[Rdo-list] Fwd: [OpenStack-docs] [install-guide] (not that much) progress with Kilo install on RHEL/Centos 7
11:01 a.m.
FYI, interested in any further info on the below to help the docs team out.
----- Forwarded Message -----
From: "Bernd Bausch" <berndbausch(a)gmail.com>
To: openstack-docs(a)lists.openstack.org
Sent: Sunday, April 12, 2015 9:49:17 PM
Subject: [OpenStack-docs] [install-guide] (not that much) progress with Kilo install on
RHEL/Centos 7
In preparation for the install guide meeting on Tuesday, I would like to
share what I have been able to do so far and what problems I hit. Advice
would be welcome (I'd be happy to discuss that in the meeting):
- There are places where the install guide content should be modified
(flagged with "CONTENT" below). What's the procedure - I file a bug and
immediately provide the fix?
- Other places look like packaging bugs; I am using a Kilo repository for
the Red Hat RDO project that is still work in progress. I think I should
leave such bugs alone for now, since they are likely to go away. Correct?
This is my report. It's based on Matt's version of the install guide
http://docs-draft.openstack.org/92/167692/13/gate/gate-openstack-manuals-tox
-doc-publish-checkbuild/31c1ab2//publish-docs/trunk/install-guide/install/yu
m/content/index.html.
---------------------------
Section 2 Basic environment
---------------------------
openstack-selinux not found in the repositories I am using. On first look,
it seems that there is no need to install it, as rules in
/etc/selinux/targeted/contexts/files/* seem to be the same as on my Juno
installation. So I am brave, plan to watch the audit log and go ahead
without modifying SELinux configs.
CONTENT: The guide lacks info about the firewall rules, except a vague
allusion in Chapter 2 Basic Environment.
Since this is Red Hat with a locked-down firewall, nothing will work without
opening ports for fundamental services (DB, RabbitMQ) and the OpenStack
services.
My NTP server doesn't work (this has nothing to do with OpenStack).
This forum says that NTP needs to be started after DNS (???)
https://forum.zentyal.org/index.php/topic,13045.0.html
In any case, issuing a ``systemctl restart ntpd.service`` fixes the problem,
but how can it be done automatically?
---------------------------------
section 2, Maria DB installation:
---------------------------------
``/usr/bin/mysql_secure_installation: line 379: find_mysql_client: command
not found``
CONTENT: The install guide doesn't say how to answer the questions of this
script.
After setting the root password on the DB, I just hit enter at each
question.
------------------------------------
Section 2, Rabbit MQ installation:
------------------------------------
CONTENT: The guide asks for adding a line to /etc/rabbitmq/rabbitmq.config.
Scratching my head because I don't have that file, but then I see that it
may not always exist. Perhaps this should be made clearer to accommodate
slow thinkers.
-------------------------------
Section 3, Identity concepts
-------------------------------
CONTENT: The diagram showing the process flow confuses me more than it
helps.
--------------------------------
Section 3, install and configure
--------------------------------
``yum install openstack-keystone python-keystoneclient``: dependency
python-cryptography can't be found
After adding this repo (found via internet search):
[npmccallum-python-cryptography]
name=Copr repo for python-cryptography owned by npmccallum
baseurl=https://copr-be.cloud.fedoraproject.org/results/npmccallum/python-cr
yptography/epel-7-$basearch/
skip_if_unavailable=True
gpgcheck=1
gpgkey=https://copr-be.cloud.fedoraproject.org/results/npmccallum/python-cry
ptography/pubkey.gpg
enabled=1
it works.
This looks very much like a packaging error, and I hope it will eventually
go away.
CONTENT (or perhaps not CONTENT): keystone.conf contains "connection =
<None>" rather than the connection string cited in the install guide. This
may be legitimately so, in which case the guide needs to be modified, or a
packaging error.
------------------------------------------------------
Section 3, create the service entity and API endpoints
------------------------------------------------------
CONTENT: ``openstack`` command missing. Found in the package
python-openstackclient.
