OpenStack Keystone Charm

Configure service tokens by default

Bug #1992840 reported by Jorge Merlino
20
This bug affects 3 people
Affects Status Importance Assigned to Milestone
OpenStack Charm Guide
Fix Released
High
Felipe Reyes
OpenStack Cinder Charm
Fix Committed
High
Jorge Merlino
2023.1
Fix Released
High
Unassigned
Ussuri
Fix Released
High
Unassigned
Victoria
Fix Released
High
Unassigned
Wallaby
Fix Released
High
Unassigned
Xena
Fix Released
High
Unassigned
Yoga
Fix Released
High
Unassigned
Zed
Fix Released
High
Unassigned
OpenStack Ironic API Charm
Fix Committed
High
Unassigned
2023.1
Fix Released
High
Unassigned
Ussuri
Fix Released
High
Unassigned
Victoria
Fix Released
High
Unassigned
Wallaby
Fix Released
High
Unassigned
Xena
Fix Released
High
Unassigned
Yoga
Fix Released
High
Unassigned
Zed
Fix Released
High
Unassigned
OpenStack Ironic Conductor Charm
Fix Committed
High
Unassigned
2023.1
Fix Released
High
Unassigned
Ussuri
Fix Released
High
Unassigned
Victoria
Fix Released
High
Unassigned
Wallaby
Fix Released
High
Unassigned
Xena
Fix Released
High
Unassigned
Yoga
Fix Released
High
Unassigned
Zed
Fix Released
High
Unassigned
OpenStack Keystone Charm
Fix Committed
High
Jorge Merlino
2023.1
Fix Released
High
Unassigned
Ussuri
Fix Released
High
Unassigned
Victoria
Fix Released
High
Unassigned
Wallaby
Fix Released
High
Unassigned
Xena
Fix Released
High
Unassigned
Yoga
Fix Released
High
Unassigned
Zed
Fix Released
High
Unassigned
OpenStack Nova Cloud Controller Charm
Fix Committed
High
Jorge Merlino
2023.1
Fix Released
High
Unassigned
Ussuri
Fix Released
High
Unassigned
Victoria
Fix Released
High
Unassigned
Wallaby
Fix Released
High
Unassigned
Xena
Fix Released
High
Unassigned
Yoga
Fix Released
High
Unassigned
Zed
Fix Released
High
Unassigned
OpenStack Nova Compute Charm
Fix Committed
High
Jorge Merlino
2023.1
Fix Released
High
Unassigned
Ussuri
Fix Released
High
Unassigned
Victoria
Fix Released
High
Unassigned
Wallaby
Fix Released
High
Unassigned
Xena
Fix Released
High
Unassigned
Yoga
Fix Released
High
Unassigned
Zed
Fix Released
High
Unassigned

Bug Description

As documented in [1] service tokens are useful to prevent issues with long running services or with requests that take a long time to finish where the user token can expire in the middle of an operation.

For service tokens to work some configuration is needed both on the originating service so that it sends the service tokens and also on the receiving service so that it accepts them.

This bug is created to track patches on several charms so that this configuration can be enabled by default on Juju.

[1] https://docs.openstack.org/cinder/latest/configuration/block-storage/service-token.html

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-keystone (master)

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/charm-keystone/+/861220

Changed in charm-keystone:
status: New → In Progress
Jorge Merlino (jorge-merlino)
Changed in charm-keystone:
assignee: nobody → Jorge Merlino (jorge-merlino)
Changed in charm-cinder:
assignee: nobody → Jorge Merlino (jorge-merlino)
Changed in charm-nova-cloud-controller:
assignee: nobody → Jorge Merlino (jorge-merlino)
Changed in charm-nova-compute:
assignee: nobody → Jorge Merlino (jorge-merlino)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-keystone (master)

Reviewed: https://review.opendev.org/c/openstack/charm-keystone/+/861220
Committed: https://opendev.org/openstack/charm-keystone/commit/55bd7022242857fd8d8c1cc823411021e61bcba4
Submitter: "Zuul (22348)"
Branch: master

commit 55bd7022242857fd8d8c1cc823411021e61bcba4
Author: Jorge Merlino <email address hidden>
Date: Thu Oct 13 16:23:19 2022 -0300

    Add admin-role parameter value to identity relation

    This parameter is added to the relation in order to configure service
    tokens on related services. The role of the service user is required for
    service token validation.

    Closes-Bug: #1992840
    Change-Id: Id7e84d38a9f774179808137548307c9174a87f87

Changed in charm-keystone:
status: In Progress → Fix Committed
OpenStack Infra (hudson-openstack)
Changed in charm-nova-compute:
status: New → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-compute (stable/wallaby)

Fix proposed to branch: stable/wallaby
Review: https://review.opendev.org/c/openstack/charm-nova-compute/+/873922

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-compute (stable/xena)

Fix proposed to branch: stable/xena
Review: https://review.opendev.org/c/openstack/charm-nova-compute/+/873923

Revision history for this message
Michael Quiniola (qthepirate) wrote :

Can we make sure this gets backported to Ussuri?

