Why do I get "Access denied to resource server"?

asked 2018-05-15 03:01:02 -0500

eusanka gravatar image

I am using the following template heat-templates/hot/software-config/example-templates/example-sw-component-template.yaml to test lifecycle handling of a virtual machine. I have made a small addition and added "actions: [DELETE]" to this heat template. My test is very simple where I do "CREATE STACK" and after that when the stack is complete, I do "DELETE STACK". This is where I get some issues. Looking in the heat-engine.log, I can see the following WARNING:

2018-05-15 08:41:35.643 22363 WARNING heat.engine.service [req-2d2568de-c7e3-4edf-b5b3-4e12cdf636a5 - 85e37bbe49e541c1988c854674a605f5-733b7cd1-f9d0-4a86-b332-e64b8cf - 41947affb1c6435bb448ad207c596283 41947affb1c6435bb448ad207c596283] Access denied to resource server

This warning comes from service.py traced back to function access_allowed in stack.py which come back as False. The reason for this seems to be that "if not self.resources={}". There is a comment here which says a lazy-loading of resources should be triggered but I don't know if this is done or how it's working. The effect of it will be that "DELETE STACK" will hang and the only way to get out of this situation is to delete the instance by itself.

My test is performed on the following software:

  • OpenStack-Ansible Pike 16.08 on RHEL 7.4
  • qcow2 image on RHEL 7.4 including python-heat-agent RPM (this RPM has dependencies to heat-cfntools, os-apply-config, os-collect-config, os-refresh-config, python-heatclient, python-zaqarclient) for OS12 and make sure that service os-collect-config is enabled.
edit retag flag offensive close merge delete