FUEL_ACCESS hash not updated in astute on fuelmaster after changing fuel admin password via Fuel WebUI

[Dmitriy Stremkovskiy]

We have similar bug https://bugs.launchpad.net/fuel/+bug/1555262
How to reproduce:
1) Deploy new fuel
2) By default you should be able to execute:
hash=$(grep -A2 FUEL_ACCESS /etc/fuel/astute.yaml)
fuel_pass=$(echo "${hash}" | grep password | cut -d ':' -f2 | cut -d'"' -f2)
keystone --os-username admin --os-password "${fuel_pass}" --os-tenant-name admin --os-auth-url http://127.0.0.1:35357/v2.0 user-list
3) goto Fuel WebUI
4) change fuel admin password
5) grep -A2 FUEL_ACCESS /etc/fuel/astute.yaml
You see old credentials
and execution of:
hash=$(grep -A2 FUEL_ACCESS /etc/fuel/astute.yaml)
fuel_pass=$(echo "${hash}" | grep password | cut -d ':' -f2 | cut -d'"' -f2)
keystone --os-username admin --os-password "${fuel_pass}" --os-tenant-name admin --os-auth-url http://127.0.0.1:35357/v2.0 user-list
won't work anymore as keystone database updated however /etc/fuel/astute.yaml not.

So if user changes password via WebUI, plugins will not be able to access fuel keystone anymore
Workaround over it - update /etc/fuel/astute.yaml (however this is ugly hack and should not be used commonly)

Expected:
/etc/fuel/astute.yaml update after fuel admin password change via Fuel WebUI

Affected/tested:
FUEL 9 (community)

[Oleg S. Gelbukh (gelbuhos)]

I'm not sure that's exactly the expected behavior here. The file 'astute.yaml' serves as a source for deployment information only. It must not be used by any application (including plugin) as a source of actual auth information for the Nailgun API.

Actual auth credentials are intended to be kept in $HOME/.config/fuel/fuel_client.yaml file, or set as an env variable (KEYSTONE_PASS or OS_PASSWORD), orpassed via command line option every time. All applications that want to authenticate for the Nailgun API should rely on those 3 mechanisms.

[Andrey Grebennikov (agrebennikov)]

Dmitry, could you please explain the usecase of "plugins will not be able to access fuel keystone anymore"? What I could only guess - you want to call to nailgun From the plugin??