Revision history for this message
Jorge Merlino (jorge-merlino) wrote :

The plan is to port it all the way to Ussuri, but that will probably take some time.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to charm-nova-compute (master)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-compute/+/877883
Committed: https://opendev.org/openstack/charm-nova-compute/commit/cc5d6234c7060241068d48b47be0f43375cf2b7b
Submitter: "Zuul (22348)"
Branch: master

commit cc5d6234c7060241068d48b47be0f43375cf2b7b
Author: Jorge Merlino <email address hidden>
Date: Sun Mar 19 17:25:55 2023 -0300

    Sync with charm-helpers

    This sync includes this patch to charm helpers:

    https://github.com/juju/charm-helpers/pull/757

    which is an extension of this one:

    https://github.com/juju/charm-helpers/pull/740

    and both are meant to include templates to configure service tokens
    in juju charms as shown in this lp bug:

    Related-Bug: #1992840

    Change-Id: I5a5564f3e50fc09dc905b6a8f49256886d3c6a69

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to charm-cinder (master)

Related fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/charm-cinder/+/879195

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-nova-compute (master)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-compute/+/866053
Committed: https://opendev.org/openstack/charm-nova-compute/commit/3c53110282b97c42a00cee9ee344f32dc8cf29c5
Submitter: "Zuul (22348)"
Branch: master

commit 3c53110282b97c42a00cee9ee344f32dc8cf29c5
Author: Jorge Merlino <email address hidden>
Date: Tue Nov 29 14:36:57 2022 -0300

    Add support for using service tokens

    This patch configures Nova to send a service token along with the
    received user token on requests to other services. This can allow those
    other services to accept the request even if the user token has been
    invalidated since received by Nova. Also with this patch Nova will
    accept request from other services with invalid user tokens but valid
    service tokens. Service tokens exist since Openstack Queens.

    Closes-Bug: #1992840
    Change-Id: I78b43ef77dc1d7b5976ec81ecddf63c9e6c8b6c1

Changed in charm-nova-compute:
status: In Progress → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-compute (stable/zed)

Fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/charm-nova-compute/+/882390

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to charm-cinder (master)

Reviewed: https://review.opendev.org/c/openstack/charm-cinder/+/879195
Committed: https://opendev.org/openstack/charm-cinder/commit/739aed0a14ed842bd8d83f3aaa8654ceeedcc780
Submitter: "Zuul (22348)"
Branch: master

commit 739aed0a14ed842bd8d83f3aaa8654ceeedcc780
Author: Jorge Merlino <email address hidden>
Date: Fri Mar 31 11:59:28 2023 -0300

    Sync with charm-helpers

    This sync includes this patch to charm helpers:

    https://github.com/juju/charm-helpers/pull/757

    which is an extension of this one:

    https://github.com/juju/charm-helpers/pull/740

    and both are meant to include templates to configure service tokens
    in juju charms as shown in this lp bug:

    Related-Bug: #1992840
    Change-Id: Ib273f50d620160f62cbb3d6f5789bf334a7d6333

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-cinder (stable/2023.1)

Fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/charm-cinder/+/883436

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-compute (stable/2023.1)

Fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/charm-nova-compute/+/883404

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to charm-cinder (stable/2023.1)

Related fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/charm-cinder/+/883405

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on charm-cinder (stable/2023.1)

Change abandoned by "Corey Bryant <email address hidden>" on branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/charm-cinder/+/883405
Reason: Probably better to do a sync from stable/2023.1 charm-helpers rather than a cherry-pick

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-cinder (master)

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/charm-cinder/+/883524

Changed in charm-cinder:
status: New → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-nova-compute (stable/2023.1)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-compute/+/883404
Committed: https://opendev.org/openstack/charm-nova-compute/commit/2f2f34c84f3a4992cef86d10176a394d65a5bf10
Submitter: "Zuul (22348)"
Branch: stable/2023.1

commit 2f2f34c84f3a4992cef86d10176a394d65a5bf10
Author: Jorge Merlino <email address hidden>
Date: Tue Nov 29 14:36:57 2022 -0300

    Add support for using service tokens

    This patch configures Nova to send a service token along with the
    received user token on requests to other services. This can allow those
    other services to accept the request even if the user token has been
    invalidated since received by Nova. Also with this patch Nova will
    accept request from other services with invalid user tokens but valid
    service tokens. Service tokens exist since Openstack Queens.

    Closes-Bug: #1992840
    Change-Id: I78b43ef77dc1d7b5976ec81ecddf63c9e6c8b6c1
    (cherry picked from commit 3c53110282b97c42a00cee9ee344f32dc8cf29c5)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-cinder (stable/2023.1)

Fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/charm-cinder/+/883547

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-cinder (master)

Reviewed: https://review.opendev.org/c/openstack/charm-cinder/+/883524
Committed: https://opendev.org/openstack/charm-cinder/commit/81c330b5d87a64a7a9ec601f4dd263b836ee9c01
Submitter: "Zuul (22348)"
Branch: master

commit 81c330b5d87a64a7a9ec601f4dd263b836ee9c01
Author: Jorge Merlino <email address hidden>
Date: Thu May 18 12:21:42 2023 -0300

    Add support for using service tokens

    This patch configures Cinder to send a service token along with the
    received user token on requests to other services. This can allow those
    other services to accept the request even if the user token has been
    invalidated since received by Cinder. Also with this patch Cinder will
    accept request from other services with invalid user tokens but valid
    service tokens. Service tokens exist since Openstack Queens.

    Closes-Bug: #1992840
    Change-Id: I6cb9b1cb257db0b57bd7984c795b8caa1e3b74d9

Changed in charm-cinder:
status: In Progress → Fix Committed
Revision history for this message
Felipe Reyes (freyes) wrote :

based on comment #17 marking the associated task as fix committed.

