
            "rbac_rule": []
        },
        "display_name": "default-api-access-list",
        "fq_name": [
            "default-global-system-config",
            "default-api-access-list"
        ],
        "href": "http://127.0.0.1:8095/api-access-list/d621afcd-9392-4212-a0c3-286184facbf4",
        "id_perms": {
            "created": "2016-12-09T20:09:32.350519",
            "creator": null,
            "description": null,
            "enable": true,
            "last_modified": "2016-12-09T20:26:03.562554",
            "permissions": {
                "group": "admin",
                "group_access": 7,
                "other_access": 7,
                "owner": "ctest-TestRbac-18714389",
                "owner_access": 7
            },
            "user_visible": true,
            "uuid": {
                "uuid_lslong": 11584147065835015156,
                "uuid_mslong": 15429807095827022354
            }
        },
        "name": "default-api-access-list",
        "parent_href": "http://127.0.0.1:8095/global-system-config/84a54180-2724-4080-9313-6fa5d6080587",
        "parent_type": "global-system-config",
        "parent_uuid": "84a54180-2724-4080-9313-6fa5d6080587",
        "perms2": {
            "global_access": 0,
            "owner": "f4d1f588438a424c9e6c2eebc1cbac29",
            "owner_access": 7,
            "share": []
        },
        "uuid": "d621afcd-9392-4212-a0c3-286184facbf4"
    }
}

[Senthilnathan Murugappan (msenthil)]

FYI deleting the default global acl and restart of api service fixes the issue

[Deepinder Setia (dsetia)]

Senthil, I am unable to reproduce this. My steps

1) Install 3.2 build 12. aaa_mode is not set in testbed.py
2) System comes up without RBAC

root@dsetia-3:~# python /opt/contrail/utils/rbacutil.py --op read
AAA mode is cloud-admin

Oper = read
Name = ['default-global-system-config', 'default-api-access-list']
UUID = None
API Server = 127.0.0.1:8082

api-access-list ['default-global-system-config', 'default-api-access-list'] not found!

3) set aaa_mode to rbac in /etc/contrail/contrail-api.conf
4) Restart API server

root@dsetia-3:~# service contrail-api restart
contrail-api:0: stopped
contrail-api:0: started
root@dsetia-3:~#
root@dsetia-3:~#
root@dsetia-3:~# python /opt/contrail/utils/rbacutil.py --op read
AAA mode is rbac

Oper = read
Name = ['default-global-system-config', 'default-api-access-list']
UUID = None
API Server = 127.0.0.1:8082

Rules (5):
----------
 1 fqname-to-id *:CRUD,
 2 id-to-fqname *:CRUD,
 3 useragent-kv *:CRUD,
 4 documentation *:R,
 5 / *:R,

[Jeba Paulaiyan (jebap)]

Discussed this with Senthil. Not happening in 3.2-13