Ironic is using deprecated authentication options

[Dmitry Tantsur]

An example warning:

2017-02-02 12:39:46.666 28959 WARNING ironic.cmd.conductor [-] Failed to load authentification credentials from [service_catalog], [neutron], [glance], [swift], [inspector] config sections. The corresponding service users' credentials will be loaded from [keystone_authtoken] config section, which is deprecated for this purpose. Please update the config file. For more info see http://docs.openstack.org/releasenotes/ironic/newton.html.

This has to be fixed soon, as these options can be removed at any moment. Affects both undercloud and overcloud.

UPD: this issue also introduces a dependency between IronicApi and IronicConductor, which prevents IronicConductor from being used as a standalone role.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/428188

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/428680

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/428795

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/428188
Committed: https://git.openstack.org/cgit/openstack/puppet-ironic/commit/?id=c995ec4840beb8a4aff7cc53f13c7c4089b0a2e2
Submitter: Jenkins
Branch: master

commit c995ec4840beb8a4aff7cc53f13c7c4089b0a2e2
Author: Dmitry Tantsur <email address hidden>
Date: Thu Feb 2 15:29:39 2017 +0100

    Add separate manifest for configuring access to glance

    Without these parameters ironic uses keystone_authtoken credentials.
    This is deprecated since Newton and can be removed at any moment.

    This patch provides a manifest to configure separate credentials
    and moves other related parameters to it.

    Change-Id: I1b367308fb4dd82a7c8702a5d4301dcfd3f24a34
    Partial-Bug: #1661250

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/430323

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/430333

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/430323
Committed: https://git.openstack.org/cgit/openstack/puppet-ironic/commit/?id=15d216c6b94fdfafda5211ebcd3728424b68dddc
Submitter: Jenkins
Branch: master

commit 15d216c6b94fdfafda5211ebcd3728424b68dddc
Author: Dmitry Tantsur <email address hidden>
Date: Tue Feb 7 16:49:51 2017 +0100

    Move glance paremeters related to temporary URLs to ironic::glance

    This was missed when ironic::glance was created. These paremeters related
    to how glance generates temporary URLs for images in swift.

    Change-Id: Ia188f9b6618ef8a13d874729a9b556102cda57f0
    Related-Bug: #1661250

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/430886

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/430333
Committed: https://git.openstack.org/cgit/openstack/puppet-ironic/commit/?id=57e997515bd545659f0e25346e38748911e1a246
Submitter: Jenkins
Branch: master

commit 57e997515bd545659f0e25346e38748911e1a246
Author: Dmitry Tantsur <email address hidden>
Date: Tue Feb 7 17:06:23 2017 +0100

    Add separate manifest for configuring access to swift

    Without these parameters ironic uses keystone_authtoken credentials.
    This is deprecated since Newton and can be removed at any moment.

    Change-Id: I072cd20c7027ceb9aa0260428d6df136a25263eb
    Partial-Bug: #1661250

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/431046

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/428680
Committed: https://git.openstack.org/cgit/openstack/instack-undercloud/commit/?id=599d5b15ca529873188c24e84a7c686993000776
Submitter: Jenkins
Branch: master

commit 599d5b15ca529873188c24e84a7c686993000776
Author: Dmitry Tantsur <email address hidden>
Date: Fri Feb 3 11:31:46 2017 +0100

    Explicitly configure credentials used by ironic to access glance

    Using keystone_authtoken credentials for this purpose is deprecated.

    Partial-Bug: #1661250
    Change-Id: Ic7841ee6b49e53631ea750001629a749b3038282

[Dmitry Tantsur (divius)]

The glance part was done in Ocata, moving everything else to Pike.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/428795
Committed: https://git.openstack.org/cgit/openstack/puppet-ironic/commit/?id=ee74484b3aedcda52521440d7b75bf39f33635a1
Submitter: Jenkins
Branch: master

commit ee74484b3aedcda52521440d7b75bf39f33635a1
Author: Dmitry Tantsur <email address hidden>
Date: Fri Feb 3 17:08:45 2017 +0100

    Add separate manifest for configuring access to neutron

    Without these parameters ironic uses keystone_authtoken credentials.
    This is deprecated since Newton and can be removed at any moment.