Revision history for this message
Felipe Reyes (freyes) wrote :

marking the charm-keystone/2023.1 task as invalid since the changes were merged into master before the stable/2023.1 branch was cut.

$ git branch --remote --contains 55bd7022242857fd8d8c1cc823411021e61bcba4
  gerrit/master
  gerrit/stable/2023.1
...

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to charm-nova-cloud-controller (master)

Related fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/883564

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to charm-nova-cloud-controller (master)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/883564
Committed: https://opendev.org/openstack/charm-nova-cloud-controller/commit/9adc198f74a7a5270acf0b295b16f004c41a2d59
Submitter: "Zuul (22348)"
Branch: master

commit 9adc198f74a7a5270acf0b295b16f004c41a2d59
Author: Jorge Merlino <email address hidden>
Date: Thu May 18 16:20:32 2023 -0300

    Sync with charm-helpers

    This sync includes these patches to charm helpers:

    https://github.com/juju/charm-helpers/pull/740
    https://github.com/juju/charm-helpers/pull/757

    Both are meant to include templates to configure service tokens
    in juju charms as shown in this lp bug:

    Related-Bug: #1992840
    Change-Id: I31e95e227f82a4049d5f639516ed4ef5ef52d354

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-cloud-controller (master)

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/883615

Changed in charm-nova-cloud-controller:
status: New → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-nova-cloud-controller (master)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/883615
Committed: https://opendev.org/openstack/charm-nova-cloud-controller/commit/fd810f9afd92904cd66544c00610f830fd337299
Submitter: "Zuul (22348)"
Branch: master

commit fd810f9afd92904cd66544c00610f830fd337299
Author: Felipe Reyes <email address hidden>
Date: Thu May 18 22:24:12 2023 -0400

    Add support for using service tokens

    This patch configures nova-cloud-controller to send a service token
    along with the received user token on requests sent to other services.
    This allows those other services to accept the request even if the user
    token has been invalidated since received by the nova services running
    in nova-cloud-controller units, the same applies for incoming requests
    from other services. Service tokens exist since Openstack Queens.

    Change-Id: I95021600da8af12cb75ef5681fb5af8780ade4f8
    Closes-Bug: #1992840

Changed in charm-nova-cloud-controller:
status: In Progress → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to charm-nova-cloud-controller (stable/2023.1)

Related fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/883989

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-cloud-controller (stable/2023.1)

Fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/883990

Revision history for this message
Felipe Reyes (freyes) wrote :

marking kestone 2023.1 task as 'fix committed' since it got commited before the stable branch was created.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to charm-nova-cloud-controller (stable/2023.1)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/883989
Committed: https://opendev.org/openstack/charm-nova-cloud-controller/commit/a4252d86f19b078d87a2d0dc794ddb9225c701a7
Submitter: "Zuul (22348)"
Branch: stable/2023.1

commit a4252d86f19b078d87a2d0dc794ddb9225c701a7
Author: Felipe Reyes <email address hidden>
Date: Tue May 23 21:14:24 2023 -0400

    Sync with charm-helpers

    This sync includes these patches to charm helpers:

    https://github.com/juju/charm-helpers/pull/740
    https://github.com/juju/charm-helpers/pull/757

    Both are meant to include templates to configure service tokens
    in juju charms as shown in LP: #1992840

    Change-Id: Ib9f0d6a70eb42e6cb441665511fc425cf96a1d1c
    Related-Bug: #1992840

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-cinder (stable/2023.1)

Reviewed: https://review.opendev.org/c/openstack/charm-cinder/+/883436
Committed: https://opendev.org/openstack/charm-cinder/commit/2218b720828e9b067b5f2ae825005f79e60d9da3
Submitter: "Zuul (22348)"
Branch: stable/2023.1

commit 2218b720828e9b067b5f2ae825005f79e60d9da3
Author: Felipe Reyes <email address hidden>
Date: Wed May 17 14:51:03 2023 -0400

    Charm-helpers sync

    Sync up charm-helpers to pick up the change that enables service tokens
    in the keystone section template.

    Closes-Bug: #1992840
    Depends-On: https://review.opendev.org/c/openstack/charm-nova-compute/+/883404
    Change-Id: Id418d8ebbec27f046f6127d8ccf94364900ae923

Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Reviewed: https://review.opendev.org/c/openstack/charm-cinder/+/883547
Committed: https://opendev.org/openstack/charm-cinder/commit/d7b08ddf69ad5ff67d94e11a70a32cfc8f814959
Submitter: "Zuul (22348)"
Branch: stable/2023.1

commit d7b08ddf69ad5ff67d94e11a70a32cfc8f814959
Author: Jorge Merlino <email address hidden>
Date: Thu May 18 12:21:42 2023 -0300

    Add support for using service tokens

    This patch configures Cinder to send a service token along with the
    received user token on requests to other services. This can allow those
    other services to accept the request even if the user token has been
    invalidated since received by Cinder. Also with this patch Cinder will
    accept request from other services with invalid user tokens but valid
    service tokens. Service tokens exist since Openstack Queens.

