nova uses the wrong tenant
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
OpenStack Compute (nova) |
Invalid
|
Undecided
|
Unassigned |
Bug Description
See the bug #985070 on horizon product.
Latest OpenStack release on Ubuntu 12.04.
In keystone, I've created several users and tenants:
- a user A in the tenant A',
- a user B in the tenant B',
etc..
Then I've declared endpoints for these tenants with the "keystone endpoint-create ..." command.
# SERVICE_NOVA=ID of the service nova
# TENANT_A=ID of the tenant A'
# TENANT_B=ID of the tenant B'
# keystone endpoint-create --service_id $SERVICE_NOVA --publicurl http://
# keystone endpoint-create --service_id $SERVICE_NOVA --publicurl http://
With this configuration, when the user A logs into horizon, there is some errors because URLs used to connect to nova are the URLs declared with the TENANT_B instead of TENANT_A.
So, I've deleted the endpoints related to the TENANT_B (with keystone endpoint-delete command) and tried to declare another nova service (one per tenant) but this doesn't resolve the problem.
# keystone service-create --name nova_B --type compute
# SERVICE_NOVA_B=ID of the service nova_B
# keystone endpoint-create --service_id $SERVICE_NOVA_B --publicurl http://
After that, when the user B try to start an instance with the nova boot command, then nova uses the URLs declared with the TENANT_A instead of TENANT_B and this not solve the problem in horizon.
In conclusion, there is a big confusion on tenants which is due to the fact that the tenant ID must be declared in the keystone endpoints of the nova service(s) which is not true for glance service for example.
I don't know if the problem is in nova or keystone or in the documentation or else if it's a problem of the design.
You need to specify your endpoints using a replacement string where the tenant can be inserted:
keystone endpoint-create --service_id $SERVICE_NOVA --publicurl http:// .../%(tenant_ id)s
the %(tenant_id)s will automatically be replaced with the proper tenant
See the documentation here:
http:// docs.openstack. org/trunk/ openstack- compute/ install/ content/ keystone- service- endpoint- create. html