Keystone POST /tokens response does not contain all endpoints

Bug #1081221 reported by Boden R
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Invalid
Medium
Unassigned

Bug Description

This scenario occurs under the following conditions:

* A service of a given type (for example 'compute') is registered in keystone.
* There are more than 1 endpoints in keystone for the associated service's type for a given region. For example there are 2 different endpoints in keystone, both for the compute service of the 'compute' type and both in the region 'RegionOne'.

In the above scenario a response from the POST /tokens API only returns a single endpoint per service type (per region). So for example in the above scenario my endpoint catalog in the POST /tokens response would only include 1 'compute' service endpoint -- the other is not returned.

Note that in this scenario you can still use the admin API for GET /services -- this will return all endpoints regardless of if there are multiple endpoints for a single service.

See keystone.catalog.backend.sql.get_catalog()

To repo use the SQL catalog driver:
* Define a service of type 'compute'
* Define 2 different endpoints which contain different urls but both endpoint definitions are for the service created in the previous step. Both of these endpoints should be defined using the same region.
* Use POST /tokens on keystone to to authenticate.
* Inspect the response token.
==> You will see it only includes 1 endpoint definition for the 'compute' service.

Example from my system using MySQL backed catalog:

(1) My keystone.service table has the following service defined:

| d0912023a0304d5191ca95d59b19c8e0 | compute | {"description": "Nova Compute Service", "name": "nova"}

(2) My keystone.endpoint table has the following endpoints associated with that service:

| d2299650573a46cf8ff7eebb6f7871dc | RegionOne | d0912023a0304d5191ca95d59b19c8e0 | {"adminurl": "http://localhost:8774/v2/%(tenant_id)s", "internalurl": "http://localhost:8774/v2/%(tenant_id)s", "publicurl": "http://localhost:8774/v2/%(tenant_id)s"} |

| 80d2546f347d41f8b10a313f1bbf4726 | RegionOne | d0912023a0304d5191ca95d59b19c8e0 | {"publicurl":"http://somehost:8992/v2"} |

| 27aeb73ff319405f946fe1fff785b3fb | us-southeast | d0912023a0304d5191ca95d59b19c8e0 | {"adminurl": "http://us-se.ibm.com:4302/v2.0", "internalurl": "http://us-se.ibm.com:4301/v2.0", "publicurl": "http://us-se.ibm.com:4300/v2.0"} |

(3) A POST /tokens response to obtain an admin user scoped token contains the following endpoints for 'compute':

"endpoints":[
            {
                "adminURL":"http://localhost:8774/v2/6f8945f2d47f4abea149b7a0176b12a8",
                "region":"RegionOne",
                "publicURL":"http://localhost:8774/v2/6f8945f2d47f4abea149b7a0176b12a8",
                "internalURL":"http://localhost:8774/v2/6f8945f2d47f4abea149b7a0176b12a8",
                "id":"d2299650573a46cf8ff7eebb6f7871dc"
            },
            {
                "adminURL":"http://us-se.ibm.com:4302/v2.0",
                "region":"us-southeast",
                "publicURL":"http://us-se.ibm.com:4300/v2.0",
                "internalURL":"http://us-se.ibm.com:4301/v2.0",
                "id":"27aeb73ff319405f946fe1fff785b3fb"
            }
        ],
    "type":"compute",
    "name":"nova"
},

As shown in the JSON snippet below, only 1 of the RegionOne compute endpoints is in the token's catalog.

Additional Notes:
* I don't believe this scenario is valid using the templated driver as it appears the template format is not robust enough to allow you to define multiple endpoint per service.. I could be wrong, but IMO something like SQL is more realistic anyway.
* There is a similar issue here if you try to define multiple services of the same type (for example 'compute') but each service having its own name and description. In this case you only get 1 of the services since the catalog is indexed by region/type and hence you get at most 1 service of a given type per region.

Tags: blueprint
Revision history for this message
Dolph Mathews (dolph) wrote :

In your templated catalog example, you're overriding the endpoints you just defined:

    # fake compute service for now to help novaclient tests work
    catalog.RegionOne.compute.publicURL = http://localhost:$(compute_port)s/v1.1/$(tenant_id)s
    catalog.RegionOne.compute.adminURL = http://localhost:$(compute_port)s/v1.1/$(tenant_id)s
    catalog.RegionOne.compute.internalURL = http://localhost:$(compute_port)s/v1.1/$(tenant_id)s
    catalog.RegionOne.compute.name = Compute Service

    # 2nd compute endpoint for bug repo
    catalog.RegionOne.compute.publicURL = http://localhost2:$(compute_port)s/v1.1/$(tenant_id)s
    catalog.RegionOne.compute.adminURL = http://localhost2:$(compute_port)s/v1.1/$(tenant_id)s
    catalog.RegionOne.compute.internalURL = http://localhost2:$(compute_port)s/v1.1/$(tenant_id)s
    catalog.RegionOne.compute.name = Compute Service

Change the second set to a different region and it should appear in the catalog:

    # 2nd compute endpoint for bug repo
    catalog.RegionTwo.compute.publicURL = http://localhost2:$(compute_port)s/v1.1/$(tenant_id)s
    catalog.RegionTwo.compute.adminURL = http://localhost2:$(compute_port)s/v1.1/$(tenant_id)s
    catalog.RegionTwo.compute.internalURL = http://localhost2:$(compute_port)s/v1.1/$(tenant_id)s
    catalog.RegionTwo.compute.name = Compute Service

Changed in keystone:
status: New → Incomplete
Revision history for this message
Adam Young (ayoung) wrote :

Some discussion on Endpoints that effects this bug

https://etherpad.openstack.org/endpoint-selection

Boden R (boden)
description: updated
Changed in keystone:
status: Incomplete → New
Joseph Heck (heckj)
Changed in keystone:
status: New → Triaged
importance: Undecided → Medium
tags: added: blueprint
Revision history for this message
Henrique Truta (henriquetruta) wrote :

I've tried to get the bug with the following steps:
* Define a service of type 'compute'
* Define 2 different endpoints which contain different urls but both endpoint definitions are for the service created in the previous step. Both of these endpoints should be defined using the same region.
* Use POST /tokens on keystone to to authenticate.
* Inspect the response token.
==> You will see it only includes 1 endpoint definition for the 'compute' service.

However, I didn't get the error. I think this bug was already solved in another bug or BP. Can anyone still get the error?

Changed in keystone:
assignee: nobody → Henrique Truta (henrique-4)
Revision history for this message
Dolph Mathews (dolph) wrote :

Thanks, Henrique!

Changed in keystone:
status: Triaged → Invalid
Changed in keystone:
assignee: Henrique Truta (henrique-4) → nobody
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.