That should have read...<div><br></div><div><span class="Apple-style-span" style> ... Also - Can you run "SELECT * from `endpoint_templates`;" against the keystone DB ...</span><br clear="all"><br>Thanks,<br>Kiall<br>
<br><br><div class="gmail_quote">On Fri, Feb 3, 2012 at 12:15 AM, Kiall Mac Innes <span dir="ltr"><<a href="mailto:kiall@managedit.ie">kiall@managedit.ie</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Lille,<div><br></div><div>My packages (the Managed I.T ones) certainly do work, the config files shipped with them are fairly stock config files from the git stable/diablo branch, these generally are not setup for use with keystone of of the box.</div>
<div><br></div><div>I've got a bunch of scripts and sample config files on our GitHub account[1], Maybe you can compare your config files to these?</div><div><br></div><div>If that doesn't work, can you place your config's (all of them!) up on <a href="http://paste.openstack.org" target="_blank">http://paste.openstack.org</a> and send us the links? Also - Can you run "SELECT * from `endpoint_templates`;" against </div>
<div><br></div><div>Here is:</div><div><br></div><div>A sample of what I get back from keystone: <a href="http://paste.openstack.org/show/4665/" target="_blank">http://paste.openstack.org/show/4665/</a></div><div>A sample of the glance index output <a href="http://paste.openstack.org/show/4666/" target="_blank">http://paste.openstack.org/show/4666/</a></div>
<div>A sample result for the SQL query <a href="http://paste.openstack.org/show/4667/" target="_blank">http://paste.openstack.org/show/4667/</a> (Note: I have a webserver on port 80 that proxies traffic to the correct service i.e. your ports will likely be different, but the path (the part AFTER the port) should match)</div>
<div><br>Thanks,<br>Kiall</div><div><br></div><div>[1] <a href="https://github.com/managedit/openstack-setup" target="_blank">https://github.com/managedit/openstack-setup</a><div><div class="h5"><br>
<br><br><div class="gmail_quote">On Thu, Feb 2, 2012 at 10:12 PM, Lillie Ross-CDSR11 <span dir="ltr"><<a href="mailto:Ross.Lillie@motorolasolutions.com" target="_blank">Ross.Lillie@motorolasolutions.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Still having issues.<br>
<br>
I found a config bug in my Keystone.conf file in the filter pipeline for the d5_compat modules. However, when I fix the config to match the installation guide and restart keystone, I get an error message that the d5_compat module can't be found. My keystone installation is from the ManagedIT PPA. Is this a bug in the documentation? In the ManagedIT packages? The pipeline for the ManageIT package is configured as follows:<br>
<br>
[pipeline:admin]<br>
pipeline =<br>
urlrewritefilter<br>
admin_api<br>
<br>
[pipeline:keystone-legacy-auth]<br>
pipeline =<br>
urlrewritefilter<br>
legacy_auth<br>
RAX-KEY-extension<br>
service_api<br>
<br>
versus what is specified in the installation guide. Does this difference matter? What are the differences?<br>
<br>
Regards,<br>
Ross<br>
<br>
<br>
On Feb 1, 2012, at 10:31 AM, Lillie Ross-CDSR11 wrote:<br>
<br>
> Hi Jay,<br>
><br>
> Yes, this confused me, however I get the same error using the token I generated and added (via the keystone-manage command). To wit:<br>
><br>
> root@nova:~# keystone-manage token list<br>
> token user expiration tenant<br>
> -------------------------------------------------------------------------------<br>
> 10111213141516171819 1 <a href="tel:2022-01-01%2000" value="+12022010100" target="_blank">2022-01-01 00</a>:00:00 2<br>
> fa89fb9a-60d2-4921-b12d-6aee1c177823 1 <a href="tel:2012-02-01%2015" value="+12012020115" target="_blank">2012-02-01 15</a>:24:33 1<br>
> b06c5e4e-5e59-4293-aa54-ce6879f11371 2 <a href="tel:2012-02-01%2015" value="+12012020115" target="_blank">2012-02-01 15</a>:26:41 1<br>
><br>
> where the first token is the long-lived one I supplied during installation. Running the glance command yields identical results:<br>
><br>
> root@nova:~# glance -v -A 10111213141516171819 details<br>
> Failed to show details. Got error:<br>