    Closes-Bug: #1992840
    Func-Test-Pr: https://github.com/openstack-charmers/zaza-openstack-tests/pull/1061
    Change-Id: I6cb9b1cb257db0b57bd7984c795b8caa1e3b74d9
    (cherry picked from commit 81c330b5d87a64a7a9ec601f4dd263b836ee9c01)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-nova-cloud-controller (stable/2023.1)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/883990
Committed: https://opendev.org/openstack/charm-nova-cloud-controller/commit/6dee49e54889f77bd421af787a4cd9aa42e5ba0c
Submitter: "Zuul (22348)"
Branch: stable/2023.1

commit 6dee49e54889f77bd421af787a4cd9aa42e5ba0c
Author: Felipe Reyes <email address hidden>
Date: Thu May 18 22:24:12 2023 -0400

    Add support for using service tokens

    This patch configures nova-cloud-controller to send a service token
    along with the received user token on requests sent to other services.
    This allows those other services to accept the request even if the user
    token has been invalidated since received by the nova services running
    in nova-cloud-controller units, the same applies for incoming requests
    from other services. Service tokens exist since Openstack Queens.

    Change-Id: I95021600da8af12cb75ef5681fb5af8780ade4f8
    Closes-Bug: #1992840
    (cherry picked from commit fd810f9afd92904cd66544c00610f830fd337299)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-ironic-api (master)

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/charm-ironic-api/+/884252

Changed in charm-ironic-api:
status: New → In Progress
Felipe Reyes (freyes)
Changed in charm-guide:
assignee: nobody → Felipe Reyes (freyes)
OpenStack Infra (hudson-openstack)
Changed in charm-guide:
status: New → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-guide (master)

Reviewed: https://review.opendev.org/c/openstack/charm-guide/+/884756
Committed: https://opendev.org/openstack/charm-guide/commit/06096268e6bedf543a2bfb50bf1614e85398bf11
Submitter: "Zuul (22348)"
Branch: master

commit 06096268e6bedf543a2bfb50bf1614e85398bf11
Author: Felipe Reyes <email address hidden>
Date: Tue May 30 13:25:50 2023 -0400

    Add Service Tokens entry to the 2023.1 release notes.

    Closes-Bug: #1992840
    Change-Id: I0df682a49919900081ff2c8d2e4f2ba0ff6b29dc

Changed in charm-guide:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to charm-keystone (stable/zed)

Related fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/charm-keystone/+/885095

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-keystone (stable/zed)

Fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/charm-keystone/+/885096

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to charm-nova-compute (stable/zed)

Related fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/charm-nova-compute/+/885283

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to charm-nova-cloud-controller (stable/zed)

Related fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/885284

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-cloud-controller (stable/zed)

Fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/885285

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to charm-cinder (stable/zed)

Related fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/charm-cinder/+/885286

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-cinder (stable/zed)

Fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/charm-cinder/+/885287

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-ironic-conductor (master)

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/charm-ironic-conductor/+/885542

Changed in charm-ironic-conductor:
status: New → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-ironic-api (master)

Reviewed: https://review.opendev.org/c/openstack/charm-ironic-api/+/884252
Committed: https://opendev.org/openstack/charm-ironic-api/commit/02b7180a6b9cd9c22c4b672ae8510ea14af5e0df
Submitter: "Zuul (22348)"
Branch: master

commit 02b7180a6b9cd9c22c4b672ae8510ea14af5e0df
Author: Felipe Reyes <email address hidden>
Date: Wed May 24 12:28:36 2023 -0400

    Add support for using service tokens

    This patch configures ironic-api to send a service token along with the
    received user token on requests to other services. This allow those
    other services to accept the request even if the user token has been
    invalidated since received by Ironic. Also with this patch Ironic will
    accept request from other services with invalid user tokens but valid
    service tokens.

    Closes-Bug: #1992840
    Change-Id: Ic84e4706b93c38916e89b91dfc30bf32396e5213

Changed in charm-ironic-api:
status: In Progress → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-ironic-api (stable/2023.1)

Fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/charm-ironic-api/+/885473

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-ironic-conductor (master)

Reviewed: https://review.opendev.org/c/openstack/charm-ironic-conductor/+/885542
Committed: https://opendev.org/openstack/charm-ironic-conductor/commit/c7dda3f3a8c4b3e5445c727590eb44e4a6482cc3
Submitter: "Zuul (22348)"
Branch: master

commit c7dda3f3a8c4b3e5445c727590eb44e4a6482cc3
Author: Felipe Reyes <email address hidden>
Date: Wed Jun 7 15:19:56 2023 -0400

    Add support for using service tokens

    This patch configures ironic-conductor to send a service token along
    with the received user token on requests to other services. This allow
    those other services to accept the request even if the user token has
    been invalidated since received by Ironic. Also with this patch Ironic
    will accept request from other services with invalid user tokens but
    valid service tokens.

    Closes-Bug: #1992840
    Change-Id: Ie94b5ce9ba9d015a31a78bb71ce7ca786377d6d9

Changed in charm-ironic-conductor:
status: In Progress → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-ironic-conductor (stable/2023.1)

Fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/charm-ironic-conductor/+/885474

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-ironic-conductor (stable/zed)

Fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/charm-ironic-conductor/+/885475

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-ironic-api (stable/zed)

Fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/charm-ironic-api/+/885476

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-ironic-conductor (stable/2023.1)

Reviewed: https://review.opendev.org/c/openstack/charm-ironic-conductor/+/885474
Committed: https://opendev.org/openstack/charm-ironic-conductor/commit/2af6acd1a784b45b2017ab93419403d95e479252
Submitter: "Zuul (22348)"
Branch: stable/2023.1

commit 2af6acd1a784b45b2017ab93419403d95e479252
Author: Felipe Reyes <email address hidden>
Date: Wed Jun 7 15:19:56 2023 -0400

    Add support for using service tokens

    This patch configures ironic-conductor to send a service token along
    with the received user token on requests to other services. This allow
    those other services to accept the request even if the user token has
    been invalidated since received by Ironic. Also with this patch Ironic
    will accept request from other services with invalid user tokens but
    valid service tokens.

