keystone catalog command line fails with "'NoneType' object has no attribute 'has_service_catalog'"

[Igor Milovanović]

I am running keystone on icehouse, and client version 0.7.1
I source admin rc file
with OS_SERVICE_TOKEN and OS_SERVICE_ENDPOINT
and run:

$ keystone catalog

This fails with:

"'NoneType' object has no attribute 'has_service_catalog'"

If I unset OS_SERVICE_TOKEN and OS_SERVICE_ENDPOINT, keystone catalog succeeds, but...
running:

$ keystone tenant-list

hangs & timeouts... as my installation (Fuel 5.0.1 based) has adminURL on internal non-accessible network (I am running from public network, remote host)

[Igor Milovanović (igormilovanovic)]

Workaround is to use different credentials (token and non-token) for different calls.

[David J Hu (david-j-hu)]

I see the issue for catalog, but not tenant-list.

keystone --os-token azertytoken --os-endpoint http://localhost:35357/v2.0 catalog
'NoneType' object has no attribute 'has_service_catalog'

[Igor Milovanović (igormilovanovic)]

In the particular deployment publicUrl and adminUrl are different, the adminURL is on internal network not reachable from client's box (the one issuing keystone tenant-list)...

[David J Hu (david-j-hu)]

A quick question to help me understand the tenant-list scenario. Is this client box also on the same internal network or the client box is actual on an external network? If the client box is on the external network, I assume that you want to keep your internal network private. In that case, you might want to consider accessing the adminURL from the internal network instead.

[Igor Milovanović (igormilovanovic)]

The client box is on external network. I was under impression that i don't have to expose adminUrl in order to run admin privileged calls/commands. Otherwise, i am wondering how would external client (app) invoke ( with admin privileges) admin calls?

I'm fairly new to keystone so I probably have skewed assumptions towards behavior, but distribution I have installed (Mirantis Fuel) came with this kind of setup...

[David J Hu (david-j-hu)]

- For catalog, from keystone client perspective, the service catalog is basically not present with only --os-token and --os-endpoint. Instead, use --os-username, --os-password, --os-tenant-name(or id) and --os-auth-url. Once authenticated, the user specified in os-username will have visibility to service catalog. I have a patch coming which will spew a friendlier error message when service is not present.

- For tenant-list, it sounds like networking configuration related. Do you have a route from your client box on the external network to the internal network? or on the server with keystone running, do you have 1 nic listening on the internal network and a different nic listening on the external networking?

[Dolph Mathews (dolph)]

There's no fix associated with this - was this supposed to be tracked against python-keystoneclient?