Setting passwords to <None> in undercloud.conf fails with puppet error

[Andreas Karis]

When one uncomments password items in undercloud.conf, the deployment will fail with a puppet hiera error.

The following fields were uncommented:
Raw

[stack@undercloud ~]$ grep None -B2 undercloud.conf
# appropriately. If set, the undercloud install will configure all
# system hostname settings. (string value)
#undercloud_hostname = <None>
--
# Password used for MySQL databases. If left unset, one will be
# automatically generated. (string value)
undercloud_db_password = <None>
--
# Keystone admin token. If left unset, one will be automatically
# generated. (string value)
undercloud_admin_token = <None>
--
# Keystone admin password. If left unset, one will be automatically
# generated. (string value)
undercloud_admin_password = <None>
--
# Glance service password. If left unset, one will be automatically
# generated. (string value)
undercloud_glance_password = <None>
--
# Heat db encryption key(must be 16, 24, or 32 characters. If left
# unset, one will be automatically generated. (string value)
undercloud_heat_encryption_key = <None>
--
# Heat service password. If left unset, one will be automatically
# generated. (string value)
undercloud_heat_password = <None>
--
# Neutron service password. If left unset, one will be automatically
# generated. (string value)
undercloud_neutron_password = <None>
--
# Nova service password. If left unset, one will be automatically
# generated. (string value)
undercloud_nova_password = <None>
--
# Ironic service password. If left unset, one will be automatically
# generated. (string value)
undercloud_ironic_password = <None>
--
# Aodh service password. If left unset, one will be automatically
# generated. (string value)
undercloud_aodh_password = <None>
--
# Ceilometer service password. If left unset, one will be
# automatically generated. (string value)
undercloud_ceilometer_password = <None>
--
# Ceilometer metering secret. If left unset, one will be automatically
# generated. (string value)
undercloud_ceilometer_metering_secret = <None>
--
# Ceilometer snmpd password. If left unset, one will be automatically
# generated. (string value)
undercloud_ceilometer_snmpd_password = <None>
--
# Swift service password. If left unset, one will be automatically
# generated. (string value)
undercloud_swift_password = <None>
--
# Mistral service password. If left unset, one will be automatically
# generated. (string value)
undercloud_mistral_password = <None>
--
# Rabbitmq cookie. If left unset, one will be automatically generated.
# (string value)
undercloud_rabbit_cookie = <None>
--
# Rabbitmq password. If left unset, one will be automatically
# generated. (string value)
undercloud_rabbit_password = <None>
--
# Rabbitmq username. If left unset, one will be automatically
# generated. (string value)
undercloud_rabbit_username = <None>
--
# Heat stack domain admin password. If left unset, one will be
# automatically generated. (string value)
undercloud_heat_stack_domain_admin_password = <None>
--
# Swift hash suffix. If left unset, one will be automatically
# generated. (string value)
undercloud_swift_hash_suffix = <None>
--
# Sensu service password. If left unset, one will be automatically
# generated. (string value)
undercloud_sensu_password = <None>
--
# HAProxy stats password. If left unset, one will be automatically
# generated. (string value)
undercloud_haproxy_stats_password = <None>

This leads to the following error message
Raw

[stack@undercloud ~]$ openstack undercloud install
Logging to /home/stack/.instack/install-undercloud.log
Checking for a FQDN hostname...
Static hostname detected as undercloud.example.com
Transient hostname detected as undercloud.example.com
Running instack
(...)
dib-run-parts Sat Dec 17 14:16:16 EST 2016 Running /usr/libexec/os-refresh-config/configure.d/50-puppet-stack-config
+ set -o pipefail
+ set +e
+ puppet apply --detailed-exitcodes /etc/puppet/manifests/puppet-stack-config.pp
Error: (<unknown>): did not find expected alphabetic or numeric character while scanning an anchor at line 38 column 27 at /etc/puppet/manifests/puppet-stack-config.pp:16 on node undercloud.example.com
Wrapped exception:
(<unknown>): did not find expected alphabetic or numeric character while scanning an anchor at line 38 column 27
Error: (<unknown>): did not find expected alphabetic or numeric character while scanning an anchor at line 38 column 27 at /etc/puppet/manifests/puppet-stack-config.pp:16 on node undercloud.example.com
+ rc=1
+ set -e
+ echo 'puppet apply exited with exit code 1'
puppet apply exited with exit code 1
+ '[' 1 '!=' 2 -a 1 '!=' 0 ']'
+ exit 1
[2016-12-17 14:16:21,003] (os-refresh-config) [ERROR] during configure phase. [Command '['dib-run-parts', '/usr/libexec/os-refresh-config/configure.d']' returned non-zero exit status 1]