CONTENT: ``openstack service create --type identity`` gives me:
WARNING: openstackclient.identity.v2_0.service.CreateService The
argument --type is deprecated, use service create --name <service-name> type
instead.
I don't like the openstack client, because its help facility is much
inferior to the one of the separate command line clients. Tough luck, I
guess.
CONTENT: The relevance of the sentence "Also, OpenStack supports multiple
regions for scalability" is not clear to a first time (even n-th time) user.
CONTENT: Why are we using API v2, not v3? Why a separate adminurl port, and
same port for internal and publicurl? Some clarification would help.
CONTENT: I would phrase the note at the end differently, e.g. "You will
create similar endpoints for each of the other services as you install them"
--------------------------------------------
Section 3, Create projects, users, and roles
--------------------------------------------
CONTENT: Rather than saying "project (tenant)", be a bit more explicit e.g.
"project (also named "tenant" in earlier OpenStack releases)"
CONTENT:
# openstack role add --project demo --user demo _member_
ERROR: openstack No role with a name or ID of '_member_' exists.
I fix this by adding the _member_ role first:
# openstack role create _member_
--------------------------------------------
Section 3, verify operation
--------------------------------------------
CONTENT: There is no /etc/keystone/keystone-paste.ini; it's now under
/usr/share/keystone. Not sure yet if this file is supposed to be modified.
It seems that all the Paste/Deploy files are now under /usr/share.
For now, instead of changing paste.ini I just remove the admin token from
keystone.conf.
--------------------------------------------
Section 4, Glance install and configure
--------------------------------------------
ugly message when synching DB:
/usr/lib/python2.7/site-packages/glance/db/sqlalchemy/artifacts.py:20:
DeprecationWarning: The oslo namespace package is deprecated. Please use
oslo_config instead.
Not sure what to do about this.
--------------------------------------------
Section 4, Verify operation
--------------------------------------------
Major problems with glance. I am stuck with problem 3 below.
Problem 1:
~~~~~~~~~~
glance image-create fails. See also Monty Taylor's comments on the docs and
dev mailing lists.
It turns out that I am using glance API v2, set in the rc files:
export OS_IMAGE_API_VERSION=2
Glance v2 requires a quite different workflow to upload images. Setting API
version to 1 for the moment.
Problem 2:
~~~~~~~~~~
It turns out glance is not running. api.log says:
ERROR glance.common.config [-] Unable to load glance-api-keystone
from configuration file /usr/share/glance/glance-api-dist-paste.ini.
Got: ImportError('No module named elasticsearch',)
After pip install elasticsearch, I can start glance.
Still getting a strange warning in api.log:
2015-04-12 17:42:30.267 6789 WARNING oslo_config.cfg [-] Option
"username" from group "keystone_authtoken" is deprecated. Use option
"username" from group "keystone_authtoken".
Problem 3:
~~~~~~~~~~
Trying to upload an image now fails because of wrong credentials???? Haven't
resolved this yet. Any glance request is rejected with
# glance image-list
Invalid OpenStack Identity credentials.
Glance's API log:
2015-04-12 22:31:03.932 9048 DEBUG keystoneclient.session [-] REQ: curl -g
-i -X GET http://kilocontrol:35357 -H "Accept: application/json" -H
"User-Agent: python-keystoneclient" _http_log_request
/usr/lib/python2.7/site-packages/keystoneclient/session.py:195
2015-04-12 22:31:03.935 9048 WARNING
keystoneclient.auth.identity.generic.base [-] Discovering versions from the
identity service failed when creating the password plugin. Attempting to
determine version from URL.
2015-04-12 22:31:03.936 9048 WARNING keystonemiddleware.auth_token [-]
Authorization failed for token
This seems to be related with this DEBUG entry in keystone.log:
keystone.middleware.core [-] Auth token not in the request header. Will not
build auth context. process_request
/usr/lib/python2.7/site-packages/keystone/middleware/core.py:229
I assume a misconfiguration on my side but haven't figured out what it might
be. Need to study the nature of WSGI middleware.
_______________________________________________
OpenStack-docs mailing list
OpenStack-docs(a)lists.openstack.org
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-docs
--
Steve Gordon, RHCE
Sr. Technical Product Manager,
Red Hat Enterprise Linux OpenStack Platform
1:53 p.m.
