1

I am trying out Heat orchestration on OpenStack. When setting up a single instance stack using the configuration below, I am getting this error:

Error: ERROR: Missing required credential: roles [u'_member_']

What could be the issue here?

Thanks!

heat_template_version: 2013-05-23

description: Simple template to deploy a single compute instance

resources:
  my_instance:
    type: OS::Nova::Server
    properties:
      image: CentOS-6-x86_64-GenericCloud-2016-04-05
      flavor: c1-tiny
      key_name: mine
      networks:
        - network: private_network
0

the member attribute denotes a role on OpenStack projects, so this is an error thrown by keystone, I can think of Two possibilities - the user that is invoking the stack does not have a member role (If you can log into horizon you have this role) or the heat domain and stack user has not been set up, from the install prerequisites:

Orchestration requires additional information in the Identity service to manage stacks. To add this information, complete these steps:

Create the heat domain that contains projects and users for stacks:

$ openstack domain create --description "Stack projects and users" heat
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | Stack projects and users         |
| enabled     | True                             |
| id          | 0f4d1bd326f2454dacc72157ba328a47 |
| name        | heat                             |
+-------------+----------------------------------+
Create the heat_domain_admin user to manage projects and users in the heat domain:

$ openstack user create --domain heat --password-prompt heat_domain_admin
User Password:
Repeat User Password:
+-----------+----------------------------------+
| Field     | Value                            |
+-----------+----------------------------------+
| domain_id | 0f4d1bd326f2454dacc72157ba328a47 |
| enabled   | True                             |
| id        | b7bd1abfbcf64478b47a0f13cd4d970a |
| name      | heat_domain_admin                |
+-----------+----------------------------------+
Add the admin role to the heat_domain_admin user in the heat domain to enable administrative stack management privileges by the heat_domain_admin user:

$ openstack role add --domain heat --user heat_domain_admin admin
 Note
This command provides no output.

Create the heat_stack_owner role:

$ openstack role create heat_stack_owner
+-------+----------------------------------+
| Field | Value                            |
+-------+----------------------------------+
| id    | 15e34f0c4fed4e68b3246275883c8630 |
| name  | heat_stack_owner                 |
+-------+----------------------------------+
Add the heat_stack_owner role to the demo project and user to enable stack management by the demo user:

$ openstack role add --project demo --user demo heat_stack_owner
 Note
This command provides no output.

 Note
You must add the heat_stack_owner role to each user that manages stacks.

Create the heat_stack_user role:

$ openstack role create heat_stack_user
+-------+----------------------------------+
| Field | Value                            |
+-------+----------------------------------+
| id    | 88849d41a55d4d1d91e4f11bffd8fc5c |
| name  | heat_stack_user                  |
+-------+----------------------------------+
 Note
The Orchestration service automatically assigns the heat_stack_user role to users that it creates during stack deployment. By default, this role restricts API operations. To avoid conflicts, do not add this role to users with the heat_stack_owner role. 
4
  • I am not logging into the OpenStack using Keystone Credentials, but through a secondary authentication system. I don't have Keystone Credentials. Could that be the issue? – madtowneast Apr 15 '16 at 16:33
  • It could be a issue, because if you are signing in with SSO or domain scoped tokens heat might be using an identity api that doesn't understand your security tokens (keystone issues version 3 tokens for domain users). are you launching from cli or from dashboard? – Sum1sAdmin Apr 15 '16 at 16:39
  • From dashboard, I don't have cli access at the moment. The authentication settings as setup by the PROJECT-openrc.sh does seem to work without Keystone credentials. – madtowneast Apr 15 '16 at 16:53
  • I would report it to your administrator, I think it's a problem with the heat service – Sum1sAdmin Apr 15 '16 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.