[2016-12-17 14:16:21,003] (os-refresh-config) [ERROR] Aborting...
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/usr/lib/python2.7/site-packages/instack_undercloud/undercloud.py", line 845, in install
    _run_orc(instack_env)
  File "/usr/lib/python2.7/site-packages/instack_undercloud/undercloud.py", line 735, in _run_orc
    _run_live_command(args, instack_env, 'os-refresh-config')
  File "/usr/lib/python2.7/site-packages/instack_undercloud/undercloud.py", line 406, in _run_live_command
    raise RuntimeError('%s failed. See log for details.' % name)
RuntimeError: os-refresh-config failed. See log for details.
Command 'instack-install-undercloud' returned non-zero exit status 1

Generated undercloud-passwords.conf ...
Raw

[stack@rhosp9-dir-01 ~]$ cat undercloud-passwords.conf
[auth]
undercloud_db_password=<None>
undercloud_admin_token=<None>
undercloud_admin_password=<None>
undercloud_glance_password=<None>
undercloud_heat_encryption_key=<None>
undercloud_heat_password=<None>
undercloud_neutron_password=<None>
undercloud_nova_password=<None>
undercloud_ironic_password=<None>
undercloud_aodh_password=<None>
undercloud_ceilometer_password=<None>
undercloud_ceilometer_metering_secret=<None>
undercloud_ceilometer_snmpd_user=ro_snmp_user
undercloud_ceilometer_snmpd_password=<None>
undercloud_swift_password=<None>
undercloud_mistral_password=<None>
undercloud_rabbit_cookie=<None>
undercloud_rabbit_password=<None>
undercloud_rabbit_username=<None>
undercloud_heat_stack_domain_admin_password=<None>
undercloud_swift_hash_suffix=<None>
undercloud_sensu_password=<None>
undercloud_haproxy_stats_password=<None>

... leads to the following hiera data, which is invalid yaml syntax
Raw

[stack@rhosp9-dir-01 ~]$ sudo cat /etc/puppet/hieradata/puppet-stack-config.yaml | grep None
swift::swift_hash_suffix: &lt;None&gt;
swift::proxy::authtoken::admin_password: &lt;None&gt;
swift::keystone::auth::password: &lt;None&gt;
glance::api::keystone_password: &lt;None&gt;
glance::api::database_connection: mysql+pymysql://glance:&lt;None&gt;@192.0.2.1/glance
glance::registry::keystone_password: &lt;None&gt;
glance::registry::database_connection: mysql+pymysql://glance:&lt;None&gt;@192.0.2.1/glance
glance::keystone::auth::password: &lt;None&gt;
glance::backend::swift::swift_store_key: &lt;None&gt;
glance::notify::rabbitmq::rabbit_userid: &lt;None&gt;
glance::notify::rabbitmq::rabbit_password: &lt;None&gt;
heat_stack_domain_admin_password: &lt;None&gt;
heat::engine::auth_encryption_key: &lt;None&gt;
heat::rabbit_userid: &lt;None&gt;
heat::rabbit_password: &lt;None&gt;
heat::keystone_password: &lt;None&gt;
heat::keystone::domain::domain_password: &lt;None&gt;
heat::database_connection: mysql+pymysql://heat:&lt;None&gt;@192.0.2.1/heat
heat_dsn: mysql+pymysql://heat:&lt;None&gt;@192.0.2.1/heat
heat::keystone::auth::password: &lt;None&gt;
keystone::admin_token: &lt;None&gt;
keystone::database_connection: mysql+pymysql://keystone:&lt;None&gt;@192.0.2.1/keystone
keystone::roles::admin::password: &lt;None&gt;
keystone::rabbit_userid: &lt;None&gt;
keystone::rabbit_password: &lt;None&gt;
admin_password: &lt;None&gt;
neutron::rabbit_password: &lt;None&gt;
neutron::rabbit_user: &lt;None&gt;
neutron::server::database_connection: mysql+pymysql://neutron:&lt;None&gt;@192.0.2.1/neutron
neutron::server::auth_password: &lt;None&gt;
neutron::agents::metadata::auth_password: &lt;None&gt;
neutron::server::notifications::password: &lt;None&gt;
neutron::keystone::auth::password: &lt;None&gt;
    pass: &lt;None&gt;
sensu::rabbitmq_user: &lt;None&gt;
sensu::rabbitmq_password: &lt;None&gt;
sensu::api_password: &lt;None&gt;
    command: 'oschecks-check_keystone_api --os-auth-url http://192.0.2.1:5000/v2.0 --os-username admin --os-password &lt;None&gt; --os-tenant-name service'
ceilometer::metering_secret: &lt;None&gt;
ceilometer::rabbit_userid: &lt;None&gt;
ceilometer::rabbit_password: &lt;None&gt;
ceilometer::api::keystone_password: &lt;None&gt;
ceilometer::db::database_connection: mysql+pymysql://ceilometer:&lt;None&gt;@192.0.2.1/ceilometer
ceilometer::agent::auth::auth_password: &lt;None&gt;
snmpd_readonly_user_password: &lt;None&gt;
ceilometer::keystone::auth::password: &lt;None&gt;
aodh::rabbit_userid: &lt;None&gt;
aodh::rabbit_password: &lt;None&gt;
aodh::api::keystone_password: &lt;None&gt;
aodh::db::database_connection: mysql+pymysql://ceilometer:&lt;None&gt;@192.0.2.1/ceilometer
aodh::auth::auth_password: &lt;None&gt;
aodh::keystone::auth::password: &lt;None&gt;
nova::rabbit_userid: &lt;None&gt;
nova::rabbit_password: &lt;None&gt;
nova::api::admin_password: &lt;None&gt;
nova::database_connection: mysql+pymysql://nova:&lt;None&gt;@192.0.2.1/nova
nova::api_database_connection: mysql+pymysql://nova_api:&lt;None&gt;@192.0.2.1/nova_api
nova::compute::ironic::admin_password: &lt;None&gt;
nova::keystone::auth::password: &lt;None&gt;
ironic::api::admin_password: &lt;None&gt;
ironic::database_connection: mysql+pymysql://ironic:&lt;None&gt;@192.0.2.1/ironic
ironic::rabbit_userid: &lt;None&gt;
ironic::rabbit_password: &lt;None&gt;
ironic::keystone::auth::password: &lt;None&gt;
ironic::keystone::auth_inspector::password: &lt;None&gt;
rabbit_cookie: &lt;None&gt;
rabbitmq::default_user: &lt;None&gt;
rabbitmq::default_pass: &lt;None&gt;
mistral::rabbit_userid: &lt;None&gt;
mistral::rabbit_password: &lt;None&gt;
mistral::database_connection: mysql+pymysql://mistral:&lt;None&gt;@192.0.2.1/mistral
mistral::keystone_password: &lt;None&gt;
mistral::keystone::auth::password: &lt;None&gt;
tripleo::loadbalancer::haproxy_stats_password: &lt;None&gt;

This may be more of a documentation bug:
~~~
# Swift hash suffix. If left unset, one will be automatically
# generated. (string value)
undercloud_swift_hash_suffix = <None>
~~~
Users may misunderstand this, thinking that <None> actually means that this value is unset. A quick fix could be to change the wording, e.g.:
~~~
# Swift hash suffix. If left unset, one will be automatically
# generated. This value needs to start with an alphabetic or numeric character.
# Setting this to <None> will lead to a deployment error. (string value)
undercloud_swift_hash_suffix = <None>
~~~

[Emilien Macchi (emilienm)]

This is not a bug. <None> is not a valid string value. If you un-comment the parameter, you need to give a value like IXQUPsHD1oe9KQJx for example.

[Andreas Karis (akaris)]

This is a documentation bug / a bug with a comment.

~~~
# Swift hash suffix. If left unset, one will be automatically
# generated. (string value)
undercloud_swift_hash_suffix = <None>
~~~

>> "This is not a bug. <None> is not a valid string value. If you un-comment the parameter, you need to give a value like IXQUPsHD1oe9KQJx for example."
Yep. But the comment is not saying this. Instead, a user who accidentally removes the comment gets a cryptographic error message somewhere down the road. I'm not asking to fix anything in the code. I'm only asking to change the comment to something more verbose, e.g. introducing
~~~
# The value needs to be alphanumeric. Setting this to <None> will lead to a deployment error.
~~~

For me a bug or documentation bug is when a customer opens a support ticket and I need to troubleshoot it, and when this could have been avoided either by a better error message or a better documentation / comment in the file.

[Andreas Karis (akaris)]

Also ...

"This is not a bug. <None> is not a valid string value."

Exactly! So why are we putting it into the configuration file, giving users the idea that they could use this? It suggests to people that: if you remove this comment in front of this line, and if you want an auto-generated password, then just leave <None> as a value in here.

[Emilien Macchi (emilienm)]

This is an automated cleanup. This bug report has been closed because it
is older than 18 months and there is no open code change to fix this.
After this time it is unlikely that the circumstances which lead to
the observed issue can be reproduced.

If you can reproduce the bug, please:
* reopen the bug report (set to status "New")
* AND add the detailed steps to reproduce the issue (if applicable)
* AND leave a comment "CONFIRMED FOR: <RELEASE_NAME>"
  Only still supported release names are valid (FUTURE, PIKE, QUEENS, ROCKY, STEIN).
  Valid example: CONFIRMED FOR: FUTURE