Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1639185

Summary:	[RHOSP12]openstack client requires access to keystone's v2.0 adminURL, when it really shouldn't
Product:	Red Hat OpenStack	Reporter:	Alex Stupnikov <astupnik>
Component:	python-openstackclient	Assignee:	Harry Rybacki <hrybacki>
Status:	CLOSED WONTFIX	QA Contact:	nlevinki <nlevinki>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	12.0 (Pike)	CC:	apevec, astupnik, hrybacki, jpichon, lhh, nkinder, nlevinki, rmascena
Target Milestone:	zstream	Keywords:	ZStream
Target Release:	12.0 (Pike)
Hardware:	All
OS:	Linux
Whiteboard:	Triaged
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1639183	Environment:
Last Closed:	2018-12-13 16:42:03 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1639183
Bug Blocks:	1639184

Description Alex Stupnikov 2018-10-15 09:03:18 UTC

+++ This bug was initially created as a clone of Bug #1639183 +++

Description of problem:

Keystone v2.0 provides different set of URLs for different kinds of requests:

- adminurl: for admin requests
- internalurl: for internal services
- publicurl: for public requests

Customer reported the following problem: openstackclient requires access to adminURL in cases when it is not needed. For example, every user should be able to create and list his EC2 credentials (""openstack ec2 credentials list"" command), but for some reason openstack client uses adminURL to process such requests and hangs if it is not available.

Version-Release number of selected component (if applicable):

I was able to reproduce this issue for RHOSP 10, RHOSP 11 and RHOSP 12 (keystone v2.0 was deprecated in Queens, so haven't checked it).


How reproducible:

Collect information about identity endpoint, get its URLs.

Use EC2 commands with  active verbose flags to create and list EC2 credentials:

openstack -vv ec2 credentials create
openstack -vv ec2 credentials list

You will see that it pools adminURL (generally uses 35357 port). You could also block this URL with iptables and see that request will timeout.


Expected results:

User will be able to get his EC2 credentials without polling internal URL.


Additional info:

Though I report this issue for certain command, it seems that other commands are also affected and should be investigated.


Workaround:

Create DNAT rule that will DNAT adminURL to publicURL.

Comment 2 Alex Stupnikov 2018-11-27 09:26:54 UTC

Hello.

Would like to ask if we can provide some estimates to customer.

BR, Alex.