> openstack-selinux not found in the repositories I am using.
openstack-selinux is generally available for RHEL and CentOS, but not
for Fedora. On Fedora in particular, selinux related issues are
supposed to be reported directly against selinux-policy.
When using RDO Kilo with CentOS 7, the openstack-selinux package comes
from the rdo-juno repository. Note that installing
https://repos.fedorapeople.org/repos/openstack/openstack-kilo/rdo-release...
configures two repositories on your system:
[openstack-juno]
name=OpenStack Juno Repository
baseurl=http://repos.fedorapeople.org/repos/openstack/openstack-juno/epel-7/
enabled=1
skip_if_unavailable=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-RDO-Juno
[openstack-kilo]
name=Temporary OpenStack Kilo new deps
baseurl=http://repos.fedorapeople.org/repos/openstack/openstack-kilo/epel-7/
skip_if_unavailable=0
gpgcheck=0
enabled=1
I notice that the draft Kilo install guide still points at the Juno
packages:
Install the rdo-release-juno package to enable the RDO repository:
# yum install
# http://rdo.fedorapeople.org/openstack-juno/rdo-release-juno.rpm
[from
http://docs-draft.openstack.org/92/167692/13/gate/gate-openstack-manuals-...]
> it seems that there is no need to install it, as rules in
> /etc/selinux/targeted/contexts/files/* seem to be the same as on my Juno
> installation. So I am brave, plan to watch the audit log and go ahead
> without modifying SELinux configs.
As of last week, there were still selinux bugs open against RDO Juno.
I'm not sure what the state of the Kilo packages are at this opint,
but it seems likely that there may be issues there as well.
> My NTP server doesn't work (this has nothing to do with
OpenStack).
> This forum says that NTP needs to be started after DNS (???)
> https://forum.zentyal.org/index.php/topic,13045.0.html
> In any case, issuing a ``systemctl restart ntpd.service`` fixes the problem,
> but how can it be done automatically?
If you're seeing this on a RHEL or Fedora system, you should open a
bug in bugzilla so we can track this issue and maybe come up with an
appropriate solution.
> ------------------------------------
> Section 2, Rabbit MQ installation:
> ------------------------------------
>
> CONTENT: The guide asks for adding a line to /etc/rabbitmq/rabbitmq.config.
> Scratching my head because I don't have that file, but then I see that it
> may not always exist. Perhaps this should be made clearer to accommodate
> slow thinkers.
There's a bug open on that for RHEL:
https://bugzilla.redhat.com/show_bug.cgi?id=1134956
We should probably clone that to RDO as well.
> ``yum install openstack-keystone python-keystoneclient``:
dependency
> python-cryptography can't be found
>
> After adding this repo (found via internet search):
>
> [npmccallum-python-cryptography]
> name=Copr repo for python-cryptography owned by npmccallum
[...]
> This looks very much like a packaging error, and I hope it will eventually
> go away.
You shouldn't require COPR repositories for anything. If you
encounter a repeatable packaging error, make sure to open a bugzilla
so that folks are aware of the issue.
On CentOS 7 right now, I am able to install both python-keystoneclient
and openstack-keystone without any errors, using only the base, RDO,
and EPEL repositories.
> CONTENT: Why are we using API v2, not v3? Why a separate
adminurl port, and
> same port for internal and publicurl? Some clarification would help.
I suspect the answer to all of the above is, "because legacy". v3
support has only recently been showing up in all of the services, and
many folks still aren't familiar with the newer APIs. The
admin/non-admin port separation is another historical oddity that we
have to live with. With Keystone v2, at least, there are some
features only available through the admin api on the admin port.
> Major problems with glance. I am stuck with problem 3 below.
> ERROR glance.common.config [-] Unable to load
glance-api-keystone
> from configuration file /usr/share/glance/glance-api-dist-paste.ini.
> Got: ImportError('No module named elasticsearch',)
There is a known problem that has been corrected in the latest Kilo
packages. There was no corresponding bz filed (via apevec, irc).
