[kolla-ansible][Antelope][Keystone] Redelegation Not Working with Heat
Hello!
We are attempting to use role redelegation with Heat and Keystone to deploy a stack that deploys Zaqar subscriptions among other resources.
When attempting to scale up the stack, we receive this error:
TypeError: '<' not supported between instances of 'NoneType' and 'int')
This appears to be sourced from this check in the code in the Keystone core.py file.
# expiry times trust_expiry = trust.get('expires_at') redelegated_expiry = redelegated_trust['expires_at'] if trust_expiry: # redelegated trust is from backend and has no tzinfo if redelegated_expiry < trust_expiry.replace(tzinfo=None): raise exception.Forbidden( _('Requested expiration time is more ' 'than redelegated trust can provide'))
The issue appears to be related to 'None' values for what is passed into 'expires_at' for 'redelegated_expiry'.
We have this config in keystone.conf: [trust] allow_redelegation = True
And this in heat.conf:
reauthentication_auth_method = trusts allow_trusts_redelegation = True
This is how we are scaling the stack:
openstack stack resource signal <stack_name> scale_up_policy
Any suggestions on how to fix this issue?
Thanks,
Devin
participants (1)
-
Devin Patterson