Thank you Rob. Now glance image-list is working fine with adding
"insecure=True" to glance-api.conf and glance-register.conf below
keystone_authtoken section. I'll also try the approach suggested by
Rob for adding cafile path.
I also set "insecure=True" for nova and neutron. Nova is working fine
with SSL enabled keystone but neutron is still having weird issue. I
am doing Google around it and I see lots of bugs related to the issue
but nothing is clear if it's a bug or config issue, I am trying some
workarounds but nothing seems working. When I try to do "neutron
net-list", I can see error as "Authentication required"
/etc/neutron/server.log shows following lines when net-list command is executed:
2014-04-15 03:50:34.947 24843 INFO urllib3.connectionpool [-] Starting
new HTTPS connection (1): openstack-centos65
2014-04-15 03:50:35.045 24843 WARNING
keystoneclient.middleware.auth_token [-] Verify error: Command
'openssl' returned non-zero exit status 4
2014-04-15 03:50:35.048 24843 WARNING
keystoneclient.middleware.auth_token [-] Authorization failed for
token 19ecd7820e37141d83f5ff7339da6656
2014-04-15 03:50:35.050 24843 INFO
keystoneclient.middleware.auth_token [-] Invalid user token -
rejecting request
Neutron net-list --verbose output is attached. Please let me know your inputs.
Regards,
Devendra Gupta
On Mon, Apr 14, 2014 at 6:32 PM, Rob Crittenden <rcritten(a)redhat.com> wrote:
Devendra Gupta wrote:
>
> Hi,
>
> I have configured keystone to SSL and also update the endpoint in
> service catalog. Keystone operations like endpoint/tenant list working
> fine. I also update glance-api.conf and glance-registry.conf files
> with ssl enabled keystone details but still glance is unable to find
> images. It fails with following:
>
> [root@openstack-centos65 glance(keystone_admin)]# glance --insecure
> image-list
> Request returned failure status.
> Invalid OpenStack Identity credentials.
>
> Please see attached keystone.conf, glance-api.conf and
> glance-registry.conf and debug output of glance image-list and
> endpoint list.
The auth_uri in glance-api.conf is wrong. It should be
https://openstack-centos65:5000/v2.0
If you set cafile in that section you should be able to do this without
--insecure, assuming that openstack-centos65 is the CN value in the
certificate subject of the keystone server.
The admin_tenant_name is usually singular, service rather than services, but
it can vary by how you installed things.
rob