<p dir="ltr">There is a known issue where some providers fail when you have an openrc sourced. I remember it being glance that failed. Bug #1524599</p>
<div class="gmail_extra"><br><div class="gmail_quote">On Nov 11, 2016 4:15 AM, "Justin Cattle" <<a href="mailto:j@ocado.com">j@ocado.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">There was two problems here!<div><br></div><div>The puppet libs in use were coming from the wrong environment - so a pretty terminal issue.</div><div>The openrc file wasn't quite correct, as already noted :)<br></div><div><br></div><div>We're still using puppet3, and directory environments on puppet3 have a few issues around plugin-download with multiple directory environments.</div><div>I was already accounting for that, but somehow I missed something and some of the libs from the production env slipped back in.</div><div>Now that is sorted, and the correct openrc file is place, pupping is smooth again :)</div><div><br></div><div><br></div><div>I do notice one further issue.</div><div><br></div><div>If I source the openrc file, then run pup in that same shell, some of the providers fail.</div><div><br></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div>Notice: Puppet::Type::Neutron_network:<wbr>:ProviderNeutron: Unable to complete neutron request due to non-fatal error: "Execution of '/usr/bin/neutron net-list --format=csv --column=id --quote=none' returned 1: The request you have made requires authentication. (HTTP 401) (Request-ID: req-031655a9-3eab-4ac6-b1e8-<wbr>8840b6b49b4e)". Retrying for 9 sec.</div></div><div><div>Notice: Puppet::Type::Neutron_network:<wbr>:ProviderNeutron: Unable to complete neutron request due to non-fatal error: "Execution of '/usr/bin/neutron net-list --format=csv --column=id --quote=none' returned 1: The request you have made requires authentication. (HTTP 401) (Request-ID: req-9d5e6e3e-65ba-4a92-af95-<wbr>ef0be5fa30f6)". Retrying for 6 sec.</div></div><div><div>Notice: Puppet::Type::Neutron_network:<wbr>:ProviderNeutron: Unable to complete neutron request due to non-fatal error: "Execution of '/usr/bin/neutron net-list --format=csv --column=id --quote=none' returned 1: The request you have made requires authentication. (HTTP 401) (Request-ID: req-36f18e6a-50e1-464b-b8bd-<wbr>fc7cb6ee223e)". Retrying for 3 sec.</div></div><div><div>Notice: Puppet::Type::Neutron_network:<wbr>:ProviderNeutron: Unable to complete neutron request due to non-fatal error: "Execution of '/usr/bin/neutron net-list --format=csv --column=id --quote=none' returned 1: The request you have made requires authentication. (HTTP 401) (Request-ID: req-35c8125d-7647-49a3-829b-<wbr>ff485adb2234)". Retrying for 0 sec.</div></div></blockquote><div><br></div><div>If i don't have the OS_ variables in my shell, then it all works fine.</div><div><br></div><div>Is this a bug?</div><div><br></div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="m_4057717507566918886gmail_signature" data-smartmail="gmail_signature"><div><br></div>Cheers,<div>Just</div></div></div>
<br><div class="gmail_quote">On 10 November 2016 at 21:46, Justin Cattle <span dir="ltr"><<a href="mailto:j@ocado.com" target="_blank">j@ocado.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I tried switching the <span style="font-size:12.8px">OS_TENANT_NAME for </span><span style="font-size:12.8px">OS_PROJECT_NAME as a quick test , it didn't seem to fix it.</span><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">However, I'll generate the openrc file from the class in openstack_extras just to make sure it's 100% correct, and report back.</span></div><div><span style="font-size:12.8px"><br></span></div></div><div class="gmail_extra"><br clear="all"><div><div class="m_4057717507566918886m_1901456013154548162gmail_signature" data-smartmail="gmail_signature"><div><br></div>Cheers,<div>Just</div></div></div><div><div class="m_4057717507566918886h5">
<br><div class="gmail_quote">On 10 November 2016 at 17:43, Alex Schultz <span dir="ltr"><<a href="mailto:aschultz@redhat.com" target="_blank">aschultz@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On Thu, Nov 10, 2016 at 10:28 AM, Justin Cattle <<a href="mailto:j@ocado.com" target="_blank">j@ocado.com</a>> wrote:<br>
> Hi Alex,<br>
><br>
><br>
> Thanks very much for the response.<br>
><br>
> We're using python-openstackclient-2.3.0-2<wbr>~cloud0, which is from ubuntu<br>
> cloud archive, trusty-updates/mitaka/main.<br>
><br>
> What's the minimum version I need do you think?<br>
><br>
<br>
</span>I think that should be good. You might want to try switching out<br>
OS_TENANT_NAME for OS_PROJECT_NAME as project name is for v3 which may<br>
be causing the issue. The keystone::disable_admin_token_<wbr>auth had a<br>
dependency on a change[0] to add OS_PROJECT_NAME in. You should be<br>
able to test the underlying commands to see if that fixes the problem.<br>
The root cause seems to be more of the openstack client interactions<br>
(and missing commands) based on the rc file than a puppet issue.<br>
<br>
Thanks,<br>
-Alex<br>
<br>
[0] <a href="https://review.openstack.org/#/c/274296/" rel="noreferrer" target="_blank">https://review.openstack.org/#<wbr>/c/274296/</a><br>
<div class="m_4057717507566918886m_1901456013154548162HOEnZb"><div class="m_4057717507566918886m_1901456013154548162h5"><br>
><br>
> Actually we haven't been using puppet-openstack_extras, but I'll look at<br>
> that for the openrc file at least :)<br>
><br>
><br>
><br>
><br>
><br>
> Cheers,<br>
> Just<br>
><br>
> On 10 November 2016 at 16:32, Alex Schultz <<a href="mailto:aschultz@redhat.com" target="_blank">aschultz@redhat.com</a>> wrote:<br>
>><br>
>> Hey Justin,<br>
>><br>
>><br>
>><br>
>> On Thu, Nov 10, 2016 at 8:48 AM, Justin Cattle <<a href="mailto:j@ocado.com" target="_blank">j@ocado.com</a>> wrote:<br>
>> > Hi,<br>
>> ><br>
>> ><br>
>> > I was looking at this class in the keystone module:<br>
>> ><br>
>> > keystone::disable_admin_token_<wbr>auth<br>
>> ><br>
>> > ..which suggests:<br>
>> ><br>
>> > # After this class is run,<br>
>> > # future puppet runs must have an openrc file with valid keystone v3<br>
>> > # admin credentials in /root/openrc available<br>
>> ><br>
>> ><br>
>> ><br>
>> > So when I change the openrc file from the v2 to v3 keystone endpoint,<br>
>> > puppet<br>
>> > runs then fail with various openstack provider errors.<br>
>> ><br>
>> > e.g.<br>
>> ><br>
>> > Error: Could not prefetch keystone_service provider 'openstack':<br>
>> > Execution<br>
>> > of '/usr/bin/openstack service list --quiet --format csv --long'<br>
>> > returned 2:<br>
>> > openstack: 'service' is not an openstack command. See 'openstack<br>
>> > --help'.<br>
>> > Did you mean one of these?<br>
>> > resource member create<br>
>> > resource member delete<br>
>> > resource member list<br>
>> > resource member show<br>
>> > resource member update<br>
>> > server add security group<br>
>> > server add volume<br>
>> > server create<br>
>> > server delete<br>
>> > server dump create<br>
>> > server image create<br>
>> > server list<br>
>> > server lock<br>
>> > server migrate<br>
>> > server pause<br>
>> > server reboot<br>
>> > server rebuild<br>
>> > server remove security group<br>
>> > server remove volume<br>
>> > server rescue<br>
>> > server resize<br>
>> > server resume<br>
>> > server set<br>
>> > server shelve<br>
>> > server show<br>
>> > server ssh<br>
>> > server start<br>
>> > server stop<br>
>> > server suspend<br>
>> > server unlock<br>
>> > server unpause<br>
>> > server unrescue<br>
>> > server unset<br>
>> > server unshelve (tried 44, for a total of 170 seconds)<br>
>> ><br>
>> ><br>
>> > ..and..<br>
>> ><br>
>> > Error:<br>
>> ><br>
>> > /Stage[main]/Neutron::Keystone<wbr>::Auth/Keystone::Resource::Ser<wbr>vice_identity[neutron]/Keyston<wbr>e_user[neutron]:<br>
>> > Could not evaluate: Execution of '/usr/bin/openstack domain list --quiet<br>
>> > --format csv' returned 2: openstack: 'domain' is not an openstack<br>
>> > command.<br>
>> > See 'openstack --help'.<br>
>> > Did you mean one of these?<br>
>> > command list<br>
>> > container create<br>
>> > container delete<br>
>> > container list<br>
>> > container save<br>
>> > container set<br>
>> > container show<br>
>> > container unset (tried 44, for a total of 170 seconds)<br>
>> ><br>
>> ><br>
>><br>
>> These errors seem to point to an outdated openstackclient. What<br>
>> version are you using?<br>
>><br>
>> ><br>
>> > The v3 openrc file I have in place, works fine when just using the<br>
>> > openstack<br>
>> > cli, which makes the situation all the more strange :) Here it is for<br>
>> > reference:<br>
>> ><br>
>> > #!/bin/sh<br>
>> > export OS_NO_CACHE='true'<br>
>> > export OS_TENANT_NAME='admin'<br>
>> > export OS_USERNAME='admin'<br>
>> > export OS_PASSWORD='supersecret'<br>
>> > export OS_AUTH_URL='<a href="http://1.2.3.4:5000/v3/" rel="noreferrer" target="_blank">http://1.2.3.4:50<wbr>00/v3/</a>'<br>
>> > export OS_AUTH_STRATEGY='keystone'<br>
>> > export OS_IDENTITY_API_VERSION="3"<br>
>> > export OS_REGION_NAME='openstack'<br>
>> > export OS_USER_DOMAIN_NAME='default'<br>
>> > export OS_PROJECT_DOMAIN_NAME='defaul<wbr>t'<br>
>> > export CINDER_ENDPOINT_TYPE='publicUR<wbr>L'<br>
>> > export GLANCE_ENDPOINT_TYPE='publicUR<wbr>L'<br>
>> > export KEYSTONE_ENDPOINT_TYPE='public<wbr>URL'<br>
>> > export NOVA_ENDPOINT_TYPE='publicURL'<br>
>> > export NEUTRON_ENDPOINT_TYPE='publicU<wbr>RL'<br>
>> ><br>
>> ><br>
>><br>
>> This looks ok, but it's OS_PROJECT_NAME now. All our CI uses v3 now<br>
>> and here's an example file from a recent CI run.<br>
>><br>
>> #!/bin/sh<br>
>> export OS_NO_CACHE='true'<br>
>> export OS_PROJECT_NAME='openstack'<br>
>> export OS_USERNAME='admin'<br>
>> export OS_PASSWORD='a_big_secret'<br>
>> export OS_AUTH_URL='https://[::1]:500<wbr>0/v3/'<br>
>> export OS_AUTH_STRATEGY='keystone'<br>
>> export OS_REGION_NAME='RegionOne'<br>
>> export OS_PROJECT_DOMAIN_NAME='defaul<wbr>t'<br>
>> export OS_USER_DOMAIN_NAME='default'<br>
>> export CINDER_ENDPOINT_TYPE='publicUR<wbr>L'<br>
>> export GLANCE_ENDPOINT_TYPE='publicUR<wbr>L'<br>
>> export KEYSTONE_ENDPOINT_TYPE='public<wbr>URL'<br>
>> export NOVA_ENDPOINT_TYPE='publicURL'<br>
>> export NEUTRON_ENDPOINT_TYPE='publicU<wbr>RL'<br>
>> export OS_IDENTITY_API_VERSION='3'<br>
>><br>
>> We actually have an openstack_extras module that we use to generate<br>
>> ours in our CI runs.<br>
>><br>
>><br>
>> <a href="https://github.com/openstack/puppet-openstack_extras/blob/master/manifests/auth_file.pp" rel="noreferrer" target="_blank">https://github.com/openstack/p<wbr>uppet-openstack_extras/blob/ma<wbr>ster/manifests/auth_file.pp</a><br>
>><br>
>> Thanks,<br>
>> -Alex<br>
>><br>
>><br>
>> ><br>
>> > Can anyone advise how the openrc file should be formatted ?<br>
>> ><br>
>> > Thanks!<br>
>> ><br>
>> ><br>
>> ><br>
>> ><br>
>> > Cheers,<br>
>> > Just<br>
>> ><br>
>> > Notice: This email is confidential and may contain copyright material<br>
>> > of<br>
>> > members of the Ocado Group. Opinions and views expressed in this message<br>
>> > may<br>
>> > not necessarily reflect the opinions and views of the members of the<br>
>> > Ocado<br>
>> > Group.<br>
>> ><br>
>> ><br>
>> ><br>
>> > If you are not the intended recipient, please notify us immediately and<br>
>> > delete all copies of this message. Please note that it is your<br>
>> > responsibility to scan this message for viruses.<br>
>> ><br>
>> ><br>
>> ><br>
>> > Fetch and Sizzle are trading names of Speciality Stores Limited and<br>
>> > Fabled<br>
>> > is a trading name of Marie Claire Beauty Limited, both members of the<br>
>> > Ocado<br>
>> > Group.<br>
>> ><br>
>> ><br>
>> ><br>
>> > References to the “Ocado Group” are to Ocado Group plc (registered in<br>
>> > England and Wales with number 7098618) and its subsidiary undertakings<br>
>> > (as<br>
>> > that expression is defined in the Companies Act 2006) from time to time.<br>
>> > The registered office of Ocado Group plc is Titan Court, 3 Bishops<br>
>> > Square,<br>
>> > Hatfield Business Park, Hatfield, Herts. AL10 9NE.<br>
>> ><br>
>> ><br>
>> > ______________________________<wbr>_________________<br>
>> > OpenStack-operators mailing list<br>
>> > <a href="mailto:OpenStack-operators@lists.openstack.org" target="_blank">OpenStack-operators@lists.open<wbr>stack.org</a><br>
>> > <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi<wbr>-bin/mailman/listinfo/openstac<wbr>k-operators</a><br>
>> ><br>
><br>
><br>
><br>
> Notice: This email is confidential and may contain copyright material of<br>
> members of the Ocado Group. Opinions and views expressed in this message may<br>
> not necessarily reflect the opinions and views of the members of the Ocado<br>
> Group.<br>
><br>
><br>
><br>
> If you are not the intended recipient, please notify us immediately and<br>
> delete all copies of this message. Please note that it is your<br>
> responsibility to scan this message for viruses.<br>
><br>
><br>
><br>
> Fetch and Sizzle are trading names of Speciality Stores Limited and Fabled<br>
> is a trading name of Marie Claire Beauty Limited, both members of the Ocado<br>
> Group.<br>
><br>
><br>
><br>
> References to the “Ocado Group” are to Ocado Group plc (registered in<br>
> England and Wales with number 7098618) and its subsidiary undertakings (as<br>
> that expression is defined in the Companies Act 2006) from time to time.<br>
> The registered office of Ocado Group plc is Titan Court, 3 Bishops Square,<br>
> Hatfield Business Park, Hatfield, Herts. AL10 9NE.<br>
</div></div></blockquote></div><br></div></div></div>
</blockquote></div><br></div>
<br>
<p style="margin:0px;background-color:rgb(255,255,255)"><font color="#aeaaaa" face="Calibri, sans-serif"><span style="font-size:14.6667px">Notice: This email is confidential and may contain copyright material of members of the Ocado Group. Opinions and views expressed in this message may not necessarily reflect the opinions and views of the members of the Ocado Group. </span></font></p><p style="margin:0px;background-color:rgb(255,255,255)"><font color="#aeaaaa" face="Calibri, sans-serif"><span style="font-size:14.6667px"> </span></font></p><p style="margin:0px;background-color:rgb(255,255,255)"><font color="#aeaaaa" face="Calibri, sans-serif"><span style="font-size:14.6667px">If you are not the intended recipient, please notify us immediately and delete all copies of this message. Please note that it is your responsibility to scan this message for viruses. </span></font></p><p style="margin:0px;background-color:rgb(255,255,255)"><font color="#aeaaaa" face="Calibri, sans-serif"><span style="font-size:14.6667px"> </span></font></p><p style="margin:0px;background-color:rgb(255,255,255)"><font color="#aeaaaa" face="Calibri, sans-serif"><span style="font-size:14.6667px">Fetch and Sizzle are trading names of Speciality Stores Limited and Fabled is a trading name of Marie Claire Beauty Limited, both members of the Ocado Group.</span></font></p><p style="margin:0px;background-color:rgb(255,255,255)"><font color="#aeaaaa" face="Calibri, sans-serif"><span style="font-size:14.6667px"> </span></font></p><p style="margin:0px;background-color:rgb(255,255,255)"><font color="#aeaaaa" face="Calibri, sans-serif"><span style="font-size:14.6667px">References to the “Ocado Group” are to Ocado Group plc (registered in England and Wales with number 7098618) and its subsidiary undertakings (as that expression is defined in the Companies Act 2006) from time to time. The registered office of Ocado Group plc is Titan Court, 3 Bishops Square, Hatfield Business Park, Hatfield, Herts. AL10 9NE.</span></font></p><br>______________________________<wbr>_________________<br>
OpenStack-operators mailing list<br>
<a href="mailto:OpenStack-operators@lists.openstack.org">OpenStack-operators@lists.<wbr>openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" rel="noreferrer" target="_blank">http://lists.openstack.org/<wbr>cgi-bin/mailman/listinfo/<wbr>openstack-operators</a><br>
<br></blockquote></div></div>