    Update src/build.lock to get backported patches into
    charm-helpers@stable/antelope

    Closes-Bug: #1992840
    Change-Id: Ie94b5ce9ba9d015a31a78bb71ce7ca786377d6d9
    (cherry picked from commit c7dda3f3a8c4b3e5445c727590eb44e4a6482cc3)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to charm-keystone (stable/yoga)

Related fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/charm-keystone/+/886011

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-keystone (stable/yoga)

Fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/charm-keystone/+/886012

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to charm-nova-cloud-controller (stable/yoga)

Related fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/886013

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-cloud-controller (stable/yoga)

Fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/886014

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to charm-nova-compute (stable/yoga)

Related fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/charm-nova-compute/+/886015

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-nova-compute (stable/yoga)

Fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/charm-nova-compute/+/886016

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to charm-cinder (stable/yoga)

Related fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/charm-cinder/+/886017

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-cinder (stable/yoga)

Fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/charm-cinder/+/886018

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-ironic-api (stable/yoga)

Fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/charm-ironic-api/+/886019

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to charm-ironic-conductor (stable/yoga)

Fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/charm-ironic-conductor/+/886029

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to charm-cinder (stable/zed)

Reviewed: https://review.opendev.org/c/openstack/charm-cinder/+/885286
Committed: https://opendev.org/openstack/charm-cinder/commit/1299b2da5611ba331ecc47c01e387937565aaad4
Submitter: "Zuul (22348)"
Branch: stable/zed

commit 1299b2da5611ba331ecc47c01e387937565aaad4
Author: Felipe Reyes <email address hidden>
Date: Mon Jun 5 09:27:24 2023 -0400

    charm-helpers sync

    Synchronize charm-helpers to get service token related patches.

    Related-Bug: #1992840
    Change-Id: I8f26519afb36a0c54c35c8e0b8d0800893f22ffc

tags: added: in-stable-zed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-ironic-api (stable/2023.1)

Reviewed: https://review.opendev.org/c/openstack/charm-ironic-api/+/885473
Committed: https://opendev.org/openstack/charm-ironic-api/commit/44cd40185aeef5e5e91eadd15f0c26798ed1dfc8
Submitter: "Zuul (22348)"
Branch: stable/2023.1

commit 44cd40185aeef5e5e91eadd15f0c26798ed1dfc8
Author: Felipe Reyes <email address hidden>
Date: Wed May 24 12:28:36 2023 -0400

    Add support for using service tokens

    This patch configures ironic-api to send a service token along with the
    received user token on requests to other services. This allow those
    other services to accept the request even if the user token has been
    invalidated since received by Ironic. Also with this patch Ironic will
    accept request from other services with invalid user tokens but valid
    service tokens.

    Update src/build.lock to get backported patches into
    charm-helpers@stable/antelope

    Closes-Bug: #1992840
    Change-Id: Ic84e4706b93c38916e89b91dfc30bf32396e5213
    (cherry picked from commit 02b7180a6b9cd9c22c4b672ae8510ea14af5e0df)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-cinder (stable/zed)

Reviewed: https://review.opendev.org/c/openstack/charm-cinder/+/885287
Committed: https://opendev.org/openstack/charm-cinder/commit/4f2a3524462b7f4be4f65077d7f8840a15db4c25
Submitter: "Zuul (22348)"
Branch: stable/zed

commit 4f2a3524462b7f4be4f65077d7f8840a15db4c25
Author: Jorge Merlino <email address hidden>
Date: Thu May 18 12:21:42 2023 -0300

    Add support for using service tokens

    This patch configures Cinder to send a service token along with the
    received user token on requests to other services. This can allow those
    other services to accept the request even if the user token has been
    invalidated since received by Cinder. Also with this patch Cinder will
    accept request from other services with invalid user tokens but valid
    service tokens. Service tokens exist since Openstack Queens.

    Closes-Bug: #1992840
    Change-Id: I6cb9b1cb257db0b57bd7984c795b8caa1e3b74d9
    (cherry picked from commit 81c330b5d87a64a7a9ec601f4dd263b836ee9c01)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to charm-keystone (stable/zed)

Reviewed: https://review.opendev.org/c/openstack/charm-keystone/+/885095
Committed: https://opendev.org/openstack/charm-keystone/commit/1b940a11020d5ed264670420c48aef2b6013dfd4
Submitter: "Zuul (22348)"
Branch: stable/zed

commit 1b940a11020d5ed264670420c48aef2b6013dfd4
Author: Felipe Reyes <email address hidden>
Date: Thu Jun 1 16:16:37 2023 -0400

    charm-helpers sync

    Synchronize charm-helpers to get service token related patches.

    Change-Id: Ic2fa24e864a495e80b6ffa024d3ba55df84f34e0
    Related-Bug: #1992840

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-keystone (stable/zed)

Reviewed: https://review.opendev.org/c/openstack/charm-keystone/+/885096
Committed: https://opendev.org/openstack/charm-keystone/commit/70ef4f388a8d76a4368b6250817046d37bb73513
Submitter: "Zuul (22348)"
Branch: stable/zed

commit 70ef4f388a8d76a4368b6250817046d37bb73513
Author: Jorge Merlino <email address hidden>
Date: Thu Oct 13 16:23:19 2022 -0300

    Add admin-role parameter value to identity relation

    This parameter is added to the relation in order to configure service
    tokens on related services. The role of the service user is required for
    service token validation.

