OSTF tests don’t work with disabled Keystone V2

[Alexander Petrov]

I have run some OSTF tests on MOS 9.1 RC2 with keystone V2 disabled and got the following error message on any tests:

Can not set proxy for Health Check.Make sure that network configuration for controllers is correct

I grep /var/log/keystone-all.log and can see V2 requests as below:

root@node-1:~# cat /var/log/keystone-all.log | grep v2
<46>Oct 6 10:41:54 node-1 keystone_wsgi_main_access 10.109.9.4 - - [06/Oct/2016:10:41:48 +0000] "POST /v2.0/tokens HTTP/1.0" 404 93 6120 "-" "python-keystoneclient"
<46>Oct 6 10:41:54 node-1 keystone_wsgi_main_access 10.109.9.4 - - [06/Oct/2016:10:41:48 +0000] "POST /v2.0/tokens HTTP/1.0" 404 93 4785 "-" "python-keystoneclient"

Steps to reproduce:
#1. Deploy env (1 controller, 1 compute)
#2. On controller make sure that Keystone V2 disabled
Here is a simple script how to disable keystone v2 on controller: https://gist.github.com/alvip/c21028ad8750e96875e0d7f1da82cf26
#3. Run any OSTF test in Fuel Web

Expected results:
 test PASSED

Actual result:
 ERROR:
 Can not set proxy for Health Check.Make sure that network configuration for controllers is correct

[Pavlo Shchelokovskyy (pshchelo)]

This is not how Keystone V3 is supposed to be disabled. The auth configuration for service users is generated during puppet run, and presumably all components in all their config files have auth_url or such pointing to Keystone v2.

The only way this could possibly work is if all components used keystoneauth lib and its auth_plugins, with dynamic auth_plugin "password" configured, which will choose V2/V3 depending on their availability. AFAIK not all components do this, and I am actually not sure this would work at all.

BTW, AFAIK in upstream there is no integration job (testing multiple components at once) that has Keystone V2 completely disabled, so re actual support for running the whole cloud on Keystone V3 only we are in a bit grey area for now.