script/stackenv: Don't set 'OS_SYSTEM_SCOPE' until necessary

stephenfin · stephenfin · commit a73ddcd68e76 · 2024-05-28T15:13:10.000+01:00
We were setting OS_SYSTEM_SCOPE in some of the functional ironic tests.
This was resulting in the following errors when attempting to create
resources:

  Authentication cannot be scoped to multiple targets. Pick one of:
  project, domain, trust, system or unscoped

Unfortunately, because we weren't setting 'errexit' ('set -e') this
wasn't being noticed, but we can "correct" things now. I say "correct"
because, adding to the misfortune, how we fix this is technically
incorrect - you should have project-scoped configuration *or*
system-scoped, not both - but since we don't yet have the infrastructure
to switch between sets of auth info on a test-by-test basis, we need to
do a Bad Thing. Hopefully this will be a short-lived thing.

Signed-off-by: Stephen Finucane &lt;stephenfin@redhat.com&gt;
diff --git a/.github/workflows/functional-baremetal.yaml b/.github/workflows/functional-baremetal.yaml
@@ -15,24 +15,24 @@ jobs:
             openstack_version: "master"
             ubuntu_version: "22.04"
             # NOTE(dtantsur): this forces running tests with a system scope
-            # token, which is required for certain actions. Use "all" on
-            # versions starting with 2024.1.
-            os_system_scope: "all"
+            # token, which is required for certain actions. Use it on versions
+            # starting with 2024.1.
+            use_system_scope: true
             additional_services: "openstack-cli-server"
           - name: "caracal"
             openstack_version: "stable/2024.1"
             ubuntu_version: "22.04"
-            os_system_scope: "all"
+            use_system_scope: true
             additional_services: ""
           - name: "bobcat"
             openstack_version: "stable/2023.2"
             ubuntu_version: "22.04"
-            os_system_scope: ""
+            use_system_scope: false
             additional_services: ""
           - name: "antelope"
             openstack_version: "stable/2023.1"
             ubuntu_version: "22.04"
-            os_system_scope: ""
+            use_system_scope: false
             additional_services: ""
     runs-on: ubuntu-${{ matrix.ubuntu_version }}
     name: Deploy OpenStack ${{ matrix.name }} with Ironic and run baremetal acceptance tests
@@ -98,8 +98,8 @@ jobs:
           DEVSTACK_PATH: ${{ github.workspace }}/devstack
           PACKAGE: "./internal/acceptance/openstack/baremetal/..."
           OS_BRANCH: ${{ matrix.openstack_version }}
-          # TODO(dtantsur): default to "all" when no longer supporting versions before 2024.1
-          OS_SYSTEM_SCOPE: ${{ matrix.os_system_scope }}
+          # TODO(dtantsur): default to true when no longer supporting versions before 2024.1
+          USE_SYSTEM_SCOPE: ${{ matrix.use_system_scope }}
       - name: Generate logs on failure
         run: ./script/collectlogs
         if: failure()
diff --git a/script/stackenv b/script/stackenv
@@ -7,6 +7,25 @@
 DEVSTACK_PATH=${DEVSTACK_PATH:-/opt/stack/new/devstack}
 pushd $DEVSTACK_PATH
 source openrc admin admin
+
+if [[ "${USE_SYSTEM_SCOPE:-}" == "true" ]]; then
+    # use system-scoped tokens
+    echo export OS_SYSTEM_SCOPE=all >> openrc
+fi
+# TODO: This should only be set when using project-scoped tokens (and we should
+# unsetting things like OS_PROJECT_NAME and OS_PROJECT_DOMAIN_ID when not using
+# these) but our tests require both which means we need to export both. This
+# causes OSC to (correctly) fail since keystoneauth (which is handling
+# authentication for OSC and most other clients) can't tell if we want project-
+# or system-scoped tokens. As such, post running this script, the 'openrc' file
+# will no longer be usable with OSC or other clients.
+#
+# The long-term fix for this likely involves a mechanism to switch between
+# different sets of auth info on a test-by-test basis. Achieving this almost
+# certainly means switching our tests to use clouds.yaml with well-known cloud
+# names rather than openrc file currently used.
+echo export OS_DOMAIN_ID=default >> openrc
+
 openstack flavor create m1.acctest --id 99 --ram 512 --disk 10 --vcpu 1 --ephemeral 10
 openstack flavor create m1.resize --id 98 --ram 512 --disk 11 --vcpu 1 --ephemeral 10
 openstack keypair create magnum
@@ -28,12 +47,7 @@ echo export OS_EXTGW_ID="$_EXTGW_ID" >> openrc
 echo export OS_POOL_NAME="public" >> openrc
 echo export OS_FLAVOR_ID=99 >> openrc
 echo export OS_FLAVOR_ID_RESIZE=98 >> openrc
-echo export OS_DOMAIN_ID=default >> openrc
 echo export OS_MAGNUM_IMAGE_ID="$_MAGNUM_IMAGE_ID" >> openrc
 echo export OS_MAGNUM_KEYPAIR=magnum >> openrc
 source openrc admin admin
-if [[ "${OS_SYSTEM_SCOPE:-}" == "all" ]]; then
-    unset PROJECT_NAME
-    unset TENANT_NAME
-fi
 popd