    This patch provides a manifest to configure separate credentials
    and moves other related parameters to it.

    Reset [neutron]url to os_service_default to allow ironic to guess it,
    rather then using a value that it probably wrong.

    Change-Id: I7a9a78521c3495f04ca0a9f625b0d844ee56c56a
    Partial-Bug: #1661250

[OpenStack Infra (hudson-openstack)]

Change abandoned by Dmitry Tantsur (<email address hidden>) on branch: master
Review: https://review.openstack.org/431046
Reason: rolled into the previous patch

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/435715

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/435716

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/435716
Committed: https://git.openstack.org/cgit/openstack/puppet-ironic/commit/?id=9eb74cb35880905575e5b382c5992befbc692beb
Submitter: Jenkins
Branch: stable/ocata

commit 9eb74cb35880905575e5b382c5992befbc692beb
Author: Dmitry Tantsur <email address hidden>
Date: Tue Feb 7 17:06:23 2017 +0100

    Add separate manifest for configuring access to swift

    Without these parameters ironic uses keystone_authtoken credentials.
    This is deprecated since Newton and can be removed at any moment.

    Change-Id: I072cd20c7027ceb9aa0260428d6df136a25263eb
    Partial-Bug: #1661250
    (cherry picked from commit 57e997515bd545659f0e25346e38748911e1a246)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/435715
Committed: https://git.openstack.org/cgit/openstack/puppet-ironic/commit/?id=1853d2805151f818333daba635d5d01c4cb0b86b
Submitter: Jenkins
Branch: stable/ocata

commit 1853d2805151f818333daba635d5d01c4cb0b86b
Author: Dmitry Tantsur <email address hidden>
Date: Fri Feb 3 17:08:45 2017 +0100

    Add separate manifest for configuring access to neutron

    Without these parameters ironic uses keystone_authtoken credentials.
    This is deprecated since Newton and can be removed at any moment.

    This patch provides a manifest to configure separate credentials
    and moves other related parameters to it.

    Reset [neutron]url to os_service_default to allow ironic to guess it,
    rather then using a value that it probably wrong.

    Change-Id: I7a9a78521c3495f04ca0a9f625b0d844ee56c56a
    Partial-Bug: #1661250
    (cherry picked from commit ee74484b3aedcda52521440d7b75bf39f33635a1)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/445524

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/445534

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/445541

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/445541
Committed: https://git.openstack.org/cgit/openstack/puppet-ironic/commit/?id=f60b27493ae85babc19b35961e57189ba32eb23d
Submitter: Jenkins
Branch: master

commit f60b27493ae85babc19b35961e57189ba32eb23d
Author: Dmitry Tantsur <email address hidden>
Date: Tue Mar 14 16:39:07 2017 +0100

    Add domain parameters to switch, neutron and glance auth modules

    These are required to use Identity v3 authentication with them.

    Change-Id: I50068d5f29641fb0f01cf1ded3487bb44b324558
    Related-Bug: #1661250

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/446037

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/446074

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/430886
Committed: https://git.openstack.org/cgit/openstack/instack-undercloud/commit/?id=03a42f1583507b64d5d3f8d3c92b4b56955315ba
Submitter: Jenkins
Branch: master

commit 03a42f1583507b64d5d3f8d3c92b4b56955315ba
Author: Dmitry Tantsur <email address hidden>
Date: Fri Feb 3 11:31:46 2017 +0100

    Explicitly configure credentials used by ironic to access neutron and swift

    Using keystone_authtoken credentials for this purpose is deprecated.

    Also stop setting neutron API URL explicitly for it to be fetched
    from the service catalog instead.

    Also add missing manifest includes (all except for swift are already included
    implicitly for backward compatibility in puppet-ironic).

