Certificate creation for cluster in magnum failed maybe because of keystone/trust

[Kevin Lefevre]

Hi, on OSA master when deploying magnum cluster, instances sign certificates with the Magnum API.

It failed with OSA, here are the Keystone logs :

There is either no auth token in the request or the certificate is
suer is not trusted. No auth context will be set. fill_context /openstack/venvs/keystone-master/lib/python2.7/site-packages/keystone/middleware/auth.py:203
2017-03-06 13:11:40.966 1878 INFO keystone.common.wsgi [req-3f616981-32ba-47e0-ad81-3c4d726edaf9 - - - - -] POST http://172.29.236.100:5000/v3/auth/tokens
2017-03-06 13:11:40.966 1878 WARNING keystone.common.wsgi [req-3f616981-32ba-47e0-ad81-3c4d726edaf9 - - - - -] Invalid input for field 'identity/password/user/password': None is n
ot of type 'string'

After talking with magnum team, the issues is not on devstack, the policy.json for magnum role has been updated recently which is good. I stumble across this patch https://review.openstack.org/#/c/342887/3/templates/keystone.conf.j2 but it does not resolve the issues.

After talking with the magnum team. In devstack, there is a

[keystone_auth]
auth_url = http://192.168.200.12/identity/v3
user_domain_id = default
project_domain_id = default
project_name = service
password = password
username = magnum
auth_type = password

which is not in magnum role. When I add it in magnum.conf it works. I don't really know why, but on devstack it works without this section. It might be a mix of magnum and keystone conf I don't know :/

I'm willing to continue investigating this but need some help

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/442321

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/442321
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible-os_magnum/commit/?id=8329c257dff25686827bd1cc904506d76ad1d12f
Submitter: Jenkins
Branch: master

commit 8329c257dff25686827bd1cc904506d76ad1d12f
Author: ArchiFleKs <email address hidden>
Date: Tue Mar 7 09:51:48 2017 +0100

    Fix Magnum Cluster TLS assets generation

    Change-Id: If18a447a38f0b8ac9f1bf076d4124ccceb018627
    Fixes-Bug: #1670355

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/445000

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/445001

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/445001
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible-os_magnum/commit/?id=c13d29d169db52476267b8a56478ae752bb47dc2
Submitter: Jenkins
Branch: stable/newton

commit c13d29d169db52476267b8a56478ae752bb47dc2
Author: ArchiFleKs <email address hidden>
Date: Tue Mar 7 09:51:48 2017 +0100

    Fix Magnum Cluster TLS assets generation

    Change-Id: If18a447a38f0b8ac9f1bf076d4124ccceb018627
    Fixes-Bug: #1670355
    (cherry picked from commit 8329c257dff25686827bd1cc904506d76ad1d12f)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/445000
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible-os_magnum/commit/?id=464fd73b3e51cd8124e5eb44632030e300c49adf
Submitter: Jenkins
Branch: stable/ocata

commit 464fd73b3e51cd8124e5eb44632030e300c49adf
Author: ArchiFleKs <email address hidden>
Date: Tue Mar 7 09:51:48 2017 +0100

    Fix Magnum Cluster TLS assets generation

    Change-Id: If18a447a38f0b8ac9f1bf076d4124ccceb018627
    Fixes-Bug: #1670355
    (cherry picked from commit 8329c257dff25686827bd1cc904506d76ad1d12f)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/499041

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/499041
Committed: https://git.openstack.org/cgit/openstack/puppet-magnum/commit/?id=b7071d406cb41fab612765a566a3bd791201afeb
Submitter: Jenkins
Branch: master

commit b7071d406cb41fab612765a566a3bd791201afeb
Author: yatin <email address hidden>
Date: Wed Aug 30 12:11:23 2017 +0530

    Fix magnum cluster TLS cert generation

    Magnum cluster's cert creation requires admin_user, admin_password
    and admin_tenant_name to be set in [keystone_authtoken] section.

    Change-Id: Ice8e6537ac6796df032c4c4cf2a194d2214430fd
    Closes-Bug: #1670355

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/pike
Review: https://review.openstack.org/501141

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/501142

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/501143

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/501141
Committed: https://git.openstack.org/cgit/openstack/puppet-magnum/commit/?id=4e8d28249661bfb6fc6a5872bf586b70d8181d16
Submitter: Jenkins
Branch: stable/pike

commit 4e8d28249661bfb6fc6a5872bf586b70d8181d16
Author: yatin <email address hidden>
Date: Wed Aug 30 12:11:23 2017 +0530

    Fix magnum cluster TLS cert generation

    Magnum cluster's cert creation requires admin_user, admin_password
    and admin_tenant_name to be set in [keystone_authtoken] section.

    Change-Id: Ice8e6537ac6796df032c4c4cf2a194d2214430fd
    Closes-Bug: #1670355
    (cherry picked from commit b7071d406cb41fab612765a566a3bd791201afeb)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/501142
Committed: https://git.openstack.org/cgit/openstack/puppet-magnum/commit/?id=7884e8e1700ddc95343d50e19a32bccf06e5c9b7
Submitter: Jenkins
Branch: stable/ocata

commit 7884e8e1700ddc95343d50e19a32bccf06e5c9b7
Author: yatin <email address hidden>
Date: Wed Aug 30 12:11:23 2017 +0530

    Fix magnum cluster TLS cert generation

    Magnum cluster's cert creation requires admin_user, admin_password
    and admin_tenant_name to be set in [keystone_authtoken] section.

    Change-Id: Ice8e6537ac6796df032c4c4cf2a194d2214430fd
    Closes-Bug: #1670355
    (cherry picked from commit b7071d406cb41fab612765a566a3bd791201afeb)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/501143
Committed: https://git.openstack.org/cgit/openstack/puppet-magnum/commit/?id=815d7e6fd0ce02970418f2fa29c72cc7ba3b3517
Submitter: Jenkins
Branch: stable/newton

commit 815d7e6fd0ce02970418f2fa29c72cc7ba3b3517
Author: yatin <email address hidden>
Date: Wed Aug 30 12:11:23 2017 +0530

    Fix magnum cluster TLS cert generation

    Magnum cluster's cert creation requires admin_user, admin_password
    and admin_tenant_name to be set in [keystone_authtoken] section.

    Change-Id: Ice8e6537ac6796df032c4c4cf2a194d2214430fd
    Closes-Bug: #1670355
    (cherry picked from commit b7071d406cb41fab612765a566a3bd791201afeb)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-magnum 10.4.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-magnum 11.3.1 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-magnum 12.0.0 release.