Cannot invoke cli commands

[Richard Jones]

The developer documentation at http://docs.openstack.org/developer/openstack-ansible/install-guide/install-openstack-verify.html does not work when applied to an actual openstack-ansible installation from approximately 10 days ago.

The openrc configuration does not appear to be correct for invoking any OpenStack cli commands:

root@osad:~# lxc-attach -n aio1_utility_container-20104744
root@aio1_utility_container-20104744:~# source openrc
root@aio1_utility_container-20104744:~# keystone user-list
/usr/local/lib/python2.7/dist-packages/keystoneclient/shell.py:64: DeprecationWarning: The keystone CLI is deprecated in favor of python-openstackclient. For a Python library, continue using python-keystoneclient.
  'python-keystoneclient.', DeprecationWarning)
WARNING: unsupported identity-api-version 3, falling back to 2.0
/usr/local/lib/python2.7/dist-packages/keystoneclient/v2_0/client.py:145: DeprecationWarning: Constructing an instance of the keystoneclient.v2_0.client.Client class without a session is deprecated as of the 1.7.0 release and may be removed in the 2.0.0 release.
  'the 2.0.0 release.', DeprecationWarning)
/usr/local/lib/python2.7/dist-packages/keystoneclient/v2_0/client.py:147: DeprecationWarning: Using the 'tenant_name' argument is deprecated in version '1.7.0' and will be removed in version '2.0.0', please use the 'project_name' argument instead
  super(Client, self).__init__(**kwargs)
/usr/local/lib/python2.7/dist-packages/debtcollector/renames.py:43: DeprecationWarning: Using the 'tenant_id' argument is deprecated in version '1.7.0' and will be removed in version '2.0.0', please use the 'project_id' argument instead
  return f(*args, **kwargs)
/usr/local/lib/python2.7/dist-packages/keystoneclient/httpclient.py:376: DeprecationWarning: Constructing an HTTPClient instance without using a session is deprecated as of the 1.7.0 release and may be removed in the 2.0.0 release.
  'the 2.0.0 release.', DeprecationWarning)
Authorization Failed: The resource could not be found. (HTTP 404)

Additionally, the newer openstack command also fails:

root@aio1_utility_container-20104744:~# openstack user list
The request you have made requires authentication. (HTTP 401) (Request-ID: req-9668e42d-7786-43ba-a904-5ac6d401026e)

[Kevin Carter (kevin-carter)]

While I dont know what the root cause is quite yet, or what the exact fix is, here are my working thoughts:

Error that I encountered that seems to be along the same lines of this issue: http://paste.openstack.org/show/482472/

* The review https://review.openstack.org/#/c/245966/ has a few other fixes within it to address the recent changes in master there are a few package versions that seem to be unstable in global requirements. I noticed that use of Fernet tokens was causing problems with Unicode in the headers when Keystone was backed by Apache. Additionally I discovered that our keystone wsgi file as out of date from upstream and needed to be rebased.

[Michael Carden (mike-carden)]

I spun up a fresh AIO following http://docs.openstack.org/developer/openstack-ansible/developer-docs/quickstart-aio.html (which puts me on a detached HEAD at the 12.0.2 tag)

...ssh'd into the utility_container, sourced openrc and found that 'openstack user list' returns a table of ID:Name pairs while 'keystone user-list' fails with a bunch of deprecation warnings and an Authorisation Failed 404.

[Jamie Lennox (jamielennox)]

So all those deprecation warnings are coming from using the 'keystone' CLI utility. We've deprecated that and you should use the openstack cli - or the python bindings directly using a Session and auth plugin.

I'd need a bit more information to figure out what the actual failure is though because we shouldn't have changed any functionality that was previously working.

[Jason Guy (jguy-5)]

I found a workaround to this. I simply ran 'apt-get install python-openstackclient' on the utility server. Not sure if it broke anything else, but starting in Kilo, everything is beginning to move to API v3, and use of the openstack command as far as I can tell. I suppose the docs should be updated in the verification section, and the openstack client needs to be installed by ansible.

[Jesse Pretorius (jesse-pretorius)]

@Jason Note that the openstack CLI is already installed into the Utility container.

@Richard Note that for Liberty+ we have set the Keystone v3 API to be exclusively used for the service catalogue, so the keystone CLI does not work (it's deprecated in Liberty and does not work against a v3 API).

[Richard Jones (r1chardj0n3s)]

@Jesse ok, thanks, so this is purely a documentation bug then.

[Richard Jones (r1chardj0n3s)]

Scratch that. I note at the end of my bug report I also couldn't use the openstack cli either :-)

[Jesse Pretorius (jesse-pretorius)]

This appears to be a documentation specific bug. I can't replicate an issue with the openstack CLI not returning the data, but the keystone CLI definitely won't work for Liberty onwards.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/266641

[Amy Marrich (amy-marrich)]

We tested with an AIO installation and verified the keystone command was not functioning but the openstack one did. This was tested on liberty and the documentation has been updated.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/266641
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible/commit/?id=74ae99ebbe2a4f7498be734a71ad61074983c085
Submitter: Jenkins
Branch: master

commit 74ae99ebbe2a4f7498be734a71ad61074983c085
Author: Mudpuppy <email address hidden>
Date: Tue Jan 12 20:13:14 2016 -0600

    Correct CLI command for install verification

    Updated the location for sourcing the openrc
    Updated the CLI command from keystone to openstack

    Change-Id: I97b0364db6baa22df3877ff196289cbda8611019
    Closes-Bug: #1528427

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/openstack-ansible 13.0.0 release.

[Davanum Srinivas (DIMS) (dims-v)]

This issue was fixed in the openstack/openstack-ansible 13.0.0 release.

[Jesse Pretorius (jesse-pretorius)]

Liberty Milestone will be re-added if/when a patch is submitted.