    Change-Id: I89ed5709cb3110848c5185d3596dfd9eaed823e2
    Partial-Bug: #1661250

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/445524
Committed: https://git.openstack.org/cgit/openstack/puppet-ironic/commit/?id=a3ca538547169674e05b74cda6e0fd12104b76c4
Submitter: Jenkins
Branch: master

commit a3ca538547169674e05b74cda6e0fd12104b76c4
Author: Dmitry Tantsur <email address hidden>
Date: Tue Mar 14 15:43:02 2017 +0100

    Add separate manifest for configuring access to the service catalog

    Without these parameters ironic uses keystone_authtoken credentials.
    This is deprecated since Newton and can be removed at any moment.

    Change-Id: I5e4caf484636069dd0cb80abe1f29a6613b4874f
    Partial-Bug: #1661250

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/445534
Committed: https://git.openstack.org/cgit/openstack/puppet-ironic/commit/?id=09cb07a7c918c8120e42d4af1ea278058a8e71f0
Submitter: Jenkins
Branch: master

commit 09cb07a7c918c8120e42d4af1ea278058a8e71f0
Author: Dmitry Tantsur <email address hidden>
Date: Tue Mar 14 16:16:28 2017 +0100

    Add separate manifest for configuring access from ironic to inspector

    Without these parameters ironic uses keystone_authtoken credentials.
    This is deprecated since Newton and can be removed at any moment.

    Also introduce "enabled" and "service_url" options for completeness.

    Change-Id: I652db2b74924789d1431a89af8e07a68699de697
    Partial-Bug: #1661250

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/446386

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/446387

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/446387
Committed: https://git.openstack.org/cgit/openstack/puppet-ironic/commit/?id=d729cacd77b0e7d0270669dd5696e4c83b0461d3
Submitter: Jenkins
Branch: stable/ocata

commit d729cacd77b0e7d0270669dd5696e4c83b0461d3
Author: Dmitry Tantsur <email address hidden>
Date: Tue Mar 14 16:16:28 2017 +0100

    Add separate manifest for configuring access from ironic to inspector

    Without these parameters ironic uses keystone_authtoken credentials.
    This is deprecated since Newton and can be removed at any moment.

    Also introduce "enabled" and "service_url" options for completeness.

    Change-Id: I652db2b74924789d1431a89af8e07a68699de697
    Partial-Bug: #1661250
    (cherry picked from commit 09cb07a7c918c8120e42d4af1ea278058a8e71f0)

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/ocata
Review: https://review.openstack.org/446715

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/446386
Committed: https://git.openstack.org/cgit/openstack/puppet-ironic/commit/?id=c331e72c80cef975e6e6f78d1c8b030c31914544
Submitter: Jenkins
Branch: stable/ocata

commit c331e72c80cef975e6e6f78d1c8b030c31914544
Author: Dmitry Tantsur <email address hidden>
Date: Tue Mar 14 15:43:02 2017 +0100

    Add separate manifest for configuring access to the service catalog

    Without these parameters ironic uses keystone_authtoken credentials.
    This is deprecated since Newton and can be removed at any moment.

    Change-Id: I5e4caf484636069dd0cb80abe1f29a6613b4874f
    Partial-Bug: #1661250
    (cherry picked from commit a3ca538547169674e05b74cda6e0fd12104b76c4)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/446715
Committed: https://git.openstack.org/cgit/openstack/puppet-ironic/commit/?id=161073a41b62d4d9fb599151c6ee3835be3485ae
Submitter: Jenkins
Branch: stable/ocata

commit 161073a41b62d4d9fb599151c6ee3835be3485ae
Author: Dmitry Tantsur <email address hidden>
Date: Tue Mar 14 16:39:07 2017 +0100

    Add domain parameters to switch, neutron and glance auth modules

    These are required to use Identity v3 authentication with them.

    Conflicts:
     manifests/glance.pp
     spec/classes/ironic_glance_spec.rb

    Change-Id: I50068d5f29641fb0f01cf1ded3487bb44b324558
    Related-Bug: #1661250
    (cherry picked from commit f60b27493ae85babc19b35961e57189ba32eb23d)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/446037
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=ffe6ae2c24f82df620df14ee4be8bd292cb95075
Submitter: Jenkins
Branch: master

commit ffe6ae2c24f82df620df14ee4be8bd292cb95075
Author: Dmitry Tantsur <email address hidden>
Date: Wed Mar 15 16:58:23 2017 +0100

    Explicitly configure credentials used by ironic to access other services

    Using keystone_authtoken credentials for this purpose is deprecated, and also
    prevents ironic-conductor from being used as a separate role.

