Thursday, 2016-09-08

Index Friday, 2016-09-09 »
*** openstack has joined #openstack-ec2api01:43
*** andrey-mp has joined #openstack-ec2api10:42
*** cybojanek has joined #openstack-ec2api14:28
cybojanekHi!14:29
cybojanekIs there more documentation on installation and configuration?14:30
cybojanekI'm trying to install the ec2api and I get errors from keystone: BadRequest: Expecting to find domain in project - the server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error14:30
andrey-mphi14:48
andrey-mpwhich way do you use to install ec2api?14:48
cybojanekyum install14:58
cybojanekfrom the following repo (h/o)14:58
cybojanekhttp://mirror.centos.org/centos/7/cloud/x86_64/openstack-mitaka/14:59
cybojanekI messed around with the settings14:59
cybojanekec2 describe-images works14:59
cybojanekBut now ec2 describe-instances returns a 401 while executing one of the subcalls15:00
cybojanekI see it does some neutron calls which return empty ports/floatingips json arrays, some security groups15:02
cybojanekI think my nova api endpoint is 2.0 - does it have to be smoething else?15:03
cybojanekI'm using keystone v3 with domains15:04
andrey-mpmmm, I didn't install it via yum - what ec2api.conf contains?15:08
cybojanekGetting15:08
cybojanek[DEFAULT]15:10
cybojanekec2api_workers=415:10
cybojanekdebug = True15:10
cybojanekverbose = True15:10
cybojanekadmin_tenant_name = service15:10
cybojanekadmin_user = ec215:10
cybojanekadmin_password = xxxxx15:10
cybojanekregion_list = xxxx15:10
cybojanekkeystone_ec2_tokens_url=http://muffin:5000/v3/ec2tokens15:10
cybojanekkeystone_url=http://muffin:5000/v315:10
cybojanekexternal_network = public15:10
cybojanekfull_vpc_support=true15:10
cybojanekthe ec2 user belongs to the tenant service15:10
andrey-mpmy config from devstack is here - http://paste.org.ru/?j3po8v15:10
andrey-mpthese settings are important also -15:11
andrey-mpkeystone_ec2_tokens_url = http://10.10.0.4/identity/v3/ec2tokens15:11
andrey-mpkeystone_url = http://10.10.0.4/identity15:11
andrey-mpstate_path = /opt/stack/data/ec2api15:11
andrey-mpand database section15:11
cybojanekThe database I have set up correctly15:12
cybojanekBecause I had that issue before and now its fixed15:12
cybojanekI assume identity is a vhost to port/v315:12
cybojanekLemme check that the ec2 user has the correct role15:12
cybojanekDoes it need admin and service?15:12
andrey-mpyes15:13
andrey-mpit needs15:13
cybojanekHere's the log of describe-volumes15:16
cybojanekhttp://pastebin.com/qyFaEg8k15:16
cybojanekAs an aside, whats the status of ec2-api within the openstack community?15:19
cybojanekI've read up that they removed the core support and pushed it out to a separate project, but I'm wondering how much openstack backing this now has?15:19
andrey-mpit's an official project15:20
andrey-mpI don't know who use separate ec2api project now - We don't have such information...15:22
andrey-mplet me check logs...15:23
cybojanekthanks :-)15:23
andrey-mphow have you installed OpenStack?15:24
cybojanekcustom, from yum repo15:24
cybojaneknot devstack, not puppet15:25
cybojanekopenstack client itself works fine15:25
cybojaneklist instances, images, volumes etc15:25
andrey-mpdo you set domain options in other configurations files - like nova, cinder, glance?15:28
cybojanekYes, for example15:29
cybojanekFrom nova.conf15:29
cybojanek[keystone_authtoken]15:29
cybojanekauth_uri = http://muffin:500015:29
cybojanekauth_url = http://muffin:3535715:29
cybojanekmemcached_servers = muffin:1121115:29
cybojanekauth_type = password15:29
cybojanekproject_domain_name = default15:29
cybojanekuser_domain_name = default15:29
cybojanekproject_name = service15:29
cybojanekusername = nova15:29
cybojanekpassword = xxxxxx15:29
cybojanekdoes get_os_admin_session in clients.py need to be modified for domain support?15:30
andrey-mpmaybe...15:30
cybojanekIs it this one? http://docs.openstack.org/developer/python-keystoneclient/api/keystoneclient.auth.identity.generic.html#module-keystoneclient.auth.identity.generic.password15:30
cybojanekIs the devstack identity portion a vhost to v2?15:34
andrey-mpi don't know right now what devstack use15:36
andrey-mpfor validating ec2 credentials we use v315:37
andrey-mpfor get_os_admin_session we use root URL of keystone - client will choose version15:37
cybojanekIf I change it to15:39
