ZZ00509: WHEN USER PASSWORDS ARE CHANGED ON THE DEPLOYMENT SERVER (DS), IT IS NECESSARY TO UPDATE THE PASSWORD INSIDE THE DS KEYSTONE.

IBM Cloud Orchestrator Fix Pack 4 (2.4.0.4) for 2.4

APAR status

• Closed as documentation error.

Error description

• When performing DS upgrade (deploy_deployment_service.sh) on an
  environment which has previously changed the service account
  passwords (eg, admin, glance, heat, nova) by following the
  steps on this page:
  http://www-01.ibm.com/support/knowledgecenter/SS4KMC_2.4.0.3/com
  .ibm.sco.doc_2.4/t_changing_ds_password.html?lang=en
  
  it is also necessary to perform the user password update inside
  the DS keystone as well.
  
  NOTE: this is not the same keystone which runs on the
  Central-Server-2, this is an isolated keystone which runs on
  the DS and only gets used by the DS to perform install and
  upgrade activities.
  

Local fix

• Prior to starting the deploy upgrade script, the admin user
  must perform keystone user password update steps:
   "keystone user-password-update --pass newPassword <user>" for
  all the service accounts
  (admin,ceilometer,demo,domadmin,glance,heat,nova)
  

Problem summary

• WHEN USER PASSWORDS ARE CHANGED ON THE DEPLOYMENT SERVER (DS),
  IT IS NECESSARY TO UPDATE THE PASSWORD INSIDE THE DS KEYSTONE.
  

Problem conclusion

• A workaround was found using the -S parameter with this to pass
  the new password:
  
  
  ./deploy_deployment_service.sh -S newPassword
  
  
  
  This page should get updated to inform of using -S when the
  
  admin user password is non-default:
  
  http://www-01.ibm.com/support/knowledgecenter/SS4KMC_2.4.0
  .3/com
  .ibm.sco.doc_2.4/t_upgrade_to_FP01_non_ha.html
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels