Debian: OpenStack RC file downloaded from horizon with wrong data and missing variables

[Cristian Mondo]

Brief Description
-----------------

The OpenStack RC file downloaded from horizon have the variable OS_AUTH_URL with wrong data. The variable contents in CentOS is "http://10.20.1.3:5000/v3" and in Debian is "http://10.20.3.3:5000" (the part "/v3" is missing). This causes problems in the execution of commands like:

sysadmin@controller-0:~$ sw-manager patch-strategy show
HTTP Error 404: NOT FOUND
Invalid keystone token

Also, if HTTPS is enabled (it can be enabled using a self-signed certificate through "system modify --https_enabled true"), the openrc file is downloaded from Horizon and the "/v3" fix mentioned above is done in the file, still the following error occurs:

sysadmin@controller-0:~$ sw-manager patch-strategy show
<urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1123)>
Invalid keystone token

Severity
--------

Major.

Steps to Reproduce
------------------

Log into horizon page of a Debian AIO-SX deploy, go to "Project -> "API Access", go to "Download OpenStack RC File" -> "OpenStack RC File" and then copy the downloaded file "admin-openrc.sh" to controller. Log through SSH in the controller, source the file "admin-openrc.sh" and execute "sw-manager patch-strategy show".

Expected Behavior
------------------

The command should have no error in the output. Example:

sysadmin@controller-0:~$ sw-manager patch-strategy show
No strategy available

Actual Behavior
----------------

One of the following errors occurs (the first when https is disabled, the second when https is enabled and the "/v3" fix is present):

sysadmin@controller-0:~$ sw-manager patch-strategy show
HTTP Error 404: NOT FOUND
Invalid keystone token

sysadmin@controller-0:~$ sw-manager patch-strategy show
<urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1123)>
Invalid keystone token

Reproducibility
---------------

100% Reproducible.

System Configuration
--------------------

Tested in an AIO-SX, should happen in any environment type.

Timestamp/Logs
--------------

N/A.

Alarms
------

N/A.

Test Activity
-------------

Developer Testing.

Workaround
----------

Edit "admin-openrc.sh" file and append "/v3" to the contents of variable OS_AUTH_URL. If https is enabled, then edit "admin-openrc.sh" file and set the values of OS_AUTH_URL and OS_INTERFACE to the same values present in "/etc/platform/openrc".

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/nfv/+/866841

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/nfv/+/866841
Committed: https://opendev.org/starlingx/nfv/commit/d76a07f78a350e030d9975feddf544b6fe5ec3d2
Submitter: "Zuul (22348)"
Branch: master

commit d76a07f78a350e030d9975feddf544b6fe5ec3d2
Author: Cristian Mondo <email address hidden>
Date: Wed Dec 7 07:26:46 2022 -0300

    Unable to resolve v3 url when sw-manager is invoked

    When the OpenStack RC file is exported from Horizon
    the url in the OS_AUTH_URL variable does not include the /v3
    API version. This causes that when the sw-manager command
    is invoked and trying to get the token, it returns error 300.
    This fix is to catch the error and get the URL of the location
    which points to the /v3 API version.

    Closes-Bug: 1998949

    Test Plan:

    - Download OpenStack RC file from horizon then source it in
    remote machine.
    - Use remote-cli to execute sw-manager patch-strategy show

    Signed-off-by: Cristian Mondo <email address hidden>
    Change-Id: Ib5112bed26c2b773a460377af8be0c7ec12c80ae

[Ghada Khalil (gkhalil)]

There seems to be a more recent fix for this issue: https://review.opendev.org/c/starlingx/gui/+/889192
Merged on July 24, 2023