Handling auth expiry for long-running deployments (keystone trusts)
Long deployments (a long running heat job, or lots of components, slow servers etc) can eventually hit an authorization error as the user's token expires. Murano cannot regenerate the token, and the deployment fails. This isn't a problem specific to Murano (it affects Solum also, and maybe TripleO) but there's no clear solution. Keystone trusts might be a partial solution but (I think) chaining is necessary to pass on responsibility to Heat.
We do need a solution for this, because by its nature it will be possible (or even encouraged) to start large deployments.
Blueprint information
- Status:
- Complete
- Approver:
- ruhe
- Priority:
- High
- Drafter:
- Steve McLellan
- Direction:
- Approved
- Assignee:
- Stan Lagun
- Definition:
- Approved
- Series goal:
- Accepted for kilo
- Implementation:
-
Implemented
- Milestone target:
-
2015.1.0
- Started by
- Stan Lagun
- Completed by
- Serg Melikyan
Related branches
Related bugs
Sprints
Whiteboard
After talking to Steve Hardy, heat supports trust delegation (and it will be the default at some point), so in theory (TM) once the initial stack-create succeeds, Heat should be able to continue functioning.
It should be possible for Murano to do the same; use the initial token to generate a trust that will be valid for e.g. checking heat stack status forever. Since trust chaining is NOT yet implemented, the initial operations still have to be done with a scoped, non-trusted-
[Stan Lagun]
After some research and attempts to implement trusts I discovered that Icehouse Heat has a but that prevents it from doing anything with a token obtained from trust. Because of this bug we cannot issue new token and access stack using it. This bug was recently fixed so I'm trying to set up myself Juno Heat and test on it. Also I need to make config setting to not to use trusts (and make it default) so that Murano could still be used with Icehouse.
Also in order to use trusts with Heat the later needs to be specially configured (trusts are disabled by default) and user need to have special role (that you cannot create/add in Horizon). Thus we also need to update devstack scripts for new configuration because otherwise nothing will work with trusts enabled even on Juno
Gerrit topic: https:/
Addressed by: https:/
Use Keystone trusts to get fresh token
[asalkeld] let me know if you need help, i got solum working in this situation:
https:/
https:/
