cannot get tempest to use public interface

[Marian Gasparovic]

keystone endpoints
admin: http://10.152.183.227:5000
public: http://10.246.167.235:80/openstack-keystone
internal: http://10.246.167.235:80/openstack-keystone

I have options in config

[identity]
region =
auth_version = v3
uri = http://10.246.167.235:80/openstack-keystone/v2.0
uri_v3 = http://10.246.167.235:80/openstack-keystone/v3/
disable_ssl_certificate_validation = False
ca_certificates_file =
v3_endpoint_type = publicURL

(I tried also v3_endpoint_type = public)

But when I run tempest it tries to use admin interface

WARNING urllib3.connectionpool [-] Retrying (Retry(total=9, connect=None, read=None, redirect=5, status=None)) after connection broken by 'ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7fe094cd3580>, 'Connection to 10.152.183.227 timed out. (connect timeout=60)')': /v3/projects?name=demo

I use --fromenv and these env vars are defined

export OS_AUTH_URL=http://10.246.167.235:80/openstack-keystone
export OS_USERNAME=demo
export OS_PASSWORD=7PJBWqtkMwreVyIBV1jDkrkKsxgTsw
export OS_USER_DOMAIN_NAME=users
export OS_PROJECT_DOMAIN_NAME=users
export OS_PROJECT_NAME=demo
export OS_AUTH_VERSION=3
export OS_IDENTITY_API_VERSION=3

It is the same for admin and nonadmin user.

Do I miss something or is it a bug?
Tempest is from 34.2.0 and OpenStack is Antelope.

[Lukas Piwowarski (lukas-piwowarski)]

Hi Marian,

I'm not 100 % sure about this but I think I know what might be wrong here. The issue is probably the empty value for identity.region option. When you do not specify the region tempest then picks the first endpoint it finds for a given service [1]. If it happens that the first endpoint is an admin endpoint then the admin endpoint is used instead of the public/internal one. So maybe you can try specifying the region value. Or is there a specific reason why you did not set the region value?

[1] https://opendev.org/openstack/tempest/src/commit/fbd3dbc638ede072b7947c7a005404f389da2901/tempest/lib/auth.py#L586

[Marian Gasparovic (marosg)]

Hi Lukas,
I will certainly try that, thank you.

[Marian Gasparovic (marosg)]

@lukas-piwowarski

You were right, providing region solved it.
Thank you