yanyao: What did the keystone logs say to indicate a relationship to
Fernet?
** Also affects: keystone
Importance: Undecided
Status: New
** Also affects: keystone/kilo
Importance: Undecided
Status: New
** Changed in: keystone
Status: New => Invalid
** Changed in: keystone/kilo
Status: New => Incomplete
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).
https://bugs.launchpad.net/bugs/1515485
Title:
Heat CFN signals do not pass authorization
Status in OpenStack Identity (keystone):
Invalid
Status in OpenStack Identity (keystone) kilo series:
Incomplete
Status in openstack-ansible:
New
Bug description:
Note that this bug applies to the Kilo release. Master does not appear
to have this problem. I did not test liberty yet.
Heat templates that rely on CFN signals timeout because the API calls
that execute these signals return 403 errors. Heat signals, on the
other side, do work.
The problem was reported to me by Alex Cantu. I have verified it on
his multinode lab and have also reproduced on my own single-node
system hosted on a public cloud server. I suspect liberty/master
avoided the problem after Jesse and I reworked the Heat configuration
to use Keystone v3 the last day before the L release.
Example template, which can be executed in an AIO after running the
tempest playbook:
heat_template_version: 2013-05-23
resources:
wait_condition:
type: AWS::CloudFormation::WaitCondition
properties:
Handle: { get_resource: wait_handle }
Count: 1
Timeout: 600
wait_handle:
type: AWS::CloudFormation::WaitConditionHandle
my_instance:
type: OS::Nova::Server
properties:
image: cirros
flavor: m1.tiny
networks:
- network: "private"
user_data_format: RAW
user_data:
str_replace:
template: |
#!/bin/sh
echo "wc_notify"
curl -H "Content-Type:" -X PUT wc_notify --data-binary
'{"status": "SUCCESS"}'
params:
wc_notify: { get_resource: wait_handle }
This template should end very quickly, as it starts a cirros instance
that just sends a signal back to heat. But instead, it timeouts. The
user data script dumps the signal URL to the console log, if you then
try to send the signal manually you will get a 403. The original 403
can also be seen in the heat-api-cfn.log file. Here is the log
snippet:
2015-11-12 05:13:34.491 1862 INFO heat.api.aws.ec2token [-] Checking AWS
credentials..
2015-11-12 05:13:34.492 1862 INFO heat.api.aws.ec2token [-] AWS credentials
found, checking against keystone.
2015-11-12 05:13:34.493 1862 INFO heat.api.aws.ec2token [-] Authenticating
with http://172.29.236.100:5000/v3/ec2tokens
2015-11-12 05:13:34.533 1862 INFO heat.api.aws.ec2token [-] AWS
authentication failure.
2015-11-12 05:13:34.534 1862 INFO eventlet.wsgi.server [-]
10.0.3.181,172.29.236.100 - - [12/Nov/2015 05:13:34] "PUT
/v1/waitcondition/arn%3Aopenstack%3Aheat%3A%3A683acadf4d04489f8e991b44014e6fc1%3Astacks%2Fwc1%2Faa4083b6-ce6c-411f-9df9-d059abacf40c%2Fresources%2Fwait_handle?Timestamp=2015-11-12T05%3A12%3A27Z&SignatureMethod=HmacSHA256&AWSAccessKeyId=65657d1021e24e49ba4fb6f217ca4a22&SignatureVersion=2&Signature=aCG%2FO04MNLzSlf5gIBGw1hMcC7bQzB3pZXVKzXLLNSo%3D
HTTP/1.1" 403 301 0.043961
For reference, the curl command to trigger the signal is: curl -H
"Content-Type:" -X PUT "<cfn-signal-url".
To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1515485/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
