Upgrade Failed to run upgrade prepare: Forbidden: You are not authorized to perform the requested action.

Bug #1799177 reported by Sofer Athlan-Guyot
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
tripleo
Fix Released
Critical
Alex Schultz

Bug Description

Hi,

originally reported there https://bugzilla.redhat.com/show_bug.cgi?id=1637988

During overcloud upgrade prepare we encounter that error:

2018-10-10 14:58:48.427 659310 INFO osc_lib.shell [-] command: overcloud upgrade prepare -> tripleoclient.v1.overcloud_upgrade.UpgradePrepare (auth=True)ESC[00m
2018-10-10 14:58:48.429 659310 INFO osc_lib.clientmanager [-] Using auth plugin: passwordESC[00m
2018-10-10 14:58:48.430 659310 DEBUG osc_lib.clientmanager [-] Using parameters {'username': 'admin', 'project_name': 'admin', 'user_domain_name': 'Default', 'auth_url': 'https://192.168.24.2:13000/', 'password': '***', 'project_domain_name': 'Default'} setup_auth /usr/lib/python2.7/site-packages/osc_lib/clientmanager.py:157ESC[00m
2018-10-10 14:58:48.431 659310 DEBUG osc_lib.clientmanager [-] Get auth_ref auth_ref /usr/lib/python2.7/site-packages/osc_lib/clientmanager.py:201ESC[00m
2018-10-10 14:58:56.276 659310 INFO tripleoclient.v1.overcloud_upgrade.MajorUpgradePrepare [-] Stack found, will be doing a stack updateESC[00m
Removing the current plan files
Uploading new plan files
Plan updated.
Processing templates in the directory /tmp/tripleoclient-CHg8Wh/tripleo-heat-templates
WARNING: Following parameter(s) are deprecated and still defined. Deprecated parameters will be removed soon!
  OvercloudControlFlavor
WARNING: Following parameter(s) are defined but not used in plan. Could be possible that parameter is valid but currently not used.
  DockerMysqlClientConfigImage
  DockerDesignateMDNSImage
...
  DockerDesignateCentralImage
  DockerManilaConfigImage
2018-10-10 15:08:00.976 659310 WARNING tripleoclient.plugin [-] Waiting for messages on queue 'tripleo' with no timeout.ESC[00m
2018-10-10 15:09:31.674 659310 ERROR openstack [-] {u'deployment_status': None,
 u'execution': {u'created_at': u'2018-10-10 12:08:00',
                u'id': u'02dfd243-c1dd-41f2-ac55-8453c3377394',
                u'input': {u'config_dir': u'/tmp/',
                           u'container': u'overcloud',
                           u'queue_name': u'tripleo',
                           u'skip_deploy_identifier': False,
                           u'timeout': 240},
                u'name': u'tripleo.package_update.v1.package_update_plan',
                u'params': {u'env': {}, u'namespace': u''},
                u'spec': {u'description': u'Take a container and perform a package update with possible breakpoints',
                          u'input': [u'container',
                                     {u'timeout': 240},
                                     {u'queue_name': u'tripleo'},
                                     {u'skip_deploy_identifier': False},
                                     {u'config_dir': u'/tmp/'}],
                          u'name': u'package_update_plan',
                          u'tags': [u'tripleo-common-managed'],
                          u'tasks': {u'send_message': {u'input': {u'execution': u'<% execution() %>',
                                                                  u'message': u"<% $.get('message', '') %>",
                                                                  u'queue_name': u'<% $.queue_name %>',
                                                                  u'status': u"<% $.get('status', 'SUCCESS') %>",
                                                                  u'type': u'<% execution().name %>'},
                                                       u'name': u'send_message',
                                                       u'type': u'direct',
                                                       u'version': u'2.0',
                                                       u'workflow': u'tripleo.messaging.v1.send'},
                                     u'set_update_failed': {u'name': u'set_update_failed',
                                                            u'on-success': u'send_message',
                                                            u'publish': {u'message': u'<% task(update).result %>',
                                                                         u'status': u'FAILED'},
                                                            u'type': u'direct',
                                                            u'version': u'2.0'},
                                     u'update': {u'action': u'tripleo.package_update.update_stack',
                                                 u'input': {u'container': u'<% $.container %>',
                                                            u'timeout': u'<% $.timeout %>'},
                                                 u'name': u'update',
                                                 u'on-error': u'set_update_failed',
                                                 u'on-success': u'send_message',
                                                 u'type': u'direct',
                                                 u'version': u'2.0'}},
                          u'version': u'2.0'},
                u'updated_at': u'2018-10-10 12:08:00'},
 u'execution_id': u'02dfd243-c1dd-41f2-ac55-8453c3377394',
 u'message': u"The action raised an exception [action_ex_id=cb329a0d-1fde-46d8-a0ab-80a21454090f, action_cls='<class 'mistral.actions.action_factory.UpdateStackAction'>', attributes='{}', params='{u'container': u'overcloud', u'timeout': 240}']\n ERROR: Internal Error",
 u'plan_name': None,
 u'status': u'FAILED'}: AssertionError: {u'deployment_status': None,ESC[00m
2018-10-10 15:09:31.677 659310 INFO osc_lib.shell [-] END return value: 1ESC[00

