Inconsistent api-paste.ini settings

[Ian Pilcher]

Step 6 of "Configure a Compute Node" says:

Copy the file /etc/nova/api-paste.ini from the controller node, or edit the file to add the credentials in the [filter:authtoken] section.

  [filter:authtoken]
  paste.filter_factory=keystoneclient.middleware.auth_token:filter_factory
  auth_host=controller
  auth_port = 35357
  auth_protocol = http
  admin_user=nova
  admin_tenant_name=service
  admin_password=NOVA_PASS

However, step 7 of "Install the Nova Controller Services" in the previous section gives these settings:

  [filter:authtoken]
  paste.filter_factory=keystoneclient.middleware.auth_token:filter_factory
  auth_host=controller
  auth_uri=http://controller:5000
  admin_tenant_name=service
  admin_user=nova
  admin_password=NOVA_PASS

It's pretty straightforward to see how auth_protocol, auth_host, and auth_port are combined into auth_uri, but the difference in ports is confusing at the very least.

-----------------------------------
Built: 2013-11-04T20:43:26 00:00
git SHA: 0a4075f47609a779c56e365598f22fc8b9497b75
URL: http://docs.openstack.org/havana/install-guide/install/yum/content/nova-compute.html
source File: file:/home/jenkins/workspace/openstack-install-deploy-guide-fedora/doc/install-guide/section_nova-compute.xml
xml:id: nova-compute

[Andreas Jaeger (jaegerandi)]

Note, there are two places where auth_uri is used with port 5000, we should double check both:

section_neutron-install.xml:auth_uri=http://<replaceable>controller</replaceable>:5000
section_nova-controller.xml:auth_uri=http://<replaceable>controller</replaceable>:5000

[Andreas Jaeger (jaegerandi)]

Also reported here: http://docs.openstack.org/havana/install-guide/install/zypper/content/nova-controller.html#comment-1115283686

[Matt Kassawara (ionosphere80)]

I'm trying different combinations of directives and ports in Nova api-paste.ini on my controller. Apparently auth_uri cannot replace auth_host/auth_protocol/auth_port. For example, disabling auth_host/auth_protocol/auth_port and enabling auth_uri with either http://controller:5000 or http://controller:35357 results in the following warnings/errors in nova-api.log when executing "nova image-list":

2013-11-11 17:36:12.502 7195 WARNING keystoneclient.middleware.auth_token [-] Retrying on HTTP connection exception: [Errno 1] _ssl.c:504: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
2013-11-11 17:36:13.005 7195 WARNING keystoneclient.middleware.auth_token [-] Retrying on HTTP connection exception: [Errno 1] _ssl.c:504: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
2013-11-11 17:36:14.008 7195 WARNING keystoneclient.middleware.auth_token [-] Retrying on HTTP connection exception: [Errno 1] _ssl.c:504: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
2013-11-11 17:36:16.012 7195 ERROR keystoneclient.middleware.auth_token [-] HTTP connection exception: [Errno 1] _ssl.c:504: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
2013-11-11 17:36:16.013 7195 WARNING keystoneclient.middleware.auth_token [-] Authorization failed for token [removed for brevity]
2013-11-11 17:36:16.014 7195 INFO keystoneclient.middleware.auth_token [-] Invalid user token - rejecting request
2013-11-11 17:36:16.023 7195 INFO nova.osapi_compute.wsgi.server [-] 172.24.247.52 "GET /v2/3b1bd021c8b842de946b3b9d9e7a3f20/images/detail HTTP/1.1" status: 401 len: 194 time: 3.5288041

Enabling auth_host/auth_protocol/auth_port, setting auth_port to 5000 or 35357, and disabling auth_uri results in the expected output when executing "nova image-list":

+--------------------------------------+---------------------+--------+--------+
| ID | Name | Status | Server |
+--------------------------------------+---------------------+--------+--------+
| 54cb10c9-c5d1-47fc-a1de-4f8d04efa6cf | cirros-0.3.1-x86_64 | ACTIVE | |
+--------------------------------------+---------------------+--------+--------+

However, the following warning appears in nova-api.log:

2013-11-11 17:45:53.316 7365 WARNING keystoneclient.middleware.auth_token [-] Configuring auth_uri to point to the public identity endpoint is required; clients may not be able to authenticate against an admin endpoint

Keeping auth_host/auth_protocol/auth_port enabled and enabling auth_uri with either http://controller:5000 or http://controller:35357 also results in the expected output when executing "nova image-list", but lacks the above warning in nova-api.log.

[Igor D.C. (igordcard)]

So, in the second configuration you presented, with the warning, does nova-api behave as expected afterwards? If so, the actual nova-api (and other services that share the same problem) should get a fix to prevent this warning from being thrown out. In other words, all main OpenStack projects should clarify this configuration aspect and opt for one way or the other (or maybe both, but not simultaneously, and without errors or warnings). Is there already any bug report on this?

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/63308

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/havana
Review: https://review.openstack.org/63357

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/63308
Committed: https://git.openstack.org/cgit/openstack/openstack-manuals/commit/?id=56ef4d3085f6be34c0e1bb0a2b62f18bcc9f562f
Submitter: Jenkins
Branch: master

commit 56ef4d3085f6be34c0e1bb0a2b62f18bcc9f562f
Author: Matt Kassawara <email address hidden>
Date: Thu Dec 19 21:29:16 2013 -0700

    Clarified directives in Nova api-paste.ini

    Clarified directives in Nova api-paste.ini for controller and compute
    nodes based on a working configuration. Also cleaned up some
    formatting issues.

    Change-Id: I60408caff40934de85502b845627ddb2ebe83a27
    Closes-Bug: #1248001

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/63357
Committed: https://git.openstack.org/cgit/openstack/openstack-manuals/commit/?id=6852113145e485452dffb0338b9d2337b97deb15
Submitter: Jenkins
Branch: stable/havana

commit 6852113145e485452dffb0338b9d2337b97deb15
Author: Matt Kassawara <email address hidden>
Date: Thu Dec 19 21:29:16 2013 -0700

    Clarified directives in Nova api-paste.ini

    Clarified directives in Nova api-paste.ini for controller and compute
    nodes based on a working configuration. Also cleaned up some
    formatting issues.

    Change-Id: I60408caff40934de85502b845627ddb2ebe83a27
    Closes-Bug: #1248001
    (cherry picked from commit 56ef4d3085f6be34c0e1bb0a2b62f18bcc9f562f)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-manuals 15.0.0 release.