| 2019-08-03 07:07:55 |
Radosław Piliszek |
description |
With each CLI operation on keystone, the logs are flooded by similarly-sounding errors. The examples are shown below. This is on a fresh Stein deployment with no config fireworks.
2019-06-21 21:36:09.917685 2019-06-21 21:36:09.917 21 WARNING py.warnings [req-bf9c1264-e003-42fb-a945-975c3eb38e31 aded9f9dbd6a4b03b3e89989466d024f 1fdb93d9dab14b06bad0f3c231e24636 - default default] /var/lib/kolla/venv/lib/python2.7/site-packages/oslo_policy/policy.py:695: UserWarning: Policy "identity:list_system_grants_for_user":"rule:admin_required" was deprecated in S in favor of "identity:list_system_grants_for_user":"role:reader and system_scope:all". Reason:
2019-06-21 21:36:09.917701 As of the Stein release, the assignment API now understands default roles and
2019-06-21 21:36:09.917707 system-scoped tokens, making the API more granular by default without
2019-06-21 21:36:09.917713 compromising security. The new policy defaults account for these changes
2019-06-21 21:36:09.917719 automatically. Be sure to take these new defaults into consideration if you are
2019-06-21 21:36:09.917724 relying on overrides in your deployment for the system assignment API.
2019-06-21 21:36:09.917730 . Either ensure your deployment is ready for the new default or copy/paste the deprecated policy into your policy file and maintain it manually.
2019-06-21 21:36:09.917736 warnings.warn(deprecated_msg)
2019-06-21 21:36:09.917741 : ConfigFilesNotFoundError: Failed to find some config files: policy.d\x1b[00m
2019-06-21 21:36:09.918455 2019-06-21 21:36:09.917 21 WARNING py.warnings [req-bf9c1264-e003-42fb-a945-975c3eb38e31 aded9f9dbd6a4b03b3e89989466d024f 1fdb93d9dab14b06bad0f3c231e24636 - default default] /var/lib/kolla/venv/lib/python2.7/site-packages/oslo_policy/policy.py:695: UserWarning: Policy "identity:delete_region":"rule:admin_required" was deprecated in S in favor of "identity:delete_region":"role:admin and system_scope:all". Reason: As of the Stein release, the region API now understands default roles and system-scoped tokens, making the API more granular without compromising security. The new policies for this API account for these changes automatically. Be sure to take these new defaults into consideration if you are relying on overrides in your deployment for the region API.. Either ensure your deployment is ready for the new default or copy/paste the deprecated policy into your policy file and maintain it manually.
2019-06-21 21:36:09.918471 warnings.warn(deprecated_msg)
2019-06-21 21:36:09.918477 : ConfigFilesNotFoundError: Failed to find some config files: policy.d\x1b[00m
2019-06-21 21:36:09.925396 2019-06-21 21:36:09.924 21 WARNING py.warnings [req-bf9c1264-e003-42fb-a945-975c3eb38e31 aded9f9dbd6a4b03b3e89989466d024f 1fdb93d9dab14b06bad0f3c231e24636 - default default] /var/lib/kolla/venv/lib/python2.7/site-packages/oslo_policy/policy.py:958: UserWarning: Policy identity:list_domains failed scope check. The token used to make the request was project scoped but the policy requires ['system'] scope. This behavior may change in the future where using the intended scope is required
2019-06-21 21:36:09.925412 warnings.warn(msg)
2019-06-21 21:36:09.925418 \x1b[00m |
After each reload, policy deprecation warnings appear for each of keystone's WSGI processes if policy is not customized.
2019-06-21 21:36:09.917685 2019-06-21 21:36:09.917 21 WARNING py.warnings [req-bf9c1264-e003-42fb-a945-975c3eb38e31 aded9f9dbd6a4b03b3e89989466d024f 1fdb93d9dab14b06bad0f3c231e24636 - default default] /var/lib/kolla/venv/lib/python2.7/site-packages/oslo_policy/policy.py:695: UserWarning: Policy "identity:list_system_grants_for_user":"rule:admin_required" was deprecated in S in favor of "identity:list_system_grants_for_user":"role:reader and system_scope:all". Reason:
2019-06-21 21:36:09.917701 As of the Stein release, the assignment API now understands default roles and
2019-06-21 21:36:09.917707 system-scoped tokens, making the API more granular by default without
2019-06-21 21:36:09.917713 compromising security. The new policy defaults account for these changes
2019-06-21 21:36:09.917719 automatically. Be sure to take these new defaults into consideration if you are
2019-06-21 21:36:09.917724 relying on overrides in your deployment for the system assignment API.
2019-06-21 21:36:09.917730 . Either ensure your deployment is ready for the new default or copy/paste the deprecated policy into your policy file and maintain it manually.
2019-06-21 21:36:09.917736 warnings.warn(deprecated_msg)
2019-06-21 21:36:09.917741 : ConfigFilesNotFoundError: Failed to find some config files: policy.d\x1b[00m
2019-06-21 21:36:09.918455 2019-06-21 21:36:09.917 21 WARNING py.warnings [req-bf9c1264-e003-42fb-a945-975c3eb38e31 aded9f9dbd6a4b03b3e89989466d024f 1fdb93d9dab14b06bad0f3c231e24636 - default default] /var/lib/kolla/venv/lib/python2.7/site-packages/oslo_policy/policy.py:695: UserWarning: Policy "identity:delete_region":"rule:admin_required" was deprecated in S in favor of "identity:delete_region":"role:admin and system_scope:all". Reason: As of the Stein release, the region API now understands default roles and system-scoped tokens, making the API more granular without compromising security. The new policies for this API account for these changes automatically. Be sure to take these new defaults into consideration if you are relying on overrides in your deployment for the region API.. Either ensure your deployment is ready for the new default or copy/paste the deprecated policy into your policy file and maintain it manually.
2019-06-21 21:36:09.918471 warnings.warn(deprecated_msg)
2019-06-21 21:36:09.918477 : ConfigFilesNotFoundError: Failed to find some config files: policy.d\x1b[00m
2019-06-21 21:36:09.925396 2019-06-21 21:36:09.924 21 WARNING py.warnings [req-bf9c1264-e003-42fb-a945-975c3eb38e31 aded9f9dbd6a4b03b3e89989466d024f 1fdb93d9dab14b06bad0f3c231e24636 - default default] /var/lib/kolla/venv/lib/python2.7/site-packages/oslo_policy/policy.py:958: UserWarning: Policy identity:list_domains failed scope check. The token used to make the request was project scoped but the policy requires ['system'] scope. This behavior may change in the future where using the intended scope is required
2019-06-21 21:36:09.925412 warnings.warn(msg)
2019-06-21 21:36:09.925418 \x1b[00m |
|
