python-ceilometerclient does not works without v3 keystone endpoint

[Attila Fazekas]

since this change https://review.openstack.org/#/c/96323/, I cannot use the client in an evironemnet which does not defines keystone v3 endpoint. (After revert it works)

# ceilometer meter-list
Unable to determine the Keystone version to authenticate with using the given auth_url: http://172.16.40.13:35357/v2.0

keystone endpoint:
| 61d4e5634c704fc39f00adfbc0793603 | RegionOne | http://172.16.40.13:5000/v2.0 | http://172.16.40.13:5000/v2.0 | http://172.16.40.13:35357/v2.0 | 62022a10f9594b4aabdfb8a5cb87536f |

keystone service:
| 62022a10f9594b4aabdfb8a5cb87536f | keystone | identity | Keystone Identity Service |

[Fabio Giannetti (fabio-giannetti)]

I have done some tests and there is a problem with port 35357. Since the discovery is done by Keystone I poked at it using port 35357 and the discovery mechanism and I found a lot of issues reported in this bug:
https://bugs.launchpad.net/python-keystoneclient/+bug/1359412

When I test other clients in devstack I had the same issue with port 35357 (e.g. Glance and Cinder)

[Fabio Giannetti (fabio-giannetti)]

Using the latest clients: 0.10.2 (Keystone) and 1.0.11 (Ceilometer) the issue cannot be replicated for port 35357 and 5000.
If the auth_url is not correct, then Keystone should, using the discovery, mechanism return that the URL is not available but it crashes in doing so and this has been reported in bug:
https://bugs.launchpad.net/python-keystoneclient/+bug/1359412

[Ildiko Vancsa (ildiko-vancsa)]

Is this bug about the same issue as this one: https://bugs.launchpad.net/ceilometer/+bug/1350533?

[Fabio Giannetti (fabio-giannetti)]

Ildiko, could be. Have you tried with the latest versions: 0.10.2 (Keystone) and 1.0.11 (Ceilometer)?
Also you have to make sure that the URL is really correct because the discovery in Keystone is broken, i.e. in Devstack Keystone never run in locahost but has its own IP

[Ildiko Vancsa (ildiko-vancsa)]

Hi Fabio,

In my devstack the issue still exists with the ceilo client:

stack@trustyTest:~/devstack/devstack$ ceilometer --version
1.0.11
stack@trustyTest:~/devstack/devstack$ keystone --version
0.10.2
stack@trustyTest:~/devstack/devstack$ ceilometer meter-list
Unable to determine the Keystone version to authenticate with using the given auth_url: http://10.0.2.15:35357/v2.0

stack@trustyTest:~/devstack/devstack$ keystone endpoint-list
+----------------------------------+-----------+----------------------------------------+----------------------------------------+----------------------------------------+----------------------------------+
| id | region | publicurl | internalurl | adminurl | service_id |
+----------------------------------+-----------+----------------------------------------+----------------------------------------+----------------------------------------+----------------------------------+
| 12f594b55c374233aa6acb4184dbf746 | RegionOne | http://10.0.2.15:5000/v2.0 | http://10.0.2.15:5000/v2.0 | http://10.0.2.15:35357/v2.0 | e981b8cad6ee44e2b4bcc3e588cf6530 |

stack@trustyTest:~/devstack/devstack$ nova list
+----+------+--------+------------+-------------+----------+
| ID | Name | Status | Task State | Power State | Networks |
+----+------+--------+------------+-------------+----------+
+----+------+--------+------------+-------------+----------+
stack@trustyTest:~/devstack/devstack$ glance image-list
+--------------------------------------+---------------------------------+-------------+------------------+-----------+--------+
| ID | Name | Disk Format | Container Format | Size | Status |
+--------------------------------------+---------------------------------+-------------+------------------+-----------+--------+
| 398c90ca-36f2-48aa-87cb-038b0a9989cd | cirros-0.3.2-x86_64-uec | ami | ami | 25165824 | active |
| 0e56235f-755f-4057-b8aa-57d17b2a437d | cirros-0.3.2-x86_64-uec-kernel | aki | aki | 4969360 | active |
| 9d2d14ff-15c3-43fd-9700-3a156fd0aa8a | cirros-0.3.2-x86_64-uec-ramdisk | ari | ari | 3723817 | active |
| 323b19ab-ef74-4e6b-afc3-6575ad5f5ed1 | Fedora-x86_64-20-20140618-sda | qcow2 | bare | 209649664 | active |
+--------------------------------------+---------------------------------+-------------+------------------+-----------+--------+

