Post-Live Migration Fails Due to NeutronClientException

[Matthew Roark]

As per upstream bug LP#1647451 <https://bugs.launchpad.net/nova/+bug/1647451>, when a live migration completes, it's possible that the Keystone auth token has already expired, causing the subsequent post-live migration steps to fail.

In the nova-compute.log:

2017-02-25 10:19:31.208 9712 INFO nova.virt.libvirt.driver [req-5bed9d56-eebf-44c5-8c92-ce100f1a739d 8c4ba4f39a044426a385e17140c436f
4 40a48d16c5f74000a02543099ee0438e - - -] [instance: 3fc5cc1a-cbd5-45f9-9920-68420e14957e] Migration operation has completed

2017-02-25 10:19:31.209 9712 INFO nova.compute.manager [req-5bed9d56-eebf-44c5-8c92-ce100f1a739d 8c4ba4f39a044426a385e17140c436f4 40
a48d16c5f74000a02543099ee0438e - - -] [instance: 3fc5cc1a-cbd5-45f9-9920-68420e14957e] _post_live_migration() is started..

2017-02-25 10:19:31.756 9712 WARNING nova.virt.libvirt.driver [req-5bed9d56-eebf-44c5-8c92-ce100f1a739d 8c4ba4f39a044426a385e17140c4
36f4 40a48d16c5f74000a02543099ee0438e - - -] [instance: 3fc5cc1a-cbd5-45f9-9920-68420e14957e] Error monitoring migration: Authentication required

[Vitaly Sedelnik (vsedelnik)]

Matthew, do you request backport of upstream fix https://bugs.launchpad.net/nova/+bug/1647451? If yes - to which MOS versions?

[Matthew Roark (mroark)]

Vitaly, yes- preferably for MOS 7.0 on which the incident was reported.

[Alexey Stupnikov (astupnikov)]

I have wrote a script to test migration issues with different token's timeouts (see attachments). The script basically allows you to test live migrations with almost expired token (you should pass the token time-to-live as an argument).

I have found at least 3 different issues with token expiration and none of them are looked like described one (I guess, that it could be the fourth):
https://paste.mirantis.net/show/11356/

I have tested mitaka and IMO it will take too much effort and code changes to fix this issue. I believe that previous releases shouldn't be changed too.

Closing this bug as Won't Fix, as it is useless to backport specified patch, since there are a number of other issues that will not allow you to migrate an instance with almost expired token.