allow_application_credential_creation contraint issue with suse + mariadb 10.2

[Jean-Philippe Evrard]

In master, a problem seem to have appeared recently.

In our tests, we run the following task [1], running a db_sync --contract.
That task runs the same for centos, ubuntu, and suse.
However on SUSE (maybe a different version of mysql is packaged, I have to check) I get the following issue [2]: Unknown column 'allow_application_credential_creation' in 'CHECK'"

Checking what's happening on that db I can see on SUSE there is well a CHECK constraint on the table [3], that's not present after the whole process on ubuntu [4].

So long story short: Constraint problem prevents renaming the column + distro packaging bug?

[1]: http://logs.openstack.org/90/535790/2/check/openstack-ansible-functional-opensuse-423/5d2b02e/job-output.txt.gz#_2018-01-23_11_35_03_934688
[2]: http://paste.openstack.org/show/650942/
[3]: http://paste.openstack.org/show/650965/
[4]: http://paste.openstack.org/show/650967/

[Jean-Philippe Evrard (jean-philippe-evrard)]

Very close to this: https://bugs.launchpad.net/barbican/+bug/1734329

[Colleen Murphy (krinkle)]

Looks related to this: https://jira.mariadb.org/browse/MDEV-11114

[Colleen Murphy (krinkle)]

Reproduced on opensuse tumbleweed

[Jean-Philippe Evrard (jean-philippe-evrard)]

Yup it looks very related to that!

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/536869

[Jean-Philippe Evrard (jean-philippe-evrard)]

https://review.openstack.org/#/c/536955/ is dealing with the openstack-ansible mariadb 10.1 rollback, in order to have the same versions of mariadb accross all the distros.

[Josh Hershberg (jhershbe)]

Seen on fedora 27 as well, https://review.openstack.org/536869 (comment #5, above) seems to resolve issue

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/536869
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=59b1aacdbaba72df62167793ea2b3ed2ba5b303f
Submitter: Zuul
Branch: master

commit 59b1aacdbaba72df62167793ea2b3ed2ba5b303f
Author: Colleen Murphy <email address hidden>
Date: Tue Jan 23 16:36:15 2018 +0100

    Fix column rename migration for mariadb 10.2

    MariaDB 10.2 introduced an issue where an automatic check constraint is
    applied to boolean columns and is not automatically updated on a column
    rename alter operation[1]. A similar issue preventing dropping such a
    column was already fixed[2], so this patch changes the migration to drop
    and readd the column instead of attempting a column rename.

    Unfortunately since the mistake was already made, it is possible for
    deployments out in the wild to have made it past the expand step and be
    currently stuck in the contract step. To accomodate them, we add the new
    column as part of the contract step if necessary. Again, since there
    should be no data in this table, we don't need to worry about online
    upgrades here.

    [1] https://jira.mariadb.org/browse/MDEV-13508
    [2] https://jira.mariadb.org/browse/MDEV-11114

    Change-Id: Icbd58464182b082854fb5d73ccc93c900ede020c
    Closes-bug: #1744948

[Jean-Philippe Evrard (jean-philippe-evrard)]

https://review.openstack.org/#/c/537411/ is the last part of the rollback to 10.1 for openstack ansible.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone 13.0.0.0b3 development milestone.