    Closes-Bug: #1992840
    Change-Id: Id7e84d38a9f774179808137548307c9174a87f87
    (cherry picked from commit 55bd7022242857fd8d8c1cc823411021e61bcba4)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-ironic-conductor (stable/zed)

Reviewed: https://review.opendev.org/c/openstack/charm-ironic-conductor/+/885475
Committed: https://opendev.org/openstack/charm-ironic-conductor/commit/aa73b57b9c4bffd376ca65869df964bc205accef
Submitter: "Zuul (22348)"
Branch: stable/zed

commit aa73b57b9c4bffd376ca65869df964bc205accef
Author: Felipe Reyes <email address hidden>
Date: Wed Jun 7 15:19:56 2023 -0400

    Add support for using service tokens

    This patch configures ironic-conductor to send a service token along
    with the received user token on requests to other services. This allow
    those other services to accept the request even if the user token has
    been invalidated since received by Ironic. Also with this patch Ironic
    will accept request from other services with invalid user tokens but
    valid service tokens.

    Update src/build.lock to get backported patches into
    charm-helpers@stable/zed

    Closes-Bug: #1992840
    Change-Id: Ie94b5ce9ba9d015a31a78bb71ce7ca786377d6d9
    (cherry picked from commit c7dda3f3a8c4b3e5445c727590eb44e4a6482cc3)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to charm-nova-cloud-controller (stable/zed)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/885284
Committed: https://opendev.org/openstack/charm-nova-cloud-controller/commit/8359987460c47c6d5d9b618b43f59cda19526881
Submitter: "Zuul (22348)"
Branch: stable/zed

commit 8359987460c47c6d5d9b618b43f59cda19526881
Author: Felipe Reyes <email address hidden>
Date: Mon Jun 5 09:25:49 2023 -0400

    charm-helpers sync

    Synchronize charm-helpers to get service token related patches.

    Change-Id: I999900d6e68ceef901b8d34e54d32fa06e849f72
    Related-Bug: #1992840

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-nova-cloud-controller (stable/zed)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/885285
Committed: https://opendev.org/openstack/charm-nova-cloud-controller/commit/54e27a1f0c11075ac7427fdb592c2c521f7c15e6
Submitter: "Zuul (22348)"
Branch: stable/zed

commit 54e27a1f0c11075ac7427fdb592c2c521f7c15e6
Author: Felipe Reyes <email address hidden>
Date: Thu May 18 22:24:12 2023 -0400

    Add support for using service tokens

    This patch configures nova-cloud-controller to send a service token
    along with the received user token on requests sent to other services.
    This allows those other services to accept the request even if the user
    token has been invalidated since received by the nova services running
    in nova-cloud-controller units, the same applies for incoming requests
    from other services. Service tokens exist since Openstack Queens.

    Change-Id: I95021600da8af12cb75ef5681fb5af8780ade4f8
    Closes-Bug: #1992840
    (cherry picked from commit fd810f9afd92904cd66544c00610f830fd337299)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-ironic-api (stable/zed)

Reviewed: https://review.opendev.org/c/openstack/charm-ironic-api/+/885476
Committed: https://opendev.org/openstack/charm-ironic-api/commit/a2ef3dda1001d591b934e7c5e361f708d344bdcb
Submitter: "Zuul (22348)"
Branch: stable/zed

commit a2ef3dda1001d591b934e7c5e361f708d344bdcb
Author: Felipe Reyes <email address hidden>
Date: Wed May 24 12:28:36 2023 -0400

    Add support for using service tokens

    This patch configures ironic-api to send a service token along with the
    received user token on requests to other services. This allow those
    other services to accept the request even if the user token has been
    invalidated since received by Ironic. Also with this patch Ironic will
    accept request from other services with invalid user tokens but valid
    service tokens.

    Update src/build.lock to get backported patches into
    charm-helpers@stable/zed

    Closes-Bug: #1992840
    Change-Id: Ic84e4706b93c38916e89b91dfc30bf32396e5213
    (cherry picked from commit 02b7180a6b9cd9c22c4b672ae8510ea14af5e0df)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to charm-cinder (stable/yoga)

Reviewed: https://review.opendev.org/c/openstack/charm-cinder/+/886017
Committed: https://opendev.org/openstack/charm-cinder/commit/68752c604e7a6541eb95fa3060b35222d5be3424
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit 68752c604e7a6541eb95fa3060b35222d5be3424
Author: Felipe Reyes <email address hidden>
Date: Tue Jun 13 14:39:01 2023 -0400

    charm-helpers sync

    Synchronize charm-helpers to get service token related patches.

    Related-Bug: #1992840
    Change-Id: Iba36e4b97f542c4c7727a1851c3e68b049a25f85

tags: added: in-stable-yoga
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-cinder (stable/yoga)

Reviewed: https://review.opendev.org/c/openstack/charm-cinder/+/886018
Committed: https://opendev.org/openstack/charm-cinder/commit/b96c85f5a6b8e3d173a4f810fd4d5fd82737795e
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit b96c85f5a6b8e3d173a4f810fd4d5fd82737795e
Author: Jorge Merlino <email address hidden>
Date: Thu May 18 12:21:42 2023 -0300

    Add support for using service tokens

    This patch configures Cinder to send a service token along with the
    received user token on requests to other services. This can allow those
    other services to accept the request even if the user token has been
    invalidated since received by Cinder. Also with this patch Cinder will
    accept request from other services with invalid user tokens but valid
    service tokens. Service tokens exist since Openstack Queens.

