From cbd474cc4801b1918b7e267e0ad6e23282079974 Mon Sep 17 00:00:00 2001 From: Mark Goddard Date: Wed, 31 Mar 2021 10:51:20 +0100 Subject: [PATCH] octavia: Ensure service auth project exists Kolla Ansible supports configuration of the project used by Octavia to communicate with other services, via octavia_service_auth_project. Until Ussuri, this was set to admin. In Ussuri it changed to service. It may also be set to a different value. Kolla Ansible currently gives the octavia user the admin role in the project, but it does not ensure that the project exists. For admin and service projects, this is not a problem. If the project has been customised however, it will not necessarily exist, which will cause Octavia deployment to fail. This change fixes the issue by ensuring that the service auth project exists, in addition to the service project. Closes-Bug: #1922100 Change-Id: I968efbf3ad1de676548b4e3aeefc20bf80ca94a0 (cherry picked from commit fbd80bcdc869cf22330d5d3c8770ec11bb28b4cd) --- ansible/roles/octavia/defaults/main.yml | 7 +++++++ ansible/roles/octavia/tasks/register.yml | 15 --------------- ...ate-service-auth-project-aa38b12ebb601777.yaml | 7 +++++++ 3 files changed, 14 insertions(+), 15 deletions(-) create mode 100644 releasenotes/notes/octavia-create-service-auth-project-aa38b12ebb601777.yaml diff --git a/ansible/roles/octavia/defaults/main.yml b/ansible/roles/octavia/defaults/main.yml index c2ca8e774a..cb63dd1560 100644 --- a/ansible/roles/octavia/defaults/main.yml +++ b/ansible/roles/octavia/defaults/main.yml @@ -227,6 +227,13 @@ octavia_ks_users: user: "{{ octavia_keystone_user }}" password: "{{ octavia_keystone_password }}" role: "admin" + # NOTE(mgoddard): The default for the service auth project is service, but + # may be customised. Ensure the project exists, and assign the octavia user + # the admin role in it. + - project: "{{ octavia_service_auth_project }}" + user: "{{ octavia_keystone_user }}" + password: "{{ octavia_keystone_password }}" + role: "admin" #################### # Kolla diff --git a/ansible/roles/octavia/tasks/register.yml b/ansible/roles/octavia/tasks/register.yml index f8e9fe1148..079a59a022 100644 --- a/ansible/roles/octavia/tasks/register.yml +++ b/ansible/roles/octavia/tasks/register.yml @@ -6,21 +6,6 @@ service_ks_register_services: "{{ octavia_ks_services }}" service_ks_register_users: "{{ octavia_ks_users }}" -- name: "Adding admin role to octavia user in {{ octavia_service_auth_project }} project" - become: true - kolla_toolbox: - module_name: "os_user_role" - module_args: - user: "{{ octavia_keystone_user }}" - role: admin - project: "{{ octavia_service_auth_project }}" - auth: "{{ openstack_octavia_auth }}" - endpoint_type: "{{ openstack_interface }}" - cacert: "{{ openstack_cacert }}" - region_name: "{{ openstack_region_name }}" - run_once: True - when: octavia_service_auth_project != 'service' - - name: Adding octavia related roles become: true kolla_toolbox: diff --git a/releasenotes/notes/octavia-create-service-auth-project-aa38b12ebb601777.yaml b/releasenotes/notes/octavia-create-service-auth-project-aa38b12ebb601777.yaml new file mode 100644 index 0000000000..8f1d8bc5dc --- /dev/null +++ b/releasenotes/notes/octavia-create-service-auth-project-aa38b12ebb601777.yaml @@ -0,0 +1,7 @@ +--- +fixes: + - | + Fixes an issue with Octavia deployment when using a custom service auth + project. If ``octavia_service_auth_project`` is set to a project that does + not exist, Octavia deployment would fail. The project is now created. + `LP#1922100 `__