Parameter creates failed on Exec[keystone-manage pki_setup]: creates must be a fully qualified

[Ivan Berezovskiy]

Upstream puppet-keystone patch https://review.openstack.org/#/c/317168 deprecates PKI signing related parameters, it affects Fuel, it breaks its deployment and noop tests with following error:

noop tests:
https://ci.fuel-infra.org/job/master.puppet-openstack.fuel.noop/1269/

 failed should compile into a catalogue without dependency cycles (error during compilation: Parameter creates failed on Exec[keystone-manage pki_setup]: creates must be a fully qualified path at /home/jenkins/workspace/master.puppet-openstack.fuel.noop/deployment/puppet/keystone/manifests/init.pp:895)

deployment tests:
https://ci.fuel-infra.org/job/master.puppet-openstack.fuel-library.pkgs.ubuntu.smoke_neutron/1231

AssertionError: Task 'deploy' has incorrect status. error != ready, 'Deployment has failed. All nodes are finished. Failed tasks: Task[primary-keystone/2] Stopping the deployment process!'

2016-05-19T00:30:54.914035+00:00 notice: Compiled catalog for node-2.test.domain.local in environment production in 4.06 seconds
2016-05-19T00:30:55.140885+00:00 err: Parameter creates failed on Exec[keystone-manage pki_setup]: creates must be a fully qualified path at /etc/puppet/modules/keystone/manifests/init.pp:895
2016-05-19T00:30:55.140885+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/util/errors.rb:106:in `fail'
2016-05-19T00:30:55.140885+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/parameter/path.rb:30:in `validate_path'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/parameter/path.rb:40:in `unsafe_validate'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/parameter.rb:465:in `validate'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/parameter.rb:500:in `value='
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/type.rb:654:in `[]='
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/type.rb:2272:in `block in set_parameters'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/type.rb:2266:in `each'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/type.rb:2266:in `set_parameters'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/type.rb:2222:in `initialize'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/resource.rb:349:in `new'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/resource.rb:349:in `to_ral'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/resource/catalog.rb:520:in `block in to_catalog'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/resource/catalog.rb:512:in `each'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/resource/catalog.rb:512:in `to_catalog'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/resource/catalog.rb:404:in `to_ral'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/application/apply.rb:225:in `block in main'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/context.rb:64:in `override'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet.rb:246:in `override'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/application/apply.rb:198:in `main'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/application/apply.rb:159:in `run_command'
2016-05-19T00:30:55.141450+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/application.rb:381:in `block (2 levels) in run'
2016-05-19T00:30:55.142257+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/application.rb:507:in `plugin_hook'
2016-05-19T00:30:55.142257+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/application.rb:381:in `block in run'
2016-05-19T00:30:55.142257+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/util.rb:496:in `exit_on_fail'
2016-05-19T00:30:55.142257+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/application.rb:381:in `run'
2016-05-19T00:30:55.142257+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/util/command_line.rb:146:in `run'
2016-05-19T00:30:55.142257+00:00 err: /usr/lib/ruby/vendor_ruby/puppet/util/command_line.rb:92:in `execute'
2016-05-19T00:30:55.142257+00:00 err: /usr/bin/puppet:8:in `<main>'
2016-05-19T00:30:58.764146+00:00 notice: (Scope(Class[Openstack_tasks::Keystone::Keystone])) MODULAR: keystone/keystone.pp

[Bug Checker Bot (bug-checker)]

(This check performed automatically)
Please, make sure that bug description contains the following sections filled in with the appropriate data related to the bug you are describing:

actual result

expected result

steps to reproduce

For more detailed information on the contents of each of the listed sections see https://wiki.openstack.org/wiki/Fuel/How_to_contribute#Here_is_how_you_file_a_bug

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/319408

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/319408
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=f1750515bf2981d4dad2b6729087e96de54b7bcc
Submitter: Jenkins
Branch: master

commit f1750515bf2981d4dad2b6729087e96de54b7bcc
Author: Alex Schultz <email address hidden>
Date: Fri May 20 12:28:05 2016 -0600

    Stop setting up pki for keystone

    PKI tokens in keystone are being deprecated in the upstream puppet
    module as part of Change I6c481abce0b917a5d16e207b51b15337f150c908.
    Additionally PKI tokens are not recommanded for production use and we
    use fernet tokens in Fuel. As such this change removed the pki setup as
    part of the default keystone installation.

    DocImpact: PKI tokens setup no longer triggered as part of the default
    keystone installation.

    Change-Id: I931ab8e4d073fd3961e339e629377d756bdbbfb1
    Closes-Bug: #1583557

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/320130

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/320130
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=45228df1dbb33dcd7898ccf2130056838a8e0ed6
Submitter: Jenkins
Branch: master

commit 45228df1dbb33dcd7898ccf2130056838a8e0ed6
Author: Alex Schultz <email address hidden>
Date: Mon May 23 14:29:55 2016 -0600

    Run pki setup when ceph is enabled

    Previously we had removed the PKI setup as part of the keystone since it
    is deprecated upstream. Unfortunately we still rely on it for ceph
    deployments with radosgw. This change puts it back in to resolve the
    blocking failure with ceph. The PKI setup is still deprecated and will
    need to be addressed with an alternative configuration for radosgw.

    Change-Id: I9e9fd454e4be358a622e98fd7335ec937e0a3476
    Closes-Bug: #1584851
    Related-Bug: #1583557