Nagios Service Checks Fail with Authentication Error (HTTP 401)

[Mark T. Voelker]

In a fresh COI Grizzly g.0 install, we see two Nagios service checks fail. The checks are "Keystone" and "Nova-Api" on the control node, and both fail with the message:

The request you have made requires authentication. (HTTP 401)

[Mark T. Voelker (mvoelker)]

Thanks to Roman Krapf for the report. I'll take a look at this shortly.

[Mark T. Voelker (mvoelker)]

Just from a quick glance, I think issue here might be have to do with the check_keystone Nagios plugin being a bit outdated...it's either not passing credentials properly or isn't playing well with PKI tokens (which are a new feature in Grizzly).

[Mark T. Voelker (mvoelker)]

The issue appears to be that the plugin is being called with the wrong tenant. It's being called as:

./check_keystone --auth_url http://2.6.1.2:5000/v2.0/ --username admin --password somepassword --tenant openstack volume identity compute image network ec2

But the openstack tenant doesn't exist (this is expected in Grizzly). It should probably be getting called as:

./check_keystone --auth_url http://2.6.1.2:5000/v2.0/ --username admin --password somepassword --tenant admin volume identity compute image network ec2

Which would work fine.

[Mark T. Voelker (mvoelker)]

Pull request with patch here:

https://github.com/CiscoSystems/puppet-naginator/pull/7