[Rdo-list] [rdo-manager] Authentication required during overcloud deployment

[Dan Sneddon]

On 10/14/2015 03:03 PM, Erming Pei wrote:
> Hi,
> 
>   I am deploying the overcloud in baremetal way and after a couple of
> hours, it showed:
> 
> $ openstack overcloud deploy --templates
> Deploying templates in the directory
> /usr/share/openstack-tripleo-heat-templates
> ^[[A^[[BERROR: openstack ERROR: Authentication failed. Please try again
> with option --include-password or export HEAT_INCLUDE_PASSWORD=1
> Authentication required
> 
> 
> But I checked the nodes are now running:
> 
> [stack at gcloudcon-3 ~]$ nova list
> +--------------------------------------+-------------------------+--------+------------+-------------+--------------------+
> 
> | ID                                   | Name                    |
> Status | Task State | Power State | Networks           |
> +--------------------------------------+-------------------------+--------+------------+-------------+--------------------+
> 
> | 1ba04ac0-fe2b-4318-aa31-2e5f4d8422a6 | overcloud-controller-0  |
> ACTIVE | -          | Running     | ctlplane=10.0.6.60 |
> | c152ba59-3aed-4fb0-81fa-e3fed7e35cf6 | overcloud-novacompute-0 |
> ACTIVE | -          | Running     | ctlplane=10.0.6.61 |
> +--------------------------------------+-------------------------+--------+------------+-------------+--------------------+
> 
> 
> 1. Should I re-deploy the nodes or there is a way to do update/makeup
> for the authentication issue?
> 
> 2.
> I don't know how to access to the nodes.
> There is not an overcloudrc file produced.
> 
> $ ls overcloud*
> overcloud-env.json  overcloud-full.initrd  overcloud-full.qcow2
> overcloud-full.vmlinuz
> 
> overcloud-full.d:
> dib-manifests
> 
> Is it via ssh key or password? Should I set the authentication method
> somewhere?
> 
> 
> 
> Thanks,
> 
> Erming
> 
> 
> _______________________________________________
> Rdo-list mailing list
> Rdo-list at redhat.com
> https://www.redhat.com/mailman/listinfo/rdo-list
> 
> To unsubscribe: rdo-list-unsubscribe at redhat.com

This error generally means that something in the deployment got stuck,
and the deployment hung until the token expired after 4 hours. When
that happens, there is no overcloudrc generated (because there is not a
working overcloud). You won't be able to recover with a stack update,
you'll need to perform a stack-delete and redeploy once you know what
went wrong.

Generally a deployment shouldn't take anywhere near that long, a bare
metal deployment with 6 hosts takes me less than an hour, and less than
2 including a Ceph deployment. In fact, I usually set a timeout using
the --timeout option, because if it hasn't finished after, say 90
minutes (depending on how complicated the deployment is), then I want
it to bomb out so I can diagnose what went wrong and redeploy.

Often when a deployment times out it is because there were connectivity
issues between the nodes. Since you can log in to the hosts, you might
want to do some basic network troubleshooting, such as:

$ ip address   # check to see that all the interfaces are there, and
that the IP addresses have been assigned

$ sudo ovs-vsctl show     # make sure that the bridges have the proper
interfaces, vlans, and that all the expected bridges show up

$ ping <other overcloud nodes>  # you can try this on all VLANs to make
sure that any VLAN trunks are working properly

$ sudo ovs-appctl bond/show  # if running bonding, check to see the
bond status

$ sudo os-net-config --debug -c /etc/os-net-config/config.json   # run
the network configuration script again to make sure that it is able to
configure the interfaces without error. WARNING, MAY BE DISRUPTIVE as
this will reset the network interfaces, run on console if possible.

However, I want to first double-check that you had a valid command
line. You only show "openstack deploy overcloud --templates" in your
original email. You did have a full command-line, right? Refer to the
official installation guide for the right parameters.

-- 
Dan Sneddon         |  Principal OpenStack Engineer
dsneddon at redhat.com |  redhat.com/openstack
650.254.4025        |  dsneddon:irc   @dxs:twitter