nova uses the wrong tenant

Bug #985477 reported by Philippe Berthault
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Invalid
Undecided
Unassigned

Bug Description

See the bug #985070 on horizon product.

Latest OpenStack release on Ubuntu 12.04.

In keystone, I've created several users and tenants:
 - a user A in the tenant A',
 - a user B in the tenant B',
etc..

Then I've declared endpoints for these tenants with the "keystone endpoint-create ..." command.
# SERVICE_NOVA=ID of the service nova
# TENANT_A=ID of the tenant A'
# TENANT_B=ID of the tenant B'
# keystone endpoint-create --service_id $SERVICE_NOVA --publicurl http://.../$TENANT_A --adminurl ...
# keystone endpoint-create --service_id $SERVICE_NOVA --publicurl http://.../$TENANT_B --adminurl ...

With this configuration, when the user A logs into horizon, there is some errors because URLs used to connect to nova are the URLs declared with the TENANT_B instead of TENANT_A.

So, I've deleted the endpoints related to the TENANT_B (with keystone endpoint-delete command) and tried to declare another nova service (one per tenant) but this doesn't resolve the problem.
# keystone service-create --name nova_B --type compute
# SERVICE_NOVA_B=ID of the service nova_B
# keystone endpoint-create --service_id $SERVICE_NOVA_B --publicurl http://.../$TENANT_B --adminurl ...

After that, when the user B try to start an instance with the nova boot command, then nova uses the URLs declared with the TENANT_A instead of TENANT_B and this not solve the problem in horizon.

In conclusion, there is a big confusion on tenants which is due to the fact that the tenant ID must be declared in the keystone endpoints of the nova service(s) which is not true for glance service for example.

I don't know if the problem is in nova or keystone or in the documentation or else if it's a problem of the design.

Revision history for this message
Vish Ishaya (vishvananda) wrote : Re: [Bug 985477] [NEW] nova uses the wrong tenant

You need to specify your endpoints using a replacement string where the tenant can be inserted:

keystone endpoint-create --service_id $SERVICE_NOVA --publicurl http://.../%(tenant_id)s

the %(tenant_id)s will automatically be replaced with the proper tenant

See the documentation here:

http://docs.openstack.org/trunk/openstack-compute/install/content/keystone-service-endpoint-create.html

Changed in nova:
status: New → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.