> Internal Server error: Traceback (most recent call last):<br>
> File "/usr/lib/python2.7/dist-packages/eventlet/wsgi.py", line 336, in handle_one_response<br>
> result = self.application(self.environ, start_response)<br>
> File "/usr/lib/python2.7/dist-packages/webob/dec.py", line 147, in __call__<br>
> resp = self.call_func(req, *args, **self.kwargs)<br>
> File "/usr/lib/python2.7/dist-packages/webob/dec.py", line 208, in call_func<br>
> return self.func(req, *args, **kwargs)<br>
> File "/usr/lib/python2.7/dist-packages/glance/common/wsgi.py", line 113, in __call__<br>
> response = req.get_response(self.application)<br>
> File "/usr/lib/python2.7/dist-packages/webob/request.py", line 1053, in get_response<br>
> application, catch_exc_info=False)<br>
> File "/usr/lib/python2.7/dist-packages/webob/request.py", line 1022, in call_application<br>
> app_iter = application(self.environ, start_response)<br>
> File "/usr/lib/python2.7/dist-packages/webob/dec.py", line 147, in __call__<br>
> resp = self.call_func(req, *args, **self.kwargs)<br>
> File "/usr/lib/python2.7/dist-packages/webob/dec.py", line 208, in call_func<br>
> return self.func(req, *args, **kwargs)<br>
> File "/usr/lib/python2.7/dist-packages/glance/common/wsgi.py", line 110, in __call__<br>
> response = self.process_request(req)<br>
> File "/usr/lib/python2.7/dist-packages/glance/common/context.py", line 104, in process_request<br>
> raise exception.NotAuthorized()<br>
> NotAuthorized: None<br>
><br>
> Completed in 0.0031 sec.<br>
><br>
> Interestingly (perhaps) I see nothing in the keystone.log file. In fact, I don't even see the keystone log file. Keystone opens to log files named 'admin.log' and 'keystone_legacy_auth.log'. Is this right? Also, if I run keystone interactively (keystone -v -d) then issue the glance command, I see nothing in the keystone window. This doesn't seem right to me, but I'm just getting started with keystone integration.<br>
><br>
> Thanks in advance for any insight...<br>
><br>
> Regards,<br>
> Ross<br>
><br>
> On Jan 31, 2012, at 6:48 PM, Jay Pipes wrote:<br>
><br>
>> On 01/31/2012 06:28 PM, Lillie Ross-CDSR11 wrote:<br>
>>> I'm reinstalling the various Openstack services from packages in the<br>
>>> ManagedIT PPA to pull in the latest Diablo bug fixes. I'm following the<br>
>>> latest directions in the newly release installation guide as I perform<br>
>>> these upgrades<br>
>>> (<a href="http://docs.openstack.org/diablo/openstack-compute/install/content/index.html" target="_blank">http://docs.openstack.org/diablo/openstack-compute/install/content/index.html</a>).<br>
>>><br>
>>> However, I'm having trouble getting Glance to authenticate with<br>
>>> Keystone. All config files have been copied from the examples posted in<br>
>>> the installation guide (and modified accordingly for my admin token, IP<br>
>>> addresses, etc.). Regardless, I continually get the following error<br>
>>> message and stack dump when trying to verify the Glance/Keystone<br>
>>> integration:<br>
>>><br>
>>> Step 1: Grab a token<br>
>>><br>
>>> # curl -d '{"auth": {"tenantName": "default",<br>
>>> "passwordCredentials":{"username": "admin", "password": "admin"}}}' -H<br>
>>> "Content-type: application/json" <a href="http://173.23.181.1:35357/v2.0/tokens" target="_blank">http://173.23.181.1:35357/v2.0/tokens</a> |<br>
>>> python -mjson.tool<br>
>>><br>
>>> ...<br>
>>> "token": {<br>
>>> "expires": "2012-02-01T15:24:33",<br>
>>> "id": "fa89fb9a-60d2-4921-b12d-6aee1c177823",<br>
>>> "tenant": {<br>
>>> "id": "1",<br>
>>> "name": "default"<br>
>>> }<br>
>>> }<br>
>><br>
>> You're going to want to grab a long-lived token (sometimes called a service token) to use for the Glance API <-> Glance Registry connection. This service token should be used in the glance-registry.conf file.<br>
>><br>
>> In glance-registry.conf, you'll see a section looking like this:<br>
>><br>
>> [filter:authtoken]<br>
>> paste.filter_factory = keystone.middleware.auth_token:filter_factory<br>
>> service_protocol = http<br>
>> service_host = 127.0.0.1<br>
>> service_port = 5000<br>
