ZZ00446: CHANGING OPENSTACK SERVICE ACCOUNT PASSWORDS IN ICO 24, REGION SERVER SHOULD BE RESTARTED AFTER MODIFYING PASSWORDS.

IBM Cloud Orchestrator Fix Pack 3 (2.4.0.3) for 2.4

APAR status

• Closed as documentation error.

Error description

• Following instructions from this page,
  https://www-01.ibm.com/support/knowledgecenter/SS4KMC_2.4.0.2/co
  m.ibm.sco.doc_2.4/r_how_to_change_the_various_passwords.html
  Changing the password for OpenStack service users OpenStack has
  several service users: ceilometer, cinder, glance, heat,
  neutron, and nova.
  By default, when these service users are created during
  installation, they are assigned the same password as the admin
  user. To change the password of any of these service users,
  complete the following steps:
  
      Log in to the Administration user interface as a Cloud
  Administrator.
      In the navigation pane on the left, click ADMIN > Identity
  Panel >Users.
      Select the user that you want to edit. From the Actions
  column on the right, click Edit.
      Enter the new password in the Password and Confirm Password
  fields.  Click Update User.
  
  
  After attempting this, you will observe:
  
  1. admin password change only - change only the obfuscated
  value in the keystonerc file, do not change any service conf
  file --- all ok
  
  2. service user password change - change the obfuscated values
  in the service conf files --- ceilometer, cinder, glance, heat
  ok ---- neutron, nova fail
   nova and neutron conf files changed on both region-server and
  neutron-server
  
  This appears to only affect those regions with neutron... ie. if
  nova networking without neutron-server then nova commands are
  ok after changing the nova service user password.  Deployments
  fail due to nova/neutron broken.
  

Local fix

• Even after restarting all services via SCOrchestrator.py, a
  reboot of the region and neutron server will resolve the issue.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of IBM Cloud Orchestrator 2.4
  ****************************************************************
  * PROBLEM DESCRIPTION:
  When modifying the user passwords for glance nova etc on the
  region server, it was seen that the nova and neutron services no
  longer appeared to work, even after restarting all apparently
  relevant processes.
  
  ****************************************************************
  

Problem conclusion

• It would appear that some caching occurs of the passwords on the
  neutron and region servers that prevents nova and neutron cli
  from operating correctly once the passwords have been changed.
  to resolve the issue the customer should reboot the region
  server which will clear any cached information.
  
  The documentation has been updated to reflect this
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels