juju bootstrap failed on openstack because of security groups

[Alexander Jelinek]

Created an image stream according to the instructions (https://juju.is/docs/cloud-image-metadata#heading--create-image-metadata-with-juju) and tried to create a juju controller with the following parameters.

juju bootstrap myopenstack mycontroller --debug --config network=<network-id-vxlan> --config external-network=<network-id> --config use-floating-ip=true --metadata-source=~/simplestreams/images

I get the following error message.

18:52:50 ERROR juju.cmd.juju.commands bootstrap.go:776 failed to bootstrap model: cannot start bootstrap instance: cannot set up groups: failed to create a security group with name: juju-47468ac6-71e8-4aa0-83dc-facf398fb649-373f4fc8-ee94-431f-8a7e-d506b815200e
caused by: request (https://neutron.wgs-wnd-01.lkw-walter.com:9696/v2.0/security-groups) returned unexpected status: 400; error info: {"NeutronError": {"type": "HTTPBadRequest", "message": "Running without keystone AuthN requires that tenant_id is specified", "detail": ""}}

Setting the domain-name field in credentials.yaml to zero did not help in this case and also adding the "--config use-default-secgroup=true" doesn't. I use juju in version 2.7.6.

[Pen Gale (pengale)]

Can you create machines, view endpoints, create networks, create security groups, and do other things w/ your openstack cli client on this OpenStack? This could be Juju mishandling a specific configuration of Keystone et al, or it could be an underlying configuration or credential issue in OpenStack.

[Przemyslaw Hausman (phausman)]

I'm hitting the same error with juju 2.7.8-bionic-amd64.

I'm using the cloud admin account, who is able to perform all actions in OpenStack.

ubuntu@ob80:~/deploy/ussuri/ovn-noha$ . generated/openstack/novarc

ubuntu@ob80:~/deploy/ussuri/ovn-noha$ env | grep OS_
OS_AUTH_URL=http://172.27.80.29:5000/v3
OS_DOMAIN_NAME=admin_domain
OS_REGION_NAME=RegionOne
OS_PROJECT_NAME=admin
OS_PROJECT_DOMAIN_NAME=admin_domain
OS_USER_DOMAIN_NAME=admin_domain
OS_IDENTITY_API_VERSION=3
OS_TENANT_NAME=admin
OS_AUTH_TYPE=password
OS_INTERFACE=public
OS_PASSWORD=<redacted>
OS_USERNAME=admin

ubuntu@ob80:~/deploy/ussuri/ovn-noha$ juju bootstrap --debug --logging-config="<root>=TRACE" --metadata-source /tmp/tmp/simplestreams openstack juju-openstack-controller
[...]
18:16:00 TRACE goose client.go:352 MakeServiceURL: http://neutron.orange.box:9696/v2.0/networks
18:16:00 TRACE goose client.go:352 MakeServiceURL: http://neutron.orange.box:9696/v2.0/security-groups?name=juju-b144130f-4b30-479a-8ca9-0bee2be2e1f1-ecc0d08a-9ab9-49c0-8bb4-f142031aa2e7
18:16:00 TRACE goose client.go:352 MakeServiceURL: http://neutron.orange.box:9696/v2.0/security-groups
18:16:00 ERROR juju.cmd.juju.commands bootstrap.go:776 failed to bootstrap model: cannot start bootstrap instance: cannot set up groups: failed to create a security group with name: juju-b144130f-4b30-479a-8ca9-0bee2be2e1f1-ecc0d08a-9ab9-49c0-8bb4-f142031aa2e7
caused by: request (http://neutron.orange.box:9696/v2.0/security-groups) returned unexpected status: 400; error info: {"NeutronError": {"type": "HTTPBadRequest", "message": "Running without keystone AuthN requires that tenant_id is specified", "detail": ""}}
18:16:00 DEBUG juju.cmd.juju.commands bootstrap.go:777 (error details: [{/build/juju/parts/juju/go/src/github.com/juju/juju/cmd/juju/commands/bootstrap.go:851: failed to bootstrap model} {/build/juju/parts/juju/go/src/github.com/juju/juju/environs/bootstrap/bootstrap.go:611: } {/build/juju/parts/juju/go/src/github.com/juju/juju/environs/bootstrap/bootstrap.go:519: } {/build/juju/parts/juju/go/src/github.com/juju/juju/provider/common/bootstrap.go:57: } {/build/juju/parts/juju/go/src/github.com/juju/juju/provider/common/bootstrap.go:227: cannot start bootstrap instance} {/build/juju/parts/juju/go/src/github.com/juju/juju/provider/openstack/provider.go:1230: } {/build/juju/parts/juju/go/src/github.com/juju/juju/provider/openstack/provider.go:1230: cannot set up groups} {/build/juju/parts/juju/go/src/github.com/juju/juju/provider/openstack/firewaller.go:469: } {failed to create a security group with name: juju-b144130f-4b30-479a-8ca9-0bee2be2e1f1-ecc0d08a-9ab9-49c0-8bb4-f142031aa2e7
caused by: request (http://neutron.orange.box:9696/v2.0/security-groups) returned unexpected status: 400; error info: {"NeutronError": {"type": "HTTPBadRequest", "message": "Running without keystone AuthN requires that tenant_id is specified", "detail": ""}}}])
18:16:00 DEBUG juju.cmd.juju.commands bootstrap.go:1422 cleaning up after failed bootstrap

See full log attached.

This is what I can see in the neutron-api's neutron-server.log:

2020-10-06 18:27:33.270 848 INFO neutron.wsgi [req-2bd179e9-9b48-4087-b3ee-0d63b822fccc 7cb6bcd1...

[Heather Lanigan (hmlanigan)]

You may be hitting: https://bugs.launchpad.net/juju/+bug/1806985

Try removing the value of "domain-name" in your ~/.local/share/juju/credentials.yaml.

[Przemyslaw Hausman (phausman)]

Thanks @hmlanigan! It worked. Unsetting OS_DOMAIN_NAME environment variable did the trick. It feels like a duplicate of LP #1806985 indeed.