    Closes-Bug: #1992840
    Change-Id: I6cb9b1cb257db0b57bd7984c795b8caa1e3b74d9
    (cherry picked from commit 81c330b5d87a64a7a9ec601f4dd263b836ee9c01)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to charm-nova-cloud-controller (stable/yoga)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/886013
Committed: https://opendev.org/openstack/charm-nova-cloud-controller/commit/ef45a47655ecd78ef141f86756e46d0fe90b99f7
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit ef45a47655ecd78ef141f86756e46d0fe90b99f7
Author: Felipe Reyes <email address hidden>
Date: Tue Jun 13 14:36:26 2023 -0400

    charm-helpers sync

    Synchronize charm-helpers to get service token related patches.

    Change-Id: Ic581a63abdbce5a71a45f9390c0615942e6f0876
    Related-Bug: #1992840

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-ironic-conductor (stable/yoga)

Reviewed: https://review.opendev.org/c/openstack/charm-ironic-conductor/+/886029
Committed: https://opendev.org/openstack/charm-ironic-conductor/commit/f2b4c4b6540752e8de1b9f2b8d04c5e2f1b59a98
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit f2b4c4b6540752e8de1b9f2b8d04c5e2f1b59a98
Author: Felipe Reyes <email address hidden>
Date: Wed Jun 7 15:19:56 2023 -0400

    Add support for using service tokens

    This patch configures ironic-conductor to send a service token along
    with the received user token on requests to other services. This allow
    those other services to accept the request even if the user token has
    been invalidated since received by Ironic. Also with this patch Ironic
    will accept request from other services with invalid user tokens but
    valid service tokens.

    Closes-Bug: #1992840
    Change-Id: Ie94b5ce9ba9d015a31a78bb71ce7ca786377d6d9
    (cherry picked from commit c7dda3f3a8c4b3e5445c727590eb44e4a6482cc3)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to charm-keystone (stable/yoga)

Reviewed: https://review.opendev.org/c/openstack/charm-keystone/+/886011
Committed: https://opendev.org/openstack/charm-keystone/commit/51cdd61fdcb4a27c58a36e141b4ca46dbe2167ac
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit 51cdd61fdcb4a27c58a36e141b4ca46dbe2167ac
Author: Felipe Reyes <email address hidden>
Date: Tue Jun 13 14:33:42 2023 -0400

    charm-helpers sync

    Synchronize charm-helpers to get service token related patches.

    Change-Id: Ia8c65639f82bf881349f0319eca19510eb1ce53b
    Related-Bug: #1992840

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-keystone (stable/yoga)

Reviewed: https://review.opendev.org/c/openstack/charm-keystone/+/886012
Committed: https://opendev.org/openstack/charm-keystone/commit/d3246b4c6e3e6274c67f49b282f1077373c3247a
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit d3246b4c6e3e6274c67f49b282f1077373c3247a
Author: Jorge Merlino <email address hidden>
Date: Thu Oct 13 16:23:19 2022 -0300

    Add admin-role parameter value to identity relation

    This parameter is added to the relation in order to configure service
    tokens on related services. The role of the service user is required for
    service token validation.

    Closes-Bug: #1992840
    Change-Id: Id7e84d38a9f774179808137548307c9174a87f87
    (cherry picked from commit 55bd7022242857fd8d8c1cc823411021e61bcba4)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to charm-nova-compute (stable/zed)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-compute/+/885283
Committed: https://opendev.org/openstack/charm-nova-compute/commit/8df5e9356f5972c0eb2db7f863fe93f485f84b95
Submitter: "Zuul (22348)"
Branch: stable/zed

commit 8df5e9356f5972c0eb2db7f863fe93f485f84b95
Author: Felipe Reyes <email address hidden>
Date: Mon Jun 5 09:18:19 2023 -0400

    charm-helpers sync

    Synchronize charm-helpers to get service token related patches.

    Change-Id: Iadd0d4c408460db77687fc89d8b8f75b7fd5b817
    Related-Bug: #1992840

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-nova-compute (stable/zed)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-compute/+/882390
Committed: https://opendev.org/openstack/charm-nova-compute/commit/d9dc048a514546c481d1a1acb87f7f52a31a4a39
Submitter: "Zuul (22348)"
Branch: stable/zed

commit d9dc048a514546c481d1a1acb87f7f52a31a4a39
Author: Jorge Merlino <email address hidden>
Date: Tue Nov 29 14:36:57 2022 -0300

    Add support for using service tokens

    This patch configures Nova to send a service token along with the
    received user token on requests to other services. This can allow those
    other services to accept the request even if the user token has been
    invalidated since received by Nova. Also with this patch Nova will
    accept request from other services with invalid user tokens but valid
    service tokens. Service tokens exist since Openstack Queens.

    Closes-Bug: #1992840
    Change-Id: I78b43ef77dc1d7b5976ec81ecddf63c9e6c8b6c1
    (cherry picked from commit 3c53110282b97c42a00cee9ee344f32dc8cf29c5)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to charm-nova-compute (stable/yoga)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-compute/+/886015
Committed: https://opendev.org/openstack/charm-nova-compute/commit/e020bb8c520dacb5daaab79c807d81f3c222a9e8
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit e020bb8c520dacb5daaab79c807d81f3c222a9e8
Author: Felipe Reyes <email address hidden>
Date: Tue Jun 13 14:37:59 2023 -0400

    charm-helpers sync

    Synchronize charm-helpers to get service token related patches.