> Trying to upload an image now fails because of wrong
credentials???? Haven't
> resolved this yet. Any glance request is rejected with
> # glance image-list
> Invalid OpenStack Identity credentials.
Debugging this will probably require someone looking over your shoulder at your
glance configuration.
--
Lars Kellogg-Stedman <lars(a)redhat.com> | larsks @ {freenode,twitter,github}
Cloud Engineering / OpenStack | http://blog.oddbit.com/
4:30 p.m.
New subject: [Rdo-list] Fwd: [OpenStack-docs] [install-guide] (not that much) progress with Kilo install on RHEL/Centos 7
https://bugzilla.redhat.com/show_bug.cgi?id=1134956
We should probably clone that to RDO as well.
rabbitmq-server comes from EPEL so I've cloned to EPEL7
https://bugzilla.redhat.com/show_bug.cgi?id=1211394
3:14 a.m.
Many thanks for addressing this, Lars (and Steve for raising this to the
RDO list).
A few comments:
- it would seem that I have the wrong environment; my rdo-release.repo
doesn't
contain anything about Kilo. This should explain the packaging problems
I experienced.
- the yum part of the draft install guide has not yet been written and is
pure
Juno right now. It's to write that part that I am trying to install Kilo.
- I will work with my OpenStack docs team mates on the glance problems -
perhaps they will go away when my repo configuration is fixed.
When I hit problems after using the right repositories, I will raise my flag
again, or just file bugs.
Cheers,
Bernd
-----Original Message-----
From: Lars Kellogg-Stedman [mailto:lars@redhat.com]
Sent: Tuesday, April 14, 2015 3:54 AM
To: Steve Gordon
Cc: rdo-list; berndbausch(a)gmail.com
Subject: Re: [Rdo-list] Fwd: [OpenStack-docs] [install-guide] (not that
much) progress with Kilo install on RHEL/Centos 7
> openstack-selinux not found in the repositories I am using.
openstack-selinux is generally available for RHEL and CentOS, but not for
Fedora. On Fedora in particular, selinux related issues are supposed to be
reported directly against selinux-policy.
When using RDO Kilo with CentOS 7, the openstack-selinux package comes from
the rdo-juno repository. Note that installing
https://repos.fedorapeople.org/repos/openstack/openstack-kilo/rdo-release-ki
lo-0.noarch.rpm
configures two repositories on your system:
[openstack-juno]
name=OpenStack Juno Repository
baseurl=http://repos.fedorapeople.org/repos/openstack/openstack-juno/epel-7/
enabled=1
skip_if_unavailable=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-RDO-Juno
[openstack-kilo]
name=Temporary OpenStack Kilo new deps
baseurl=http://repos.fedorapeople.org/repos/openstack/openstack-kilo/epel-7/
skip_if_unavailable=0
gpgcheck=0
enabled=1
I notice that the draft Kilo install guide still points at the Juno
packages:
Install the rdo-release-juno package to enable the RDO repository:
# yum install
#
http://rdo.fedorapeople.org/openstack-juno/rdo-release-juno.rpm
[from
http://docs-draft.openstack.org/92/167692/13/gate/gate-openstack-manuals-tox
-doc-publish-checkbuild/31c1ab2//publish-docs/trunk/install-guide/install/yu
m/content/ch_basic_environment.html#basics-prerequisites]
> it seems that there is no need to install it, as rules in
> /etc/selinux/targeted/contexts/files/* seem to be the same as on my
> Juno installation. So I am brave, plan to watch the audit log and go
> ahead without modifying SELinux configs.
As of last week, there were still selinux bugs open against RDO Juno.
I'm not sure what the state of the Kilo packages are at this opint, but it
seems likely that there may be issues there as well.
> My NTP server doesn't work (this has nothing to do with
OpenStack).
> This forum says that NTP needs to be started after DNS (???)
> https://forum.zentyal.org/index.php/topic,13045.0.html
> In any case, issuing a ``systemctl restart ntpd.service`` fixes the
> problem, but how can it be done automatically?
