Red Hat Bugzilla – Bug 1428632
OpenStack Heat may fail to connect keystone admin API in multi-region environment
Last modified: 2017-05-17 08:21:45 EDT
+++ This bug was initially created as a clone of Bug #1418159 +++ Description of problem: Heat uses Keystone Trust to build a stack as a tenant user. To do so, heat-engine needs connections to a Keystone admin API endpoint. In multi-region environment, each region may have its own Keystone admin API and Keystone may have multiple endpoint entries. In this case, heat-engine uses the 1st. So, heat-engine in regions without the 1st endpoint tries to connect another region with the 1st. It will fail if there is no route to the endpoint. Version-Release number of selected component (if applicable): openstack-heat-common-6.0.0-8.el7ost.noarch How reproducible: 100% in regions without the 1st endpoint. Steps to Reproduce: 1. Register multiple Keystone admin endpoints. The 1st entry should have dummy region name and inaccessible IP address from heat-engine. 2. "heat stack-create <template>" 3. Actual results: heat command failed with and error: ConnectFailure: Unable to establish connection to http://<inaccessbile>:35357/v2.0/OS-TRUST/trusts Expected results: heat-engine works properly and the stack creation completed. Additional info: The attached patch fixes the problem. --- Additional comment from Rabi Mishra on 2017-02-03 08:02:00 EST --- I've raised an upstream bug and put a fix for it.
There is a consensus to mark as verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2017:1243