[openstack-dev] [puppet] is puppet-keystone using v3 credentials correctly ?

Alex Schultz aschultz at mirantis.com
Tue Feb 23 15:29:53 UTC 2016


On Tue, Feb 23, 2016 at 1:48 AM, Ptacek, MichalX <michalx.ptacek at intel.com>
wrote:

> Hello again,
>
>
>
> In last days I realized that rpm/deb packages from supported platforms are
> too old (OSC, python-PROJECTclient,….)
>
> so I suppose that I should install newer versions not via deb/rpm packages
> but as pip packages.
>
> This kind of dependency on system packages when trying to install v7
> openstack puppet modules is probably natural for more experienced puppet
> guys,
>
> but I think it should be covered somewhere in doc.
>
>
>

So for our testing we're using the RDO or UCA package sets for the
releases.  Unfortunately you need to have a matching set of packages and
puppet modules for everything to work. What you're running into is trying
to use distro provide packages (probably for kilo or older) with manifests
that were written for something much newer like Liberty or Mitaka.  We do
have a module[0] that can help pull in these newer repos when you're
setting up your system.  You shouldn't pip install anything but rather
leverage the matching package set for the version of OpenStack you are
trying to deploy.




> I suppose I should install openstack clients as pip packages instead …
>
> Like. pip install python-openstackclient==2.0.0, pip install
> python-keystoneclient, …
>
>
>
> by installing them in this way, manifest deployment finished smoothly, but
> I realized that “missing rpm/deb packages” are also installed (even when
> pip version is present),
>
> which might lead to some inconsistency …
>
>
>
> like currently I am fighting with some issue on glance:
>
> ERROR glance.common.config [-] Unable to load glance-api-keystone from
> configuration  file /etc/glance/glance-api-paste.ini.
>
> Got: ImportError(‘No module named middleware.auth_token’),
>
> (I think it’s asking for this file
>
> /usr/lib/python2.7/dist-packages/keystoneclient/middleware
>
> Which is present on the system)
>
>
>
> so my small and general question would be …
>
> What is the procedure if one would like to work with liberty openstack on
> old/supported platform  ?
>
> (currently I am using Ubuntu 14.04 LTS)
>
>
>

For this configuration you'd want ot use the Liberty UCA package set[1]
with 14.04 and it should work.

Thanks,
-Alex

[0] http://git.openstack.org/cgit/openstack/puppet-openstack_extras
[1] https://wiki.ubuntu.com/ServerTeam/CloudArchive



