Description

When there are multiple instances, users may encounter issues related to Resource-Based Access Control (RBAC), such as authentication failure or user not having optimum rights due to which stack operations fail, thereby affecting day-to-day operations.

This article describes the procedure to disable RBAC by using the Contrail API.

Note: The following operation must be used for troubleshooting RBAC-related issues and RBAC must be enabled after troubleshooting is completed.

Solution

Perform the following steps:

Log in to the Contrail controller VM / Config controller VM contrail-api container as detailed below:

  1. Find the details of the container by using the command docker ps : 

[root@overcloud-contrailcontroller-0 heat-admin]# docker ps | grep config_api
3c8aa51687d7        192.168.24.1:8787/contrail/contrail-controller-config-api:1908.47-rhel-queens          "/entrypoint.sh /u..."   5 months ago        Up 17 minutes                           contrail_config_api

  1. Log in to the container by using the command docker exec -it . 

[root@overcloud-contrailcontroller-0 heat-admin]# docker exec -it contrail_config_api bash
(config-api)[root@overcloud-contrailcontroller-0 /]$

  1. Check the current aaa_mode in the container. 

(config-api)[root@overcloud-contrailcontroller-0 /]$ grep auth entrypoint.sh
auth=$AUTH_MODE
aaa_mode=$AAA_MODE

  1. Modify aaa_mode in the entrypoint.sh script, which executes at the start of the container. 

(config-api)[root@overcloud-contrailcontroller-0 /]$  vi entrypoint.sh
 
auth=$AUTH_MODE
#aaa_mode=$AAA_MODE
aaa_mode=no-auth

  1. After the change is made, the entry point aaa mode should be as shown below: 

(config-api)[root@overcloud-contrailcontroller-0 /]$ grep auth entrypoint.sh
auth=$AUTH_MODE
aaa_mode=no-auth

  1. Verify the config_api container status. 

[root@overcloud-contrailcontroller-0 heat-admin]# docker ps | grep config_api
3c8aa51687d7        192.168.24.1:8787/contrail/contrail-controller-config-api:1908.47-rhel-queens          "/entrypoint.sh /u..."   5 months ago        Up 17 minutes                           contrail_config_api

  1. Restart the Contrail API container. 

[root@overcloud-contrailcontroller-0 heat-admin]# docker restart contrail_config_api
contrail_config_api

  1. Confirm the container status. 

[root@overcloud-contrailcontroller-0 heat-admin]# docker ps | grep config_api
3c8aa51687d7        192.168.24.1:8787/contrail/contrail-controller-config-api:1908.47-rhel-queens          "/entrypoint.sh /u..."   5 months ago        Up About a minute                       contrail_config_api

Note: Repeat the above steps on all the three controller config API containers.

Now operations that were failing earlier should work fine.