<div dir="ltr">Daniel<div><br></div><div>Yes, if you want to do some administrative stuff you need to have access to management network to be able to work with internal and admin endpoints.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jul 10, 2015 at 9:58 AM, Daniel Comnea <span dir="ltr"><<a href="mailto:comnea.dani@gmail.com" target="_blank">comnea.dani@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div>I know about the flow but what i'm questioning is:<br><br></div>admin endpoint is mapped to br-mgmt subnet (you do have the HAproxy as below defined in 6.1. In 6.0 and before you had no HAproxy)<br><br>listen keystone-2<br> bind <a href="http://192.168.20.3:35357" target="_blank">192.168.20.3:35357</a><br> option httpchk<br> option httplog<br> option httpclose<br> server node-17 <a href="http://192.168.20.20:35357" target="_blank">192.168.20.20:35357</a> check inter 10s fastinter 2s downinter 3s rise 3 fall 3<br> server node-18 <a href="http://192.168.20.21:35357" target="_blank">192.168.20.21:35357</a> check inter 10s fastinter 2s downinter 3s rise 3 fall 3<br> server node-23 <a href="http://192.168.20.26:35357" target="_blank">192.168.20.26:35357</a> check inter 10s fastinter 2s downinter 3s rise 3 fall 3<br><br></div>public endpoint is mapped to br-ex <br><br></div>So with this behavior you are saying the bt-mgmt subnet (which i thought is only for controller <> compute traffic, isolated network) should be routable in the same way br-ex is?<br><br></div>Dani<div><div class="h5"><br><div><div><div><div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jul 9, 2015 at 11:30 PM, Stanislaw Bogatkin <span dir="ltr"><<a href="mailto:sbogatkin@mirantis.com" target="_blank">sbogatkin@mirantis.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi Daniel,<div><br></div><div>answer is no - actually there is no strong dependency between public and internal/admin endpoints. In your case keystone client ask keystone on address <span style="font-size:12.8px">10.52.71.39 (which, I think, was provided by system variable OS_AUTH_URL), auth on it and then keystone give endpoints list to client. Client selected admin endpoint from this list (192.168.20.3 address) and tried to get information you asked. It's a normal behavior.</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">So, in Fuel by default we have 3 different endpoints for keystone - public on public VIP, port 5000; internal on management VIP, port 5000, admin on management VIP, port 35357.</span></div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div>On Thu, Jul 9, 2015 at 4:59 PM, Daniel Comnea <span dir="ltr"><<a href="mailto:comnea.dani@gmail.com" target="_blank">comnea.dani@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div><div dir="ltr"><div><div><div>Hi,<br><br></div>I'm running Fuel 6.1 and <span>i've</span> seen an interesting behavior which i think match bug [1]<br><br></div>Basically the <span>adminUrl</span> & <span>publicUrl</span> part of keystone endpoint are different<br><br></div>And the result of that is that you can't run keystone <span>cli</span> - i.e create/list tenants etc<br><br>keystone --debug tenant-list<br>/<span>usr</span>/local/lib/python2.7/site-packages/<span>keystoneclient</span>/shell.<span>py</span>:65: <span>DeprecationWarning</span>: The keystone <span>CLI</span> is deprecated in favor of python-<span>openstackclient</span>. For a Python library, continue using python-keys<br><span>toneclient</span>.<br> 'python-<span>keystoneclient</span>.', <span>DeprecationWarning</span>)<br>DEBUG:<span>keystoneclient</span>.<span>auth</span>.identity.v2:Making authentication request to <a href="http://10.20.71.39:5000/v2.0/tokens" target="_blank">http://10.20.71.39:5000/v2.0/tokens</a><br>INFO:requests.packages.urllib3.<span>connectionpool</span>:Starting new HTTP connection (1): 10.52.71.39<br>DEBUG:requests.packages.urllib3.<span>connectionpool</span>:"POST /v2.0/tokens HTTP/1.1" 200 3709<br>DEBUG:<span>keystoneclient</span>.session:<span>REQ</span>: curl -g -i -X GET <a href="http://192.168.20.3:35357/v2.0/tenants" target="_blank">http://192.168.20.3:35357/v2.0/tenants</a> -H "User-Agent: python-<span>keystoneclient</span>" -H "Accept: application/<span>json</span>" -H "X-<span>Auth</span>-Token: {SHA1}cc918b89c2dca563edda43e01964b1f1979c552b"<br><br><div>shouldn't <span>adminURL</span> = <span>publicURL</span> = <span>br</span>-ex for keystone?<br></div><div><br><br></div><div>Dani<br></div><br><br>[1] <a href="https://bugs.launchpad.net/fuel/+bug/1441855" target="_blank">https://bugs.launchpad.net/fuel/+bug/1441855</a></div>
<br></div></div>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div>
<br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div></div></div></div></div></div></div></div></div></div>
<br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr">Yours Faithfully,<br>Vladimir Kuklin,<br>Fuel Library Tech Lead,<br>Mirantis, Inc.<br>+7 (495) 640-49-04<br>+7 (926) 702-39-68<br>Skype kuklinvv<br>35bk3, Vorontsovskaya Str.<br>Moscow, Russia,<br><a href="http://www.mirantis.ru/" target="_blank">www.mirantis.com</a><br><a href="http://www.mirantis.ru/" target="_blank">www.mirantis.ru</a><br><a href="mailto:vkuklin@mirantis.com" target="_blank">vkuklin@mirantis.com</a></div></div></div></div>
</div>