Thanks,
>
> Michal
>
>
>
>
>
> *From:* Ptacek, MichalX [mailto:michalx.ptacek at intel.com]
> *Sent:* Monday, February 22, 2016 9:50 AM
>
> *To:* OpenStack Development Mailing List (not for usage questions) <
> openstack-dev at lists.openstack.org>
> *Subject:* Re: [openstack-dev] [puppet] is puppet-keystone using v3
> credentials correctly ?
>
>
>
> Hi Matt,
>
>
>
> thanks for good hint !
>
> Issue disappeared with newer python-openstackclient-1.0.3-3.fc23.noarch
>
> python-openstackclient-1.0.1-1.fc22.noarch is too old,
>
>
>
> it’s interesting, as supported platforms for puppet-openstack is
> fedora21,22 and I get it running just with fc23 J
>
>
>
> best regards,
>
> Michal
>
>
>
> *From:* Matt Fischer [mailto:matt at mattfischer.com <matt at mattfischer.com>]
> *Sent:* Friday, February 19, 2016 4:27 PM
> *To:* OpenStack Development Mailing List (not for usage questions) <
> openstack-dev at lists.openstack.org>
> *Subject:* Re: [openstack-dev] [puppet] is puppet-keystone using v3
> credentials correctly ?
>
>
>
> You shouldn't have to do any of that, it should just work. I have OSC
> 2.0.0 in my environment though (Ubuntu). I'm just guessing but perhaps that
> client is too old? Maybe a Fedora user could recommend a version.
>
>
>
> On Fri, Feb 19, 2016 at 7:38 AM, Matthew Mosesohn <mmosesohn at mirantis.com>
> wrote:
>
> Hi Michal,
>
> Just add --os-identity-api-version=3 to your command it will work. The
> provider uses v3 openstackclient via env var
> OS_IDENTITY_API_VERSION=3. The default is still 2.
>
> Best Regards,
> Matthew Mosesohn
>
>
> On Fri, Feb 19, 2016 at 5:25 PM, Matt Fischer <matt at mattfischer.com>
> wrote:
> > What version of openstack client do you have? What version of the module
> are
> > you using?
> >
> > On Feb 19, 2016 7:20 AM, "Ptacek, MichalX" <michalx.ptacek at intel.com>
> wrote:
> >>
> >> Hi all,
> >>
> >>
> >>
> >> I was playing some time with puppet-keystone deployments,
> >>
> >> and also reported one issue related to this:
> >>
> >> https://bugs.launchpad.net/puppet-keystone/+bug/1547394
> >>
> >> but in general my observations are that keystone_service is using v3
> >> credentials with openstack cli commands that are not compatible
> >>
> >>
> >>
> >> e.g.
> >>
> >> Error: Failed to apply catalog: Execution of '/bin/openstack service
> list
> >> --quiet --format csv --long' returned 2: usage: openstack service list
> [-h]
> >> [-f {csv,table}] [-c COLUMN]
> >>                               [--max-width <integer>]
> >>                               [--quote {all,minimal,none,nonnumeric}]
> >> openstack service list: error: unrecognized arguments: --long
> >>
> >>
> >>
> >>
> >>
> >> It can’t be bug, because whole module will not work due to this J
> >>
> >> I think I miss something important somewhere …
> >>
> >>
> >>
> >> My latest manifest file is :
> >>
> >>
> >>
> >> Exec { logoutput => 'on_failure' }
> >>
> >> package { 'curl': ensure => present }
> >>
> >>
> >>
> >> node keystone {
> >>
> >>
> >>
> >>   class { '::mysql::server': }
> >>
> >>   class { '::keystone::db::mysql':
> >>
> >>     password => 'keystone',
> >>
> >>   }
> >>
> >>
> >>
> >>   class { '::keystone':
> >>
> >>     verbose             => true,
> >>
> >>     debug               => true,
> >>
> >>     database_connection => 'mysql://
> keystone:keystone at 127.0.0.1/keystone',
> >>
> >>     catalog_type        => 'sql',
> >>
> >>     admin_token         => 'admin_token',
> >>
> >>   }
> >>
> >>
> >>
> >>   class { '::keystone::roles::admin':
> >>
> >>     email    => 'example at abc.com',
> >>
> >>     password => 'ChangeMe',
> >>
> >>   }
> >>
> >>
> >>
> >>   class { '::keystone::endpoint':
> >>
> >>     public_url => "http://${::fqdn}:5000/v2.0",
> >>
> >>     admin_url  => "http://${::fqdn}:35357/v2.0",
> >>
> >>   }
> >>
> >> }
> >>
> >>
> >>
> >> Env variables looks as follows(before service list is called with
> --long)
> >>
> >> {"OS_IDENTITY_API_VERSION"=>"3", "OS_TOKEN"=>"admin_token",
> >> "OS_URL"=>"http://127.0.0.1:35357/v3"}
> >>
> >> Debug: Executing: '/bin/openstack service list --quiet --format csv
> >> --long'
> >>
> >>
> >>
> >> Thanks for any hint,
> >>
> >> Michal
> >>
> >> --------------------------------------------------------------
> >> Intel Research and Development Ireland Limited
> >> Registered in Ireland
> >> Registered Office: Collinstown Industrial Park, Leixlip, County Kildare
> >> Registered Number: 308263
> >>
> >> This e-mail and any attachments may contain confidential material for
> the
> >> sole use of the intended recipient(s). Any review or distribution by
> others
> >> is strictly prohibited. If you are not the intended recipient, please
> >> contact the sender and delete all copies.
> >>
> >>
> >>
> __________________________________________________________________________
> >> OpenStack Development Mailing List (not for usage questions)
> >> Unsubscribe:
> OpenStack-dev-request at lists.openstack.org?subject:unsubscribe
> >> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
> >>
> >
> >
> __________________________________________________________________________
> > OpenStack Development Mailing List (not for usage questions)
> > Unsubscribe:
> OpenStack-dev-request at lists.openstack.org?subject:unsubscribe
> > http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
> >
>
> __________________________________________________________________________
> OpenStack Development Mailing List (not for usage questions)
> Unsubscribe: OpenStack-dev-request at lists.openstack.org?subject:unsubscribe
> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
>
>
>
> --------------------------------------------------------------
> Intel Research and Development Ireland Limited
> Registered in Ireland
> Registered Office: Collinstown Industrial Park, Leixlip, County Kildare
> Registered Number: 308263
>
> This e-mail and any attachments may contain confidential material for the
> sole use of the intended recipient(s). Any review or distribution by others
> is strictly prohibited. If you are not the intended recipient, please
> contact the sender and delete all copies.
>
> --------------------------------------------------------------
> Intel Research and Development Ireland Limited
> Registered in Ireland
> Registered Office: Collinstown Industrial Park, Leixlip, County Kildare
> Registered Number: 308263
>
> This e-mail and any attachments may contain confidential material for the
> sole use of the intended recipient(s). Any review or distribution by others
> is strictly prohibited. If you are not the intended recipient, please
> contact the sender and delete all copies.
>
>
> __________________________________________________________________________
> OpenStack Development Mailing List (not for usage questions)
> Unsubscribe: OpenStack-dev-request at lists.openstack.org?subject:unsubscribe
> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20160223/d0d05a7b/attachment.html>


More information about the OpenStack-dev mailing list