<div dir="ltr">Thanks Pavlo! After downgrade my IPA to Mitaka branch, my ironic seems work fine now. But another problem, can we specify IPA version when we create image via DIB? </div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 12, 2017 at 3:42 PM, Pavlo Shchelokovskyy <span dir="ltr"><<a href="mailto:pshchelokovskyy@mirantis.com" target="_blank">pshchelokovskyy@mirantis.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi,<div><br></div><div>you shouldn't use the latest master IPA version with ironic as of Mitaka release.</div><div>The ironic API endpoint it tries to contact (v1/lookup...) was introduced during Newton development and thus is present in ironic API from Newton release onwards. The fallback to the old lookup endpoint (implemented as vendor driver passthru) was removed recently from IPA in master branch (after Newton release). That means your IPA version tries to contact the ironic API via endpoint that does not exist in this ironic version. Use ramdisk with IPA built from stable/mitaka or stable/newton branches.</div><div><br></div><div>As for the "without any authentication" point - yes, that's the way it currently works, all communications between IPA and ironic API are not using Keystone tokens as we still have to figure out a reliable and secure way to pass tokens or credentials to get them into the ramdisk.</div><div><br></div><div>Cheers,</div></div><div class="gmail_extra"><br clear="all"><div><div class="m_-7280059895246311190gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr">Dr. Pavlo Shchelokovskyy<div>Senior Software Engineer</div><div>Mirantis Inc</div><div><a href="http://www.mirantis.com" target="_blank">www.mirantis.com</a></div></div></div></div></div></div>
<br><div class="gmail_quote"><div><div class="h5">On Thu, Jan 12, 2017 at 5:13 AM, int32bit <span dir="ltr"><<a href="mailto:krystism@gmail.com" target="_blank">krystism@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div dir="ltr">Hi, All,<div> <br></div><div>I'm a newcomer to Openstack Ironic. Recently, I'm work on deploy ironic manually, and I found that the node status 100% <b>blocked in `callback wait` status</b> until timeout. The ironic-api log shows that:</div><div><br></div><div>2017-01-12 10:21:00.626 158262 INFO keystonemiddleware.auth_token [-] Rejecting request</div><div>2017-01-12 10:21:00.627 158262 INFO ironic_api [-] 10.0.81.31 "GET /v1/lookup?addresses=xxx HTTP/1 </div><div><br></div><div>I guess the problem is IPA, so I dug into IPA source and traced the request process and found that the IPA client request <b>without any authentication</b> [1].</div><div><br></div><div>[1] <a href="https://github.com/openstack/ironic-python-agent/blob/master/ironic_python_agent/ironic_api_client.py#L109-L111" target="_blank">https://github.com/opensta<wbr>ck/ironic-python-agent/blob/<wbr>master/ironic_python_agent/<wbr>ironic_api_client.py#L109-L111</a></div><div><br></div><div><br></div><div>My ironic version is <b>5.1.1-1(mitaka) </b>and <b>IPA has updated to newest version from master branch</b>.</div><div><br></div><div>My config as follows:</div><div><br></div><div>```</div><div><div>[keystone_authtoken]</div><div>auth_uri=<a href="http://xxxx:5000/" target="_blank">http://xxxx:5000/</a></div><div>auth_version=v3.0</div><div>identity_uri=<a href="http://xxxx:35357/" target="_blank">http://xxxx:35357<wbr>/</a></div><div>admin_user=ironic</div><div>admin_password=IRONIC_PASSWORD</div><div>admin_tenant_name=service</div><div><br></div><div>[conductor]</div><div>api_url=<a href="http://201.0.0.120:6385" target="_blank">http://201.0.0.120:638<wbr>5</a> # ensure the node can access</div><div>```</div></div><div><br></div><div>I'm really not sure if I miss something or something wrong in config.</div><div><br></div><div><div style="font-size:12.8px">Thanks for any help!</div><div style="font-size:12.8px">krystism</div></div></div>
<br></div></div>______________________________<wbr>_________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi<wbr>-bin/mailman/listinfo/openstac<wbr>k</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi<wbr>-bin/mailman/listinfo/openstac<wbr>k</a><br>
<br></blockquote></div><br></div>
</blockquote></div><br></div>