    Change-Id: I5245a7728eb429c7b2c27c14792be24debee58c5
    Related-Bug: #1992840

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-nova-compute (stable/yoga)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-compute/+/886016
Committed: https://opendev.org/openstack/charm-nova-compute/commit/b54f6701d6cc408990add5fdb81bac1c74aa20db
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit b54f6701d6cc408990add5fdb81bac1c74aa20db
Author: Jorge Merlino <email address hidden>
Date: Tue Nov 29 14:36:57 2022 -0300

    Add support for using service tokens

    This patch configures Nova to send a service token along with the
    received user token on requests to other services. This can allow those
    other services to accept the request even if the user token has been
    invalidated since received by Nova. Also with this patch Nova will
    accept request from other services with invalid user tokens but valid
    service tokens. Service tokens exist since Openstack Queens.

    Closes-Bug: #1992840
    Change-Id: I78b43ef77dc1d7b5976ec81ecddf63c9e6c8b6c1
    (cherry picked from commit 3c53110282b97c42a00cee9ee344f32dc8cf29c5)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-nova-cloud-controller (stable/yoga)

Reviewed: https://review.opendev.org/c/openstack/charm-nova-cloud-controller/+/886014
Committed: https://opendev.org/openstack/charm-nova-cloud-controller/commit/98b637d8e9d9df19cd001e582f846e2046fba1bd
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit 98b637d8e9d9df19cd001e582f846e2046fba1bd
Author: Felipe Reyes <email address hidden>
Date: Thu May 18 22:24:12 2023 -0400

    Add support for using service tokens

    This patch configures nova-cloud-controller to send a service token
    along with the received user token on requests sent to other services.
    This allows those other services to accept the request even if the user
    token has been invalidated since received by the nova services running
    in nova-cloud-controller units, the same applies for incoming requests
    from other services. Service tokens exist since Openstack Queens.

    Change-Id: I95021600da8af12cb75ef5681fb5af8780ade4f8
    Closes-Bug: #1992840
    (cherry picked from commit fd810f9afd92904cd66544c00610f830fd337299)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to charm-ironic-api (stable/yoga)

Reviewed: https://review.opendev.org/c/openstack/charm-ironic-api/+/886019
Committed: https://opendev.org/openstack/charm-ironic-api/commit/fca337274407d8c145c33fe5ce4805497878eb04
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit fca337274407d8c145c33fe5ce4805497878eb04
Author: Felipe Reyes <email address hidden>
Date: Wed May 24 12:28:36 2023 -0400

    Add support for using service tokens

    This patch configures ironic-api to send a service token along with the
    received user token on requests to other services. This allow those
    other services to accept the request even if the user token has been
    invalidated since received by Ironic. Also with this patch Ironic will
    accept request from other services with invalid user tokens but valid
    service tokens.

    Update src/build.lock to get backported patches into
    charm-helpers@stable/yoga

    Closes-Bug: #1992840
    Change-Id: Ic84e4706b93c38916e89b91dfc30bf32396e5213
    (cherry picked from commit 02b7180a6b9cd9c22c4b672ae8510ea14af5e0df)

Corey Bryant (corey.bryant)
Changed in charm-cinder:
importance: Undecided → High
status: Fix Committed → Fix Released
Changed in charm-guide:
importance: Undecided → High
Changed in charm-ironic-api:
importance: Undecided → High
status: Fix Committed → Fix Released
Changed in charm-ironic-conductor:
importance: Undecided → High
status: Fix Committed → Fix Released
Changed in charm-keystone:
importance: Undecided → High
status: Fix Committed → Fix Released
Changed in charm-nova-cloud-controller:
importance: Undecided → High
status: Fix Committed → Fix Released
Changed in charm-nova-compute:
importance: Undecided → High
status: Fix Committed → Fix Released
Changed in charm-cinder:
status: Fix Released → Fix Committed
Changed in charm-ironic-api:
status: Fix Released → Fix Committed
Changed in charm-ironic-conductor:
status: Fix Released → Fix Committed
Changed in charm-keystone:
status: Fix Released → Fix Committed
Changed in charm-nova-cloud-controller:
status: Fix Released → Fix Committed
Changed in charm-nova-compute:
status: Fix Released → Fix Committed
Revision history for this message
Michael Quiniola (qthepirate) wrote :

We have an issue with this now:

Focal/Ussuri
User can no longer create volume backed instances but can create ephemeral instances.
We tested creating a volume and creating an instance from that volume as well.

The workaround was to comment out the service_user section in nova.conf. After which we were able to continue creating volume-backed instances.

Revision history for this message
Felipe Reyes (freyes) wrote : Re: [Bug 1992840] Re: Configure service tokens by default

> Focal/Ussuri
> User can no longer create volume backed instances but can create ephemeral instances.
> We tested creating a volume and creating an instance from that volume as well.
>
> The workaround was to comment out the service_user section in nova.conf.
> After which we were able to continue creating volume-backed instances.

can you file a new bug with this issue?, please, make sure to include the charms revisions deployed
and the packages installed.

Revision history for this message
Michael Quiniola (qthepirate) wrote :

> can you file a new bug with this issue?, please, make sure to include the charms revisions deployed
> and the packages installed.

I just saw this. Will file a new bug with this issue.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.