Post-deployment config for UI

[Ana Krivokapić]

TripleO UI is lacking the post-deployment config[1]. We need to either re-implement the config in the UI, or (preferably) to refactor it to a mistral workflow which will then be called from both the CLI and the UI.

https://github.com/openstack/python-tripleoclient/blob/master/tripleoclient/v1/overcloud_deploy.py#L1231-L1238

[Steven Hardy (shardy)]

What remains in the postconfig that we actually need?

Most of the logic should now be in puppet, so it'd be good to understand which pieces aren't so we can decide if it's better to just fix those and remove that from the client.

Historically os-cloud-config has done a bunch of stuff like endpoint creation, but it's been a big headache because it's decoupled from the heat logic, so if possible I'd like to take this opportunity to kill that old model completely vs perpetuating it in mistral.

[Jiri Tomasek (jtomasek)]

I've deployed simple deployment (1 controller, 1 compute) with GUI and this is the result. I hope this provides some information on figuring out whether post-deployment is run or not:

[stack@instack ~]$ mistral environment-get overcloud4
+-------------+---------------------------------------------------------------------------------+
| Field | Value |
+-------------+---------------------------------------------------------------------------------+
| Name | overcloud4 |
| Description | <none> |
| Variables | { |
| | "passwords": { |
| | "HAProxyStatsPassword": "GtBRh3gAFYexBBQnCTHkDxXkF", |
| | "CephMonKey": "AQAj3wRYAAAAABAAqk0ee+8zVdodAMGEE1RYhA==", |
| | "NeutronPassword": "HMnCD38jykRCUYXZ3vV8ZvcKx", |
| | "HeatPassword": "T2h4Mh6VURhwyKMMPmkaVKrGx", |
| | "SnmpdReadonlyUserPassword": "", |
| | "GlancePassword": "qZBH8nbu9tnxMdMfCc4RzBK72", |
| | "IronicPassword": "fmex4MCPuqc4kaKdVzDcGXKBC", |
| | "HeatStackDomainAdminPassword": "nVKFg7VeFz92bkCJccVCedFZV", |
| | "ZaqarPassword": "WXkM2uUFhwcaR7T99kXtmAdMd", |
| | "MysqlClustercheckPassword": "n4aXkPHPJvaEuQZBQ3mmQtqxd", |
| | "GnocchiPassword": "ErgZtJRErKRUkBjDJJxV44G4f", |
| | "CephAdminKey": "AQAj3wRYAAAAABAAg1sx+X9ZXrsFwQ0PBZZwpQ==", |
| | "CeilometerPassword": "HXmWwkj9KdUQAgdrQXFhxzXuX", |
| | "CinderPassword": "MYpHfVAf9CkNMPuy2p8nHbnVX", |
| | "RabbitPassword": "7D9UC8DuRbgbEYaywfU44Qyz2", |
| | "CephRgwKey": "AQAj3wRYAAAAABAA9wEE1vKyjYgk1TGbI+Z+eQ==", |
| | "TrovePassword": "7Zp7B3dV63GGvY3Qs9A4zUskV", |
| | "KeystoneCredential0": "U25pK5b-rmd_MNVMHw-QFqiPnN0etj5EQzODoKW0ugg=", |
| | "KeystoneCredential1": "dNofacad90jE3XyV8YHE7ZffrOgsf9gtO2cNMC_6vcI=", |
| | "CephClientKey": "AQAj3wRYAAAAABAAbWiiCOw0DZqIB+DMaofoTg==", |
| | "NovaPassword": "wjkGTEgjNkzmp7jUD3y2KvnxR", |
| | "AdminToken": "3BKdYCeuXx2ewDu8QYmhtXR8r", |
| | "RedisPassword": "3dCKFDMaQg9z9ZHCPnY4py9dW", |
| | ...

[Jiri Tomasek (jtomasek)]