    As a side effect, this change makes it possible to potentially enable
    ironic-inspector support in the future (it's not enabled yet).

    Change-Id: I21180678bec911f1be36e3b174bae81af042938c
    Partial-Bug: #1661250

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/446074
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=91d7d8c46858d42e6cf2354a3be6af6c5bb9c02e
Submitter: Jenkins
Branch: master

commit 91d7d8c46858d42e6cf2354a3be6af6c5bb9c02e
Author: Dmitry Tantsur <email address hidden>
Date: Wed Mar 15 18:04:44 2017 +0100

    Explicitly configure credentials used by ironic to access other services

    Using keystone_authtoken credentials for this purpose is deprecated, and also
    prevents ironic-conductor from being used as a separate role.

    Also remove neutron_url, it can be fetched from the catalog instead.

    Change-Id: I12822568cb4db31808aec5fd407d71fe4b7b09e0
    Depends-On: I21180678bec911f1be36e3b174bae81af042938c
    Partial-Bug: #1661250

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/446981

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/448028

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/448029

[OpenStack Infra (hudson-openstack)]

Change abandoned by Emilien Macchi (<email address hidden>) on branch: stable/ocata
Review: https://review.openstack.org/448028

[OpenStack Infra (hudson-openstack)]

Change abandoned by Emilien Macchi (<email address hidden>) on branch: stable/ocata
Review: https://review.openstack.org/448029

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/448028
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=1c1565057567d2732a38dfe400195b853601f5f1
Submitter: Jenkins
Branch: stable/ocata

commit 1c1565057567d2732a38dfe400195b853601f5f1
Author: Dmitry Tantsur <email address hidden>
Date: Wed Mar 15 16:58:23 2017 +0100

    Explicitly configure credentials used by ironic to access other services

    Using keystone_authtoken credentials for this purpose is deprecated, and also
    prevents ironic-conductor from being used as a separate role.

    As a side effect, this change makes it possible to potentially enable
    ironic-inspector support in the future (it's not enabled yet).

    Change-Id: I21180678bec911f1be36e3b174bae81af042938c
    Partial-Bug: #1661250
    (cherry picked from commit ffe6ae2c24f82df620df14ee4be8bd292cb95075)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/448029
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=2d47d9b64e7b0b484741b2a39bcdb8993e71aa02
Submitter: Jenkins
Branch: stable/ocata

commit 2d47d9b64e7b0b484741b2a39bcdb8993e71aa02
Author: Dmitry Tantsur <email address hidden>
Date: Wed Mar 15 18:04:44 2017 +0100

    Explicitly configure credentials used by ironic to access other services

    Using keystone_authtoken credentials for this purpose is deprecated, and also
    prevents ironic-conductor from being used as a separate role.

    Also remove neutron_url, it can be fetched from the catalog instead.

    Change-Id: I12822568cb4db31808aec5fd407d71fe4b7b09e0
    Depends-On: I21180678bec911f1be36e3b174bae81af042938c
    Partial-Bug: #1661250
    (cherry picked from commit 91d7d8c46858d42e6cf2354a3be6af6c5bb9c02e)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/446981
Committed: https://git.openstack.org/cgit/openstack/instack-undercloud/commit/?id=354550f5978908223b49d915f67d47d0f834cc4a
Submitter: Jenkins
Branch: master

commit 354550f5978908223b49d915f67d47d0f834cc4a
Author: Dmitry Tantsur <email address hidden>
Date: Fri Mar 17 13:17:17 2017 +0100

    Explicitly configure credentials used by ironic to access inspector and service catalog

    Using keystone_authtoken credentials for this purpose is deprecated.

    Change-Id: I0be636ec9672124846ed479614fbbcbfb306fab0
    Partial-Bug: #1661250