cybojanekkeystone_url=http://muffin:5000/15:39
cybojanek(no v3)15:39
cybojanekI get Unauthorized: The request you have made requires authentication. (HTTP 401) (Request-ID: req-b02805da-6087-492c-83d8-aa16b6413868)15:39
andrey-mpcan you modify clients.py of ec2api code and add passing of user_domain_name='default' to call https://github.com/openstack/ec2-api/blob/master/ec2api/clients.py#L21115:39
andrey-mp?15:39
cybojanekMhm - 1 sec15:40
cybojanekSame issue BadRequest: Expecting to find domain in project15:42
andrey-mpis there a script of users/projects/domains creation? so I can check same on my devstack15:44
cybojanekhttp://pastebin.com/ap3xTNWY15:45
cybojanekIts missing the ec2 user which I created manually15:47
cybojanekBut I also tried with nova user15:47
cybojanekin ec2api.conf15:47
andrey-mpand is the same result with nova user?15:47
cybojanekyes15:48
cybojanekI have a tcpdump of the keystone requests if need be15:48
andrey-mpI think we should check this on our side15:49
cybojanekOk15:50
andrey-mpI will try to get same sutiation first and then will make a fix15:50
andrey-mpright now you can try to modify clients.py and add there domain_name and project_domain_name with same 'default' value as user_domain_name15:57
cybojanekmhm15:57
andrey-mpthis only one idea that I have now :)15:58
cybojanekAuthorizationFailure: Authentication cannot be scoped to multiple targets. Pick one of: project, domain, trust or unscoped15:58
andrey-mpwow15:59
cybojanekProbably conflicting with the other tenant/project stuff15:59
andrey-mplets try with domain_name only ?15:59
andrey-mpand if it's not difficult - please share keystone tcpdump with us16:00
cybojaneksame issue again16:00
cybojanekh/o16:00
cybojanekok16:04
cybojanek1 more min16:04
andrey-mpnp16:04
andrey-mpbtw, ec2 service is not needed in keystone catalog for anyone...16:05
andrey-mpand it listens just on "${PREFIX_PUBLIC}://${HOSTNAME_PUBLIC}:8788/" not on "${PREFIX_PUBLIC}://${HOSTNAME_PUBLIC}:8788/services/Cloud"16:06
cybojanekK16:06
cybojanekI think the openstack ec2 credentials list command didn't work until I added it16:07
cybojanekHorizon also didn't show the download creds link until the service was there16:07
andrey-mphm, looks strange )16:07
cybojanekhttp://pastebin.com/UEapv7Zj16:07
cybojanekLol - I dug into the horizon code, it has something like "is service enabled" that looks for ec2 in the endpoint list16:08
andrey-mpthis last log says me that request should contain only project_domain_name16:09
andrey-mpbut as I understood you've tried this with same result16:09
cybojanekUsing project_domain_name instead of user_domain_name I get16:11
cybojanek{"auth": {"scope": {"project": {"domain": {"name": "default"}, "name": "service"}}, "identity": {"password": {"user": {"password": "xxxxx", "name": "ec2"}}, "methods": ["password"]}}}16:11
andrey-mpand 400 ?16:12
cybojanekYes16:12
andrey-mpand the same error - "expecting to find domain in project" ?16:13
cybojanekNope, user16:14
andrey-mp^)16:14
andrey-mp:)16:14
cybojanekok progress16:15
cybojanekI figured out how to fix it in curl16:15
cybojaneklol16:15
andrey-mpadn what if add user_domain_name to current?16:15
andrey-mppass project_domain_name and user_domain_name together16:15
cybojanekGreat success!16:15
cybojanekvolumes and instances works16:16
cybojanekauth = keystone_auth.Password(16:16
cybojanek            user_domain_name='default',16:16
cybojanek            project_domain_name='default',16:16
cybojanek            username=CONF.admin_user,16:16
cybojanek            password=CONF.admin_password,16:16
cybojanek            project_name=CONF.admin_tenant_name,16:16
cybojanek            tenant_name=CONF.admin_tenant_name,16:16
cybojanek            auth_url=CONF.keystone_url,16:16
cybojanek        )16:16
cybojanekYea, now I get what the errors meant16:16
andrey-mpthank you - we will fix this in upstream shortly16:16
cybojanekAre you going to add a config option?16:17
andrey-mpyeah16:17
andrey-mpsame as in nova16:17
cybojanekCool16:17
cybojanekThanks! AFK for a bit16:19
andrey-mpno problem :)16:19
*** andrey-mp has quit IRC16:44
*** rbradfor has left #openstack-ec2api18:04
*** andrey-mp has joined #openstack-ec2api20:06
*** andrey-mp has quit IRC20:25
Index Friday, 2016-09-09 »

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!