[heat-admin@overcloud4-controller-0 ~]$ openstack --os-username admin --os-password W9KYn3BBexmWca3KUaubuMF68 --os-auth-url http://192.0.2.15:5000/v2.0 --debug -v
START with options: [u'--os-username', u'admin', u'--os-password', u'W9KYn3BBexmWca3KUaubuMF68', u'--os-auth-url', u'http://192.0.2.15:5000/v2.0', u'--debug', u'-v']
options: Namespace(access_key='', access_secret='***', access_token='***', access_token_endpoint='', access_token_type='', aodh_endpoint='', auth_type='', auth_url=u'http://192.0.2.15:5000/v
2.0', authorization_code='', cacert=None, cert='', client_id='', client_secret='***', cloud='', consumer_key='', consumer_secret='***', debug=True, default_domain='default', default_domain_i
d='', default_domain_name='', deferred_help=False, discovery_endpoint='', domain_id='', domain_name='', endpoint='', identity_provider='', identity_provider_url='', insecure=None, inspector_
api_version='1', inspector_url=None, interface='', key='', log_file=None, murano_url='', old_profile=None, openid_scope='', os_alarming_api_version='2', os_application_catalog_api_version='1
', os_baremetal_api_version='1.6', os_beta_command=False, os_compute_api_version='', os_container_infra_api_version='1', os_data_processing_api_version='1.1', os_data_processing_url='', os_d
ns_api_version='2', os_identity_api_version='', os_image_api_version='', os_key_manager_api_version='1', os_metrics_api_version='1', os_network_api_version='', os_object_api_version='', os_o
rchestration_api_version='1', os_project_id=None, os_project_name=None, os_queues_api_version='2', os_volume_api_version='', os_workflow_api_version='2', passcode='', password=***'W9KYn3BBex
mWca3KUaubuMF68', profile=None, project_domain_id='', project_domain_name='', project_id='', project_name='', protocol='', redirect_uri='', region_name='', roles='', timing=False, token='***
', trust_id='', url='', user_domain_id='', user_domain_name='', user_id='', username=u'admin', verbose_level=3, verify=None)
Auth plugin password selected
auth_config_hook(): {'auth_type': 'password', 'beta_command': False, u'compute_api_version': u'2', u'orchestration_api_version': '1', u'database_api_version': u'1.0', 'metrics_api_version':
'1', 'data_processing_api_version': '1.1', 'inspector_api_version': '1', 'auth_url': u'http://192.0.2.15:5000/v2.0', u'network_api_version': u'2', u'message': u'', u'image_format': u'qcow2',
 'networks': [], u'image_api_version': u'2', 'verify': True, u'dns_api_version': '2', u'object_store_api_version': u'1', 'username': u'admin', 'container_infra_api_version': '1', 'verbose_le
vel': 3, 'region_name': '', 'api_timeout': None, u'baremetal_api_version': '1.6', 'queues_api_version': '2', 'auth': {}, 'default_domain': 'default', 'debug': True, u'image_api_use_tasks': F
alse, u'floating_ip_source': u'neutron', 'key': None, 'timing': False, 'password': u'W9KYn3BBexmWca3KUaubuMF68', 'application_catalog_api_version': '1', 'cacert': None, u'key_manager_api_ver
sion': '1', u'metering_api_version': u'2', 'deferred_help': False, u'identity_api_version': u'2.0', 'workflow_api_version': '2', u'volume_api_version': u'2', 'cert': None, u'secgroup_source'
: u'neutron', ...

[Ben Nemec (bnemec)]

Keystone init in tripleoclient was deprecated a while ago, and since I don't see any deprecation warnings in our CI jobs I'm inclined to say that it is correctly not being run: https://github.com/openstack/python-tripleoclient/commit/792312877069d55a146cbdb52209742254877cc4

That being the case, I suspect this is not a problem in Newton by itself. The issue would be using the Newton UI to deploy a Mitaka overcloud, and I'm inclined to say that we just don't support that path. If you want to deploy Mitaka you use the method that was available in Mitaka (the CLI) and if you want to use the UI you deploy Newton.

[Ana Krivokapić (akrivoka)]

My UI deployment resulted in keystone endpoint on overcloud being set correctly:

[heat-admin@overcloud-controller-0 ~]$ openstack --os-username=admin --os-password=P7hFrnx338y7EsaP8qaRVJurk --os-tenant-name=admin --os-auth-url=http://192.0.2.13:5000/v2.0 endpoint list
+----------------------------------+-----------+--------------+----------------+
| ID | Region | Service Name | Service Type |
+----------------------------------+-----------+--------------+----------------+
| deea1819d5d042e880bab6e5e7573aa0 | regionOne | ceilometer | metering |
| d37404d6417e46e1ab6e4d14c7b671ba | regionOne | heat-cfn | cloudformation |
| 75580d179a2341159ef6c099bf977aab | regionOne | swift | object-store |
| d10a85e2ba154578b4c44f06ed1bb767 | regionOne | cinderv2 | volumev2 |
| 37d492a579604e0f939208a5c62e1e15 | regionOne | cinder | volume |
| e472485aeac04c0c8ae8aa38597a2dbc | regionOne | neutron | network |
| 00dc966615304adb9a352a7a6a5b6310 | regionOne | aodh | alarming |
| ffb48beeaef74bb59207f4b72e086a1e | regionOne | cinderv3 | volumev3 |
| 5883fc011fcc4bed9a2ee9303f017b0b | regionOne | nova | compute |
| c3adc07d4721401bb53ac972d9607a07 | regionOne | glance | image |
| e63762d1b4124765873e51a2a6d97184 | regionOne | heat | orchestration |
| 794901520d014e97834a9a6f34b95eb2 | regionOne | keystone | identity |
| 4c8bfa05536a4c92902e48ff9b1cea1a | regionOne | gnocchi | metric |
+----------------------------------+-----------+--------------+----------------+

I'll close this bug and open another one to remove the obsolete post-deployment config from the python client.