keystone always advertises its public endpoint in the identity-service relation

[Junien F]

Hi,

keystone always advertises its public endpoint in the identity-service relation, see :

https://github.com/openstack/charm-keystone/blob/5a18adffbd413dcabed2e443e44f572e36a4c108/hooks/keystone_utils.py#L1551

https://github.com/openstack/charm-keystone/blob/5a18adffbd413dcabed2e443e44f572e36a4c108/hooks/keystone_utils.py#L1671

There should at least be a config knob to make it advertise its private endpoint.

I need this because the openstack-dashboard charm will use this host to reach keystone, so there's no way to tell openstack-dashboard to use the internal endpoint.

Thanks

[Junien F (axino)]

heat is also using the public keystone endpoint even with "use-internal-endpoints" set to true.

[James Page (james-page)]

This is somewhat complicated - currently we template:

[keystone_authtoken]
auth_uri = {{ service_protocol }}://{{ service_host }}:{{ service_port }}
auth_url = {{ auth_protocol }}://{{ auth_host }}:{{ auth_port }}

where service host is always the PUBLIC endpoint, and auth host is always the ADMIN endpoint.

auth_uri must be the PUBLIC endpoint as its used in 'authentication required' responses to end users - so it needs to be the PUBLIC endpoint.

The charm usage of the ADMIN endpoint for the auth_url appears to be atypical - most deployments will use the INTERNAL endpoint for this configuration.

That said the openstack-dashboard charm does no differentiation between endpoints - it just gets pointed at service_host (which is always the public endpoint).

[James Page (james-page)]

I think exposing the internal endpoint for keystone and an additional set of keys is a good idea; the admin endpoint is a bit of a legacy concept.

[Boggy (kowalczykb)]

Exposing internal url - https://review.opendev.org/#/c/696997

[Felipe Reyes (freyes)]

PR for openstack-dashboard https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/776254

[Aurelien Lourot (aurelien-lourot)]

@Felipe would you like to create a charm-guide review for the release notes? Thanks!

[Aurelien Lourot (aurelien-lourot)]

Release notes: https://review.opendev.org/c/openstack/charm-guide/+/783879