[Fabio Giannetti (fabio-giannetti)]

Ok, did some more digging and I think I found the root cause.
In Devstack the port 35357 is only enabled for V3 and NOT for V2.
If you do this command on the discovery:
curl -H 'Accept: application/json' http://10.0.2.15:5000/ | python -mjson.tool
This will generate:
  % Total % Received % Xferd Average Speed Time Time Time Current
                                 Dload Upload Total Spent Left Speed
100 753 100 753 0 0 32958 0 --:--:-- --:--:-- --:--:-- 34227
{
    "versions": {
        "values": [
            {
                "id": "v3.0",
                "links": [
                    {
                        "href": "http://10.0.2.15:5000/v3/",
                        "rel": "self"
                    }
                ],
                "media-types": [
                    {
                        "base": "application/json",
                        "type": "application/vnd.openstack.identity-v3+json"
                    },
                    {
                        "base": "application/xml",
                        "type": "application/vnd.openstack.identity-v3+xml"
                    }
                ],
                "status": "stable",
                "updated": "2013-03-06T00:00:00Z"
            },
            {
                "id": "v2.0",
                "links": [
                    {
                        "href": "http://10.0.2.15:5000/v2.0/",
                        "rel": "self"
                    },
                    {
                        "href": "http://docs.openstack.org/",
                        "rel": "describedby",
                        "type": "text/html"
                    }
                ],
                "media-types": [
                    {
                        "base": "application/json",
                        "type": "application/vnd.openstack.identity-v2.0+json"
                    },
                    {
                        "base": "application/xml",
                        "type": "application/vnd.openstack.identity-v2.0+xml"
                    }
                ],
                "status": "stable",
                "updated": "2014-04-17T00:00:00Z"
            }
        ]
    }
}

That shows that both V2 and V3 are advertised, but if you run:
curl -H 'Accept: application/json' http://10.0.2.15:35357/ | python -mjson.tool

The answer is:
  % Total % Received % Xferd Average Speed Time Time Time Current
                                 Dload Upload Total Spent Left Speed
100 346 100 346 0 0 15963 0 --:--:-- --:--:-- --:--:-- 16476
{
    "versions": {
        "values": [
            {
                "id": "v3.0",
                "links": [
                    {
                        "href": "http://10.0.2.15:35357/v3/",
                        "rel": "self"
                    }
                ],
                "media-types": [
                    {
                        "base": "application/json",
                        "type": "application/vnd.openstack.identity-v3+json"
                    },
                    {
                        "base": "application/xml",
                      ...

[Fabio Giannetti (fabio-giannetti)]

Port 35357 is used for admin and token validation and it does only support V3.
Port 5000 is internal and public and it supports both V2 and V3. It is considered legacy and it will be remove when all openstack will move to Keystone V3

[Chris Dent (cdent)]

If Keystone is hosted by apache (the norm these days?) it won't register v2.0 on that port, but this ought to fix it: https://review.openstack.org/#/c/118757/2

[Fabio Giannetti (fabio-giannetti)]

Patch https://review.openstack.org/#/c/118757/2 has been merged. So the new client should now allow calls to :35357/v2.0

[Chris Dent (cdent)]

Can we declare this closed, inactive, something so that it is not showing up as an active bug anymore? With the keystone fix, it should no longer be a problem?

[Chris Dent (cdent)]

It's been two years since any activity so killing this.