It appears to be that during cluster operations /root/openrc file is used for some Neutron-related scripts, for example for q-agent-cleanup.py.
It is unacceptable for two reasons:
1) /root/ is not a place for service configuration files, and no linux sysadmin in the world expects it. So, it can be easily modified / removed by sysadmin without expectation that HA failover fails to work properly afterwards.
2) Creds hardcoded in the file can be changed by admin in Horizon. In this case, file won't be updated, and again, scripts which use it - will simply fail.
I've ran grep in the repo. It's probably fine to use this file for deployment, as it is managed and updated by puppet, but not for operations like HA failover. Every occurrence of /root/openrc has to be whether removed and service token used instead (which won't get change by the user in Horizon), or explained why it's Ok to use it.
Also, we have to consider scale-up. If user changes default password after initial deployment in horizon, then adds 2 controllers and deploys them. Will deployment pass? If it still relies on openrc with settings defined before initial deployment, then it will fail for sure. Please investigate it.
(env)mike@cvr-air ~/dev/fuel-library (git)-[master]-% grep -r "/root/openrc" *
deployment/puppet/ceph/examples/site.pp:# keystone. This is commonly inside /root/openrc on controllers
deployment/puppet/cluster/files/q-agent-cleanup.py: parser.add_argument("-c", "--auth-config", dest="authconf", default="/root/openrc",
deployment/puppet/neutron/examples/create_network.sh:source /root/openrc
deployment/puppet/openstack/files/filter_quantum_ports.py: parser.add_option("-c", "--auth-config", dest="authconf", default="/root/openrc",
deployment/puppet/openstack/manifests/auth_file.pp: file { '/root/openrc':
deployment/puppet/openstack/manifests/corosync.pp: #require =>[Package['corosync'],File['/root/openrc']],
deployment/puppet/openstack/manifests/network.pp: onlyif => "test -r /root/openrc",
deployment/puppet/openstack/manifests/network.pp: command => "bash -c \"source /root/openrc ; neutron net-list --http-timeout=4 \" 2>&1 > /dev/null",
deployment/puppet/openstack/manifests/test_file.pp:# variables. Optional. Defaults to /root/openrc.
deployment/puppet/openstack/manifests/test_file.pp: $rc_file_path = '/root/openrc',
deployment/puppet/openstack/README.md: /root/openrc
deployment/puppet/openstack/README.md: 1. Ensure that your authentication information is stored in /root/openrc.
deployment/puppet/openstack/README.md: source /root/openrc
I would not consider this bug as a critical one. First of all, if you change administrator user/password, then you need just to update openrc file on all the controllers. In case you want to do it automatically, using FUEL, you can use FUEL CLI and update access hash for admin user credentials, upload it and redeploy controller nodes by issuing HTTP PUT request to http://<fuel>: