<div dir="auto">Hey Danish,<div dir="auto"><br></div><div dir="auto">This failure is related to the security vulnerability [1].</div><div dir="auto">There are several things to mention with this regards:</div><div dir="auto">1. Cinder has not backported fix to Wallaby, due to its complexity, so vulnerability is still not fully covered there.</div><div dir="auto">2. Nova has backported the fix, which is raising the error you see</div><div dir="auto">3. In OpenStack-Ansible we also have not backported work that is required to support service tokens to Wallaby, as there was huge amount of changes that are required for this to fix, while vulnerability is not fixed in services themselves.</div><div dir="auto">4. There is huge ongoing discussion in Technical Commetee on what to do with releases in Extended Maintenance and if we should End Of Life them or not due, which was raised by this vulnerability.</div><div dir="auto"><br></div><div dir="auto">Keeping all that in mind, you still should be able to deploy OpenStack-Ansible. And there are several ways of doing that.</div><div dir="auto"><br></div><div dir="auto">1. Deploy vulnerable version of services. So I would try using 23.4.3 instead of stable/wallaby or 23.4.4 or wallaby-em.</div><div dir="auto">You can also override nova SHA to install not patched version by providing `nova_git_install_branch: a9e81626c5e9dac897759c5f66c7ae1b4efa3c6d` to user-variables<br></div><div dir="auto">2. Apply manual config overrides for nova and cinder services to comply with new requirements for this vulnerability. So you need smth like that:</div><div dir="auto"><br></div><div dir="auto">nova_nova_conf_overrides:</div><div dir="auto"> keystone_authtoken:</div><div dir="auto"> service_token_roles_required: True</div><div dir="auto"> service_token_roles: admin</div><div dir="auto"> service_user:</div><div dir="auto"> send_service_user_token: True</div><div dir="auto"> region_name: "{{ nova_service_region }}"</div><div dir="auto"> auth_type: password</div><div dir="auto"> username: "{{ nova_service_user_name }}"</div><div dir="auto"> password: "{{ nova_service_password }}"</div><div dir="auto"> project_name: "{{ nova_service_project_name }}"</div><div dir="auto"> user_domain_id: "{{ nova_service_user_domain_id }}"</div><div dir="auto"> project_domain_id: "{{ nova_service_project_domain_id }}"</div><div dir="auto"> auth_url: "{{ keystone_service_adminurl }}"</div><div dir="auto"> insecure: "{{ keystone_service_adminuri_insecure | bool }}"</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">[1] <a href="https://security.openstack.org/ossa/OSSA-2023-003.html">https://security.openstack.org/ossa/OSSA-2023-003.html</a></div><br><br><div class="gmail_quote" dir="auto"><div dir="ltr" class="gmail_attr">On Sun, Jul 23, 2023, 01:25 Danish Khan <<a href="mailto:danish52.jmi@gmail.com">danish52.jmi@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Dear Team,<br>
<br>
I am trying to deploy openstack-ansible wallaby but it is getting<br>
failed with error:<br>
<br>
service user token configuration is required for all Nova services.<br>
For more details see the following:<br>
<a href="https://docs.openstack.org/latest/nova/admin/configuration/service-user-token.html" rel="noreferrer noreferrer" target="_blank">https://docs.openstack.org/latest/nova/admin/configuration/service-user-token.html</a><br>
<br>
But the mentioned webpage is not available.<br>
<br>
This is fixed in yoga but wallay is still failing.<br>
<br>
I tried to copy few variables from Yoga but that is working for me.<br>
<br>
Can someone please help me on this ? where I need to make some changes<br>
to deploy openstack-ansible wallaby?<br>
<br>
Thanks in advance :)<br>
<br>
Regards,<br>
Danish<br>
<br>
</blockquote></div></div>