yahoo-eng-team team mailing list archive

[Jesse Pretorius <jesse.pretorius@xxxxxxxxxxxxxxx>]

** Also affects: keystone
   Importance: Undecided
       Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).
https://bugs.launchpad.net/bugs/1793389

Title:
  Upgrade to Ocata: Keystone Intermittent Missing 'options' Key

Status in OpenStack Identity (keystone):
  New
Status in openstack-ansible:
  Fix Released

Bug description:
  During upgrades of Newton-EOL AIOs to Ocata, Keystone installation
  fails at the "Ensure service tenant" play of the os-keystone_install.

  This occurs using the provided run-upgrade.sh script.

  Keystone logs are thus:

  INFO keystone.common.wsgi [req-11844ac2-f2d5-46b6-986d-05019432f264 - - - - -] HEAD http://aio1-keystone-container-14a3e1ad:5000/
  DEBUG keystone.middleware.auth [req-6523488f-be1a-4ba7-a264-6b6b8ca4c936 - - - - -] There is either no auth token in the request or the certificate issuer is not trusted. No auth context will be set. fill_context /openstack/venvs/keystone-15.1.24/lib/python2.7/site-packages/keystone/middleware/auth.py:188
  INFO keystone.common.wsgi [req-6523488f-be1a-4ba7-a264-6b6b8ca4c936 - - - - -] POST http://172.29.236.66:35357/v3/auth/tokens
  ERROR keystone.common.wsgi [req-6523488f-be1a-4ba7-a264-6b6b8ca4c936 - - - - -] 'options'
  ERROR keystone.common.wsgi Traceback (most recent call last):
  ERROR keystone.common.wsgi   File "/openstack/venvs/keystone-15.1.24/lib/python2.7/site-packages/keystone/common/wsgi.py", line 228, in __call__
  ERROR keystone.common.wsgi     result = method(req, **params)
  ERROR keystone.common.wsgi   File "/openstack/venvs/keystone-15.1.24/lib/python2.7/site-packages/keystone/auth/controllers.py", line 132, in authenticate_for_token
  ERROR keystone.common.wsgi     auth_context['user_id'], method_names_set):
  ERROR keystone.common.wsgi   File "/openstack/venvs/keystone-15.1.24/lib/python2.7/site-packages/keystone/auth/core.py", line 377, in check_auth_methods_against_rules
  ERROR keystone.common.wsgi     mfa_rules = user_ref['options'].get(ro.MFA_RULES_OPT.option_name, [])
  ERROR keystone.common.wsgi KeyError: 'options'

  It appears that the sql identity backend ensures an 'options' key
  should exist with .../keystone/identity/backends/sql_schema.py:225,
  but obviously that code's not being hit.

  It should be noted that rerunning the install process causes it to be
  successful.

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1793389/+subscriptions