Changed in tripleo:
assignee: nobody → Sofer Athlan-Guyot (sofer-athlan-guyot)
status: Triaged → In Progress
Revision history for this message
Sofer Athlan-Guyot (sofer-athlan-guyot) wrote :
description: updated
Changed in tripleo:
milestone: stein-1 → stein-2
Changed in tripleo:
assignee: Sofer Athlan-Guyot (sofer-athlan-guyot) → Carlos Camacho (ccamacho)
Changed in tripleo:
assignee: Carlos Camacho (ccamacho) → Alex Schultz (alex-schultz)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to puppet-tripleo (master)

Reviewed: https://review.openstack.org/611919
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=00524bfb7fd236d3ed63e76c67bcd918c3be186d
Submitter: Zuul
Branch: master

commit 00524bfb7fd236d3ed63e76c67bcd918c3be186d
Author: Sofer Athlan-Guyot <email address hidden>
Date: Fri Oct 19 18:33:33 2018 +0200

    Make sure that the _member_ role is assigned to admin.

    When we switch to not using instack_undercloud, we missed the role
    assignment that was done in there.

    By simply adding it to the puppet role we get it back.

    Change-Id: I074d2878ee9cfc6061d68ecd989832c636c065ec
    Closes-Bug: #1799177

Changed in tripleo:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to puppet-tripleo (stable/rocky)

Fix proposed to branch: stable/rocky
Review: https://review.openstack.org/615821

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to tripleo-heat-templates (master)

Reviewed: https://review.openstack.org/611677
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=1c64c2c07bcadefbb74c55fc21b6a2c7e3727e68
Submitter: Zuul
Branch: master

commit 1c64c2c07bcadefbb74c55fc21b6a2c7e3727e68
Author: Sofer Athlan-Guyot <email address hidden>
Date: Thu Oct 18 18:49:35 2018 +0200

    Enable _member_ role for undercloud install.

    During upgrade, as we don't use instack_undercloud anymore, we missing
    the _member_ role to the admin user.

    This creates the necessary hooks in tht to have the member role
    created during upgrade (and install for that matter).

    This passes on the keystone_enable_member to puppet-tripleo, but it
    needs a patch there as well for this mechanism to fully work.

    Change-Id: I2319ed876eba7f21c0e80444bf78ca080fef252a
    Depends-On: https://review.openstack.org/611919
    Partial-Bug: #1799177

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to tripleo-heat-templates (stable/rocky)

Fix proposed to branch: stable/rocky
Review: https://review.openstack.org/618538

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to puppet-tripleo (stable/rocky)

Reviewed: https://review.openstack.org/615821
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=6ec97c702f272522a51e32d08258c4d10af1b7a8
Submitter: Zuul
Branch: stable/rocky

commit 6ec97c702f272522a51e32d08258c4d10af1b7a8
Author: Sofer Athlan-Guyot <email address hidden>
Date: Fri Oct 19 18:33:33 2018 +0200

    Make sure that the _member_ role is assigned to admin.

    When we switch to not using instack_undercloud, we missed the role
    assignment that was done in there.

    By simply adding it to the puppet role we get it back.

    Change-Id: I074d2878ee9cfc6061d68ecd989832c636c065ec
    Closes-Bug: #1799177
    (cherry picked from commit 00524bfb7fd236d3ed63e76c67bcd918c3be186d)

tags: added: in-stable-rocky
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to tripleo-heat-templates (stable/rocky)

Reviewed: https://review.openstack.org/618538
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=3223f2dba3cf1356d515d745db3a90f0717b5e48
Submitter: Zuul
Branch: stable/rocky

commit 3223f2dba3cf1356d515d745db3a90f0717b5e48
Author: Sofer Athlan-Guyot <email address hidden>
Date: Thu Oct 18 18:49:35 2018 +0200

    Enable _member_ role for undercloud install.

    During upgrade, as we don't use instack_undercloud anymore, we missing
    the _member_ role to the admin user.

    This creates the necessary hooks in tht to have the member role
    created during upgrade (and install for that matter).

    This passes on the keystone_enable_member to puppet-tripleo, but it
    needs a patch there as well for this mechanism to fully work.

    Change-Id: I2319ed876eba7f21c0e80444bf78ca080fef252a
    Depends-On: https://review.openstack.org/611919
    Partial-Bug: #1799177
    (cherry picked from commit 1c64c2c07bcadefbb74c55fc21b6a2c7e3727e68)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/puppet-tripleo 10.2.0

This issue was fixed in the openstack/puppet-tripleo 10.2.0 release.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/puppet-tripleo 9.4.0

This issue was fixed in the openstack/puppet-tripleo 9.4.0 release.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.