Juju Charms Collection
nova-cloud-controller package

Mitaka nova keystone_authtoken missing auth_uri

Bug #1557223 reported by Brad Marshall
20
This bug affects 3 people
Affects Status Importance Assigned to Milestone
OpenStack Nova Cloud Controller Charm
Fix Released
High
Liam Young
nova-cloud-controller (Juju Charms Collection)
Invalid
High
Liam Young

Bug Description

I've been deploying a Mitaka openstack using the trusty-mitaka cloud archives and have noticed something odd with the nova.conf keystone_authtoken section. We've been using the auth_uri setting in our verification scripts to ensure that the keystone VIP is being used, and this has broken that validation. Investigating this has shown what appears to be a confusing situation.

With earlier version (Liberty and below) that section has an auth_uri and identity_uri setting which looks like:

  identity_uri = http://<keystone_vip>:35357/
  auth_uri = http://<keystone_vip>:5000/

Mitaka however has only an auth_url setting, like:

  auth_url = http://<keystone_vip>:35357

and also has a warning in nova-api-os-compute.log:

  2016-03-14 12:46:33.586 124365 WARNING keystonemiddleware.auth_token [-] Configuring auth_uri to point to the public identity endpoint is required; clients may not be able to authenticate against an admin endpoint

The best explanation of the difference I've found is at http://lists.openstack.org/pipermail/openstack-dev/2016-March/088636.html, I _think_ it means we need both - but am willing to be corrected.

I suspect we need at least an auth_uri setting in the nova.conf pointing to the publicURL endpoint for keystone.

This was tested with trusty servers deployed using MaaS 1.9.1+bzr4543-0ubuntu1 (trusty1) deployed with the openstack-charmers next branch as of 9th March 2016 - in particular nova-cloud-controller was r224 and keystone r214.

Please let me know if you need any more information about this.

Related branches

lp:~gnuoy/charm-helpers/keystone_authtoken
Billy Olsen: Approve
Edward Hope-Morley: Needs Information
Diff: 44 lines (+15/-13)
2 files modified
charmhelpers/contrib/openstack/templates/section-keystone-authtoken (+5/-13)
charmhelpers/contrib/openstack/templates/section-keystone-authtoken-legacy (+10/-0)
Revision history for this message
Liam Young (gnuoy) wrote :

I think we should take the install guide as authoritative. It says....

http://docs.openstack.org/liberty/install-guide-ubuntu/nova-controller-install.html
[DEFAULT]
...
auth_strategy = keystone

[keystone_authtoken]
...
auth_uri = http://controller:5000
auth_url = http://controller:35357
auth_plugin = password
project_domain_id = default
user_domain_id = default
project_name = service
username = nova
password = NOVA_PASS

http://docs.openstack.org/kilo/install-guide/install/apt/content/ch_nova.html#nova-controller-install
[DEFAULT]
...
auth_strategy = keystone

[keystone_authtoken]
...
auth_uri = http://controller:5000
auth_url = http://controller:35357
auth_plugin = password
project_domain_id = default
user_domain_id = default
project_name = service
username = nova
password = NOVA_PASS

http://docs.openstack.org/juno/install-guide/install/apt/content/ch_nova.html#nova-controller-install
[DEFAULT]
...
auth_strategy = keystone

[keystone_authtoken]
...
auth_uri = http://controller:5000/v2.0
identity_uri = http://controller:35357
admin_tenant_name = service
admin_user = nova
admin_password = NOVA_PASS

http://docs.openstack.org/icehouse/install-guide/install/apt/content/nova-controller.html
[DEFAULT]
...
auth_strategy = keystone
Add these keys to the [keystone_authtoken] section:



[keystone_authtoken]
...
auth_uri = http://controller:5000
auth_host = controller
auth_port = 35357
auth_protocol = http
admin_tenant_name = service
admin_user = nova
admin_password = NOVA_PASS

As bradm points out this does not match what our charms are doing.

Changed in nova-cloud-controller (Juju Charms Collection):
status: New → Confirmed
importance: Undecided → Medium
importance: Medium → High
assignee: nobody → Liam Young (gnuoy)
Edward Hope-Morley (hopem)
Changed in nova-cloud-controller (Juju Charms Collection):
status: Confirmed → In Progress
Revision history for this message
Andres Toomsalu (andres-active) wrote :
Download full text (9.7 KiB)

Im having similar problem. Deployed Mitaka on Trusty with MaaS 1.94 and Juju 1.25.6.
In the log for nova-api-metadata service when VM boots and requests instance metadata:
--- LOG ---
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler [req-28a7fa71-aa04-4e9e-99c1-6b251a396174 - - - - -] Failed to get metadata for instance id: 7bd7798b-9491-47b4-a972-7d979a26dd20
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler Traceback (most recent call last):
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler File "/usr/lib/python2.7/dist-packages/nova/api/metadata/handler.py", line 311, in _get_meta_by_instance_id
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler remote_address)
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler File "/usr/lib/python2.7/dist-packages/nova/api/metadata/handler.py", line 106, in get_metadata_by_instance_id
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler data = base.get_metadata_by_instance_id(instance_id, address)
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler File "/usr/lib/python2.7/dist-packages/nova/api/metadata/base.py", line 551, in get_metadata_by_instance_id
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler return InstanceMetadata(instance, address)
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler File "/usr/lib/python2.7/dist-packages/nova/api/metadata/base.py", line 134, in __init__
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler ctxt, instance)
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler File "/usr/lib/python2.7/dist-packages/nova/network/security_group/neutron_driver.py", line 417, in get_instance_security_groups
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler context, servers, detailed)
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler File "/usr/lib/python2.7/dist-packages/nova/network/security_group/neutron_driver.py", line 381, in get_instances_security_groups_bindings
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler ports = self._get_ports_from_server_list(servers, neutron)
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler File "/usr/lib/python2.7/dist-packages/nova/network/security_group/neutron_driver.py", line 340, in _get_ports_from_server_list
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler ports.extend(neutron.list_ports(**search_opts).get('ports'))
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler File "/usr/lib/python2.7/dist-packages/neutronclient/v2_0/client.py", line 97, in with_params
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler ret = self.function(instance, *args, **kwargs)
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler File "/usr/lib/python2.7/dist-packages/neutronclient/v2_0/client.py", line 644, in list_ports
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler **_params)
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler File "/usr/lib/python2.7/dist-packages/neutronclient/v2_0/client.py", line 373, in list
2016-08-31 22:59:42.347 24078 ERROR nova.api.metadata.handler ...

Read more...

James Page (james-page)
Changed in charm-nova-cloud-controller:
assignee: nobody → Liam Young (gnuoy)
importance: Undecided → High
status: New → In Progress
Changed in nova-cloud-controller (Juju Charms Collection):
status: In Progress → Invalid
James Page (james-page)
Changed in charm-nova-cloud-controller:
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.