[keystone_authtoken] auth_url = http://controller:35357 port error, it should be 5000

[Yufei]

[api]
# ...
auth_strategy = keystone

[keystone_authtoken]
# ...
auth_uri = http://controller:5000
auth_url = http://controller:35357
memcached_servers = controller:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = nova
password = NOVA_PASS

above configuration has the port error, should replace 35357 to 5000

Thanks
Yufei

This bug tracker is for errors with the documentation, use the following as a template and remove or add fields as you see fit. Convert [ ] into [x] to check boxes:

- [ ] This doc is inaccurate in this way: ______
- [ ] This is a doc addition request.
- [ ] I have a fix to the document that I can paste below including example: input and output.

If you have a troubleshooting or support issue, use the following resources:

 - Ask OpenStack: http://ask.openstack.org
 - The mailing list: http://lists.openstack.org
 - IRC: 'openstack' channel on Freenode

-----------------------------------
Release: 17.0.3.dev13 on 2018-04-17 17:03
SHA: 991c2926cbcb16dab9cf0ef059b0393b6c895490
Source: https://git.openstack.org/cgit/openstack/nova/tree/doc/source/install/controller-install-ubuntu.rst
URL: https://docs.openstack.org/nova/queens/install/controller-install-ubuntu.html

[Matt Riedemann (mriedem)]

(2:19:57 PM) mriedem: lbragstad: is this right? https://bugs.launchpad.net/nova/+bug/1765144
(2:19:59 PM) openstack: Launchpad bug 1765144 in OpenStack Compute (nova) "[keystone_authtoken] auth_url = http://controller:35357 port error, it should be 5000" [Undecided,New]
(2:20:40 PM) lbragstad: mriedem: yes and no
(2:20:55 PM) lbragstad: technically we removed the legacy v2.0 app in queens, so we no longer require two ports
(2:21:05 PM) lbragstad: but it certainly don't have to be port 5000, or 35357
(2:21:23 PM) mriedem: yeah looking in http://logs.openstack.org/20/554920/12/check/tempest-full/df42a0d/controller/logs/etc/nova/nova_conf.txt.gz
(2:21:27 PM) mriedem: we don't specify a port at all
(2:21:50 PM) lbragstad: oh - sure v
(2:21:52 PM) lbragstad: https://github.com/openstack/releases/blob/master/deliverables/queens/keystoneauth.yaml#L17
(2:22:00 PM) ***lbragstad fails copy/paste
(2:22:07 PM) lbragstad: auth_url = https://198.72.124.213/identity
(2:22:16 PM) mriedem: and auth_uri isn't specified at all
(2:22:44 PM) mriedem: was auth_uri keystone v1/v2 only?
(2:23:38 PM) lbragstad: you should use auth_url
(2:23:52 PM) lbragstad: auth_url and auth_uri was causing a lot of confusion
(2:23:57 PM) lbragstad: so we renamed it https://github.com/openstack/keystonemiddleware/commit/409b482253dec248ed828e92e52b09d4c02e51dd
(2:24:32 PM) lbragstad: it was ultimately a side-effect of integrating keystoneauth into keystonemiddleware
(2:27:01 PM) mriedem: ok so the note at step 5 here https://docs.openstack.org/keystone/latest/install/keystone-install-ubuntu.html#install-and-configure-components
(2:27:09 PM) mriedem: "Before the Queens release, keystone needed to be run on two separate ports to accommodate the Identity v2 API which ran a separate admin-only service commonly on port 35357. With the removal of the v2 API, keystone can be run on the same port for all interfaces."
(2:28:28 PM) openstackgerrit: Merged openstack/nova stable/ocata: Clean up volumes on boot failure https://review.openstack.org/545086
(2:28:42 PM) mriedem: lbragstad: and i'm assuming that keystone-manage bootstrap creates the identity service endpoint in the catalog?
(2:28:51 PM) lbragstad: it does
(2:29:01 PM) mriedem: so if hte docs say "--bootstrap-public-url http://controller:5000/v3/"
(2:29:11 PM) mriedem: then that's probably what the nova docs should use
(2:29:24 PM) mriedem: or internal url i guess, but they are the same in the docs
(2:30:16 PM) mriedem: ok i'll push a change to fix the nova install guide docs to remove auth_uri and change auth_url to use port 5000
(2:30:20 PM) mriedem: thanks

[Lance Bragstad (lbragstad)]

Some additional context. These bugs have been popping up because keystone removed the v2.0 API in Queens, which required two separate applications to be run side-by-side. The purpose of this was so administrators would talk to one application and end users would talk to the other. This ultimately pushed all the RBAC and policy problems onto operators, making "secure deployments" a system architecture problem.

The v3 API was designed mitigate this, and as a result, all the RBAC functionality was collapsed into a single application with a policy engine (oslo.policy), just like any other OpenStack service. As a result, the removal of the v2.0 API means a single application should be able to serve all users.

For reference, we updated keystone's installation guide to reference port 5000 exclusively [0]. If we don't want to use port 5000 I'm ok changing it to something else (443 or 80 perhaps), but other projects have started updating their keystonemiddleware configuration to point to 5000 for the sake a consistent installation guide.

[0] https://docs.openstack.org/keystone/latest/install/keystone-install-ubuntu.html#finalize-the-installation

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/562812

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/562812
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=698630e1a432aa1f292fabe8d738a2f5867f73fe
Submitter: Zuul
Branch: master

commit 698630e1a432aa1f292fabe8d738a2f5867f73fe
Author: Matt Riedemann <email address hidden>
Date: Thu Apr 19 15:43:35 2018 -0400

    Update docs for [keystone_authtoken] changes since Queens

    The auth_uri option was deprecated and renamed in Queens:

      I0cf11da3d395749df28077427689fdafc8a6b981

    The auth_uri option is also no longer necessary, at least
    for the purpose of the nova install guide, since all identity
    service requests can be served through the single auth_url.

    This change removes auth_uri usage and also updates the
    auth_url value to match what is in the keystone install
    guide:

    https://docs.openstack.org/keystone/queens/install/keystone-install-ubuntu.html

    Change-Id: Iff332890cbe1ba5b3876874e351b09c377d8dd5d
    Closes-Bug: #1765144

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/queens
Review: https://review.openstack.org/564336

[Realtime (peter-icb)]

As in the duplicates of this bug mentionend: The same error exists in the documentations of Cinder and Neutron!

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/564336
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=056000230a2b44908193e61de2d17d89434e7ea8
Submitter: Zuul
Branch: stable/queens

commit 056000230a2b44908193e61de2d17d89434e7ea8
Author: Matt Riedemann <email address hidden>
Date: Thu Apr 19 15:43:35 2018 -0400

    Update docs for [keystone_authtoken] changes since Queens

    The auth_uri option was deprecated and renamed in Queens:

      I0cf11da3d395749df28077427689fdafc8a6b981

    The auth_uri option is also no longer necessary, at least
    for the purpose of the nova install guide, since all identity
    service requests can be served through the single auth_url.

    This change removes auth_uri usage and also updates the
    auth_url value to match what is in the keystone install
    guide:

    https://docs.openstack.org/keystone/queens/install/keystone-install-ubuntu.html

    Change-Id: Iff332890cbe1ba5b3876874e351b09c377d8dd5d
    Closes-Bug: #1765144
    (cherry picked from commit 698630e1a432aa1f292fabe8d738a2f5867f73fe)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/nova 17.0.4 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/nova 18.0.0.0b2 development milestone.