Long running overcloud deployments fail with auth error

[Rabi Mishra]

When doing large scale deployments where timeout needs to be set higher than 240 mins,overcloud deployment fails authorization error is the default token expiration(14400s) is reached.

2017-03-18 19:54:22Z [overcloud.Compute]: CREATE_FAILED Resource CREATE failed: Unauthorized: resources[81].resources.NovaCompute: The request you have made requires authentication. (HTTP 401) (Request-ID: req-f3373924-3da4-4349-8b46-b2430ad3dc3f)
2017-03-18 19:54:22Z [overcloud.Compute]: CREATE_FAILED Unauthorized: resources.Compute.resources[81].resources.NovaCompute: The request you have made requires authentication. (HTTP 401) (Request-ID: req- f3373924-3da4-4349-8b46-b2430ad3dc3f)
2017-03-18 19:54:23Z [overcloud]: CREATE_FAILED Resource CREATE failed: Unauthorized: resources.Compute.resources[81].resources.NovaCompute: The request you have made requires authentication. (HTTP 401) (Request-ID: req-f3373924-3da4-4349-8b46-b2430ad3dc3f)

Actual results:
Although timeout was set to 360minutes, stack create fails because of authentication error.

Expected results:
Deployment should continue until timeout for overcloud deploy

This can be handled either by increasing the token expiration in keystone.conf or changing 'reauthentication_auth_method=trusts' in undercloud heat.conf. Probably it would be good to
set the flag to 'trusts' as default for undercloud.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/457837

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/457837
Committed: https://git.openstack.org/cgit/openstack/instack-undercloud/commit/?id=b7dd26647b4940fc6a652ddd09b48d1bd5064356
Submitter: Jenkins
Branch: master

commit b7dd26647b4940fc6a652ddd09b48d1bd5064356
Author: rabi <email address hidden>
Date: Tue Apr 18 23:32:48 2017 +0530

    Make 'reauthentication_auth_method=trusts' the default

    When overcloud deployments take more time than
    the token expiration time set in keystone, this
    default in undercloud would allow for deployment
    to continue till timeout.

    Depends-on: I247b02a50bb46ce16ca120961dd9c3df3e6026fd

    Change-Id: Ifa2aa352482786d9f015f85352820c27f2128e64
    Closes-Bug: #1683983

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/463462

[OpenStack Infra (hudson-openstack)]

Change abandoned by Rabi Mishra (<email address hidden>) on branch: stable/ocata
Review: https://review.openstack.org/463462
Reason: backport not feasible.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/instack-undercloud 7.1.0 release.