keystone v2.0 doesn't work when v3 in the catalog endpoint

[Sam Morrison]

We recently changed the identity endpoint that is advertised in our catalog from

https://keystone:5000/v2.0/

to

https://keystone:5000/v3/

Users using all the clients (nova/cinder etc.) all still work using a v2.0 or a v3 OS_AUTH_URL config option.

The issue is the keystone client library no longer works, we get the error at the bottom of the page.

We are following the docs at https://docs.openstack.org/python-keystoneclient/latest/using-api-v2.html#authenticating to instantiate a client however it doesn't work.

We are using the latest version available from pip:

keystoneauth1==3.1.0
python-keystoneclient==3.13.0

  File "/opt/tempest/local/lib/python2.7/site-packages/keystoneclient/v2_0/roles.py", line 50, in list
    return self._list("/OS-KSADM/roles", "roles")
  File "/opt/tempest/local/lib/python2.7/site-packages/keystoneclient/base.py", line 125, in _list
    resp, body = self.client.get(url, **kwargs)
  File "/opt/tempest/local/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 216, in get
    return self.request(url, 'GET', **kwargs)
  File "/opt/tempest/local/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 373, in request
    resp = super(LegacyJsonAdapter, self).request(*args, **kwargs)
  File "/opt/tempest/local/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 141, in request
    return self.session.request(url, method, **kwargs)
  File "/opt/tempest/local/lib/python2.7/site-packages/positional/__init__.py", line 101, in inner
    return wrapped(*args, **kwargs)
  File "/opt/tempest/local/lib/python2.7/site-packages/keystoneauth1/session.py", line 492, in request
    raise exceptions.EndpointNotFound()

[Lance Bragstad (lbragstad)]

This could be related to keystoneauth version discovery. Adding a developer who is more familiar with that flow.

[Lance Bragstad (lbragstad)]

This exception is also coming from keystoneauth, not python-keystoneclient (python-keystoneclient invokes keystonauth). Updating the affected projects accordingly.

[Eric Fried (efried)]

This may be a dup of [1], which was fixed in ksa 3.2.0 via [2]

[1] https://bugs.launchpad.net/keystoneauth/+bug/1709658
[2] https://review.openstack.org/#/c/492484/

You can confirm by removing the trailing slash from your catalog entry; or just upgrade to 3.2.0 and see if the problem disappears.

[Lance Bragstad (lbragstad)]

I ran this issue by a couple people who are more familiar with keystoneauth [0].

There was an issue with keystoneauth 3.1.0 with version discovery. The suggestions is to either upgrade to 3.2.0 or try removing the trailing slash from the endpoint. More context from that specific issue can be found in https://review.openstack.org/#/c/492484/ .

[0] http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-keystone.2017-10-03.log.html#t2017-10-03T20:42:20

[Launchpad Janitor (janitor)]

[Expired for keystoneauth because there has been no activity for 60 days.]