Running upgrades as wrong ssh user: file ownership issues, deployed-server incompatibility

[Jiří Stránský]

We still default to running upgrades as heat-admin rather than tripleo-admin. Deployment already only uses tripleo-admin.

This causes file ownership problems (Ceph-related tasks fail on upgrade converge due to heat-admin vs. tripleo-admin discrepancy) and is likely incompatible with deployed-server environments (heat-admin usually only exists when we manage servers via Nova).

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/614752

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/614752
Committed: https://git.openstack.org/cgit/openstack/python-tripleoclient/commit/?id=479a530656294eebb3e1b5f5d07e69988c56adef
Submitter: Zuul
Branch: master

commit 479a530656294eebb3e1b5f5d07e69988c56adef
Author: Jiri Stransky <email address hidden>
Date: Thu Nov 1 13:20:51 2018 +0100

    Always run upgrades/updates as tripleo-admin

    This change has two main parts:

    * Ensure that when we ssh *via Mistral*, we always use
      tripleo-admin. `--ssh-user` argument to any update/upgrade run
      commands is now deprecated. The reason i didn't remove it completely
      is that how current upgrade commands use ssh needed some mental
      untangling, and i want us to keep an easy way back in case my
      understanding is wrong here. Deprecation seems safer than outright
      removal.

    * On upgrade prepare and FFWD prepare, make sure that the
      tripleo-admin user is created and authorized.

      Note that for tripleo-admin creation and authorization, the
      `--overcloud-ssh-user` parameter is used, and that one still
      defaults to `heat-admin`, which is correct. So initially we connect
      via whatever credentials user provided (which works on Nova+Ironic
      envs unless user customized it), and from that point on we always
      use tripleo-admin, which is common for all environments regardless
      of any user customizations. This is how deployment already works
      now, and after this change upgrades will work that way too.

    Change-Id: Ib1a75a0a3f3b2a3bec00d8820c3a097620fa6256
    Closes-Bug: #1801066

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/rocky
Review: https://review.openstack.org/615829

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/615829
Committed: https://git.openstack.org/cgit/openstack/python-tripleoclient/commit/?id=26a3e5aa694893a3228fc25e668988feb3b7fd5a
Submitter: Zuul
Branch: stable/rocky

commit 26a3e5aa694893a3228fc25e668988feb3b7fd5a
Author: Jiri Stransky <email address hidden>
Date: Thu Nov 1 13:20:51 2018 +0100

    Always run upgrades/updates as tripleo-admin

    This change has two main parts:

    * Ensure that when we ssh *via Mistral*, we always use
      tripleo-admin. `--ssh-user` argument to any update/upgrade run
      commands is now deprecated. The reason i didn't remove it completely
      is that how current upgrade commands use ssh needed some mental
      untangling, and i want us to keep an easy way back in case my
      understanding is wrong here. Deprecation seems safer than outright
      removal.

    * On upgrade prepare and FFWD prepare, make sure that the
      tripleo-admin user is created and authorized.

      Note that for tripleo-admin creation and authorization, the
      `--overcloud-ssh-user` parameter is used, and that one still
      defaults to `heat-admin`, which is correct. So initially we connect
      via whatever credentials user provided (which works on Nova+Ironic
      envs unless user customized it), and from that point on we always
      use tripleo-admin, which is common for all environments regardless
      of any user customizations. This is how deployment already works
      now, and after this change upgrades will work that way too.

    Change-Id: Ib1a75a0a3f3b2a3bec00d8820c3a097620fa6256
    Closes-Bug: #1801066
    (cherry picked from commit 479a530656294eebb3e1b5f5d07e69988c56adef)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/python-tripleoclient 11.2.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/python-tripleoclient 10.6.1 release.