>> auth_host = 127.0.0.1<br>
>> auth_port = 35357<br>
>> auth_protocol = http<br>
>> auth_uri = <a href="http://127.0.0.1:5000/" target="_blank">http://127.0.0.1:5000/</a><br>
>> admin_token = 999888777666<br>
>><br>
>> Replace admin_token = 999888777666 with the relevant long-lived service token.<br>
>><br>
>> Cheers!<br>
>> -jay<br>
>><br>
>><br>
>>> Step 2: Try a Glance command<br>
>>><br>
>>> # glance details -A fa89fb9a-60d2-4921-b12d-6aee1c177823<br>
>>> Failed to show details. Got error:<br>
>>> Internal Server error: Traceback (most recent call last):<br>
>>> File "/usr/lib/python2.7/dist-packages/eventlet/wsgi.py", line 336, in<br>
>>> handle_one_response<br>
>>> result = self.application(self.environ, start_response)<br>
>>> File "/usr/lib/python2.7/dist-packages/webob/dec.py", line 147, in __call__<br>
>>> resp = self.call_func(req, *args, **self.kwargs)<br>
>>> File "/usr/lib/python2.7/dist-packages/webob/dec.py", line 208, in call_func<br>
>>> return self.func(req, *args, **kwargs)<br>
>>> File "/usr/lib/python2.7/dist-packages/glance/common/wsgi.py", line 113,<br>
>>> in __call__<br>
>>> response = req.get_response(self.application)<br>
>>> File "/usr/lib/python2.7/dist-packages/webob/request.py", line 1053, in<br>
>>> get_response<br>
>>> application, catch_exc_info=False)<br>
>>> File "/usr/lib/python2.7/dist-packages/webob/request.py", line 1022, in<br>
>>> call_application<br>
>>> app_iter = application(self.environ, start_response)<br>
>>> File "/usr/lib/python2.7/dist-packages/webob/dec.py", line 147, in __call__<br>
>>> resp = self.call_func(req, *args, **self.kwargs)<br>
>>> File "/usr/lib/python2.7/dist-packages/webob/dec.py", line 208, in call_func<br>
>>> return self.func(req, *args, **kwargs)<br>
>>> File "/usr/lib/python2.7/dist-packages/glance/common/wsgi.py", line 110,<br>
>>> in __call__<br>
>>> response = self.process_request(req)<br>
>>> File "/usr/lib/python2.7/dist-packages/glance/common/context.py", line<br>
>>> 104, in process_request<br>
>>> raise exception.NotAuthorized()<br>
>>> NotAuthorized: None<br>
>>><br>
>>> From the Glance api.log file we see the following (with the traceback<br>
>>> identical to above removed):<br>
>>><br>
>>> <a href="tel:2012-01-31%2017" value="+12012013117" target="_blank">2012-01-31 17</a>:14:30 DEBUG [glance.api.middleware.version_negotiation]<br>
>>> Processing request: GET /v1/images/detail Accept:<br>
>>> <a href="tel:2012-01-31%2017" value="+12012013117" target="_blank">2012-01-31 17</a>:14:30 DEBUG [glance.api.middleware.version_negotiation]<br>
>>> Matched versioned URI. Version: 1.0<br>
>>> <a href="tel:2012-01-31%2017" value="+12012013117" target="_blank">2012-01-31 17</a>:14:30 DEBUG [eventlet.wsgi.server] Traceback (most recent<br>
>>> call last):<br>
>>> ? (traceback removed)<br>
>>> <a href="tel:2012-01-31%2017" value="+12012013117" target="_blank">2012-01-31 17</a>:14:30 DEBUG [eventlet.wsgi.server] 127.0.0.1 - -<br>
>>> [31/Jan/2012 17:14:30] "GET /v1/images/detail?limit=10 HTTP/1.1" 500<br>
>>> 1528 0.001163<br>
>>><br>
>>> This is probably a config blunder on my part, but I've poured over the<br>
>>> config files numerous times. Regardless, I've attached the glance-api<br>
>>> and registry conf files.<br>
>>><br>
>>> Any suggestions?<br>
>>><br>
>>> Regards,<br>
>>> Ross<br>
>>><br>
>>><br>
>>><br>
>>><br>
>>><br>
>>> _______________________________________________<br>
>>> Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
>>> Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
>>> Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
>>> More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
>><br>
>> _______________________________________________<br>
>> Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
>> Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
>> Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
>> More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
>><br>
>><br>
>><br>
><br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
</blockquote></div><br></div></div></div>
</blockquote></div><br></div>