[openstack-dev] [Heat] [Keystone] Heat cfn-push-stats failed with '403 SignatureDoesNotMatch', it may be Keystone problem.

Steven Hardy shardy at redhat.com
Tue Aug 26 10:29:56 UTC 2014

On Sun, Aug 24, 2014 at 02:55:14PM +0900, Yukinori Sagara wrote:
>    Hi.
>    I am trying Heat instance HA, using RDO Icehouse.
>    After instance boot, instance push own stats to heat alarm with
>    cfn-push-stats command.
>    But cfn-push-stats always failed with error '403 SignatureDoesNotMatch',
>    this message is
>    output to /var/log/cfn-push-stats.log.
>    I debugged client and server side code. (i.e. cfn-push-stats, boto, heat,
>    keystone,

Thanks for debugging this - unfortunately it's not the first time a change
in boto has broken heat like this :(

Can you please provide a link to your patch, so we can help review the
change to python-keystoneclient?

Also, please remember that we need to ensure the signature calculation on
the server side works not only with the latest boto, but also older
versions too - so if this is a recent change in behavior, we may need to
use the User-Agent header to conditionally modify the logic (unless it can
be done in a backwards compatible way), e.g like I did here:




More information about the OpenStack-dev mailing list