If you're seeing this on a RHEL or Fedora system, you should open a bug in
bugzilla so we can track this issue and maybe come up with an appropriate
solution.
> ------------------------------------
> Section 2, Rabbit MQ installation:
> ------------------------------------
>
> CONTENT: The guide asks for adding a line to
/etc/rabbitmq/rabbitmq.config.
> Scratching my head because I don't have that file, but then
I see
> that it may not always exist. Perhaps this should be made clearer to
> accommodate slow thinkers.
There's a bug open on that for RHEL:
https://bugzilla.redhat.com/show_bug.cgi?id=1134956
We should probably clone that to RDO as well.
> ``yum install openstack-keystone python-keystoneclient``:
dependency
> python-cryptography can't be found
>
> After adding this repo (found via internet search):
>
> [npmccallum-python-cryptography]
> name=Copr repo for python-cryptography owned by npmccallum
[...]
> This looks very much like a packaging error, and I hope it will
> eventually go away.
You shouldn't require COPR repositories for anything. If you encounter a
repeatable packaging error, make sure to open a bugzilla so that folks are
aware of the issue.
On CentOS 7 right now, I am able to install both python-keystoneclient and
openstack-keystone without any errors, using only the base, RDO, and EPEL
repositories.
> CONTENT: Why are we using API v2, not v3? Why a separate
adminurl
> port, and same port for internal and publicurl? Some clarification would
help.
I suspect the answer to all of the above is, "because legacy". v3 support
has only recently been showing up in all of the services, and many folks
still aren't familiar with the newer APIs. The admin/non-admin port
separation is another historical oddity that we have to live with. With
Keystone v2, at least, there are some features only available through the
admin api on the admin port.
> Major problems with glance. I am stuck with problem 3 below.
> ERROR glance.common.config [-] Unable to load
glance-api-keystone
> from configuration file /usr/share/glance/glance-api-dist-paste.ini.
> Got: ImportError('No module named elasticsearch',)
There is a known problem that has been corrected in the latest Kilo
packages. There was no corresponding bz filed (via apevec, irc).
> Trying to upload an image now fails because of wrong
credentials????
> Haven't resolved this yet. Any glance request is rejected with
> # glance image-list
> Invalid OpenStack Identity credentials.
Debugging this will probably require someone looking over your shoulder at
your glance configuration.
--
Lars Kellogg-Stedman <lars(a)redhat.com> | larsks @ {freenode,twitter,github}
Cloud Engineering / OpenStack | http://blog.oddbit.com/
11:40 p.m.
Who can help installing Kilo on Centos 7? I am trying it out in view of
updating the install guide on docs.openstack.org and have showstopper
problems early in the process.
Thanks to Lars' input I corrected my repositories and got rid of what looked
like packaging errors. I am meeting new problems though and am not sure if
they are due to misconfiguration, or if Kilo still works only in a narrow
setting, or bugs (hard to believe, since I am doing nothing fancy)?
My OS is CentOS Linux release 7.1.1503 (Core), plus epel-release-7-5.
I use these instructions
http://docs-draft.openstack.org/92/167692/13/gate/gate-openstack-manuals-tox
-doc-publish-checkbuild/31c1ab2//publish-docs/trunk/install-guide/install/yu
m with a few changes:
- rdo-release-kilo-0.noarch.rpm instead of the juno rpm
- manually installing, enabling and starting memcached
- manually adding the _member_ role to keystone
----------------------------------------------------------
PROBLEM 1: I am unable to use memcached as token backend
----------------------------------------------------------
In keystone.conf:
[token]
driver=keystone.token.persistence.backends.memcache.Token
An attempt to request a token hangs, either ``openstack token issue`` or
``curl -i -X POST http://kilocontrol:35357/v2.0/tokens ...``. On the server
side, the hang is in the method() call inside
/lib/python2.7/site-packages/keystone/common/wsgi.py. If I use a wrong
password or malformed credentials, I get the expected error message, so that
I assume that the problem occurs after authentication. memcached is running
and accessible, but there is no traffic on its port 11211. I don't know
enough to trace any further.
My workaround is to use a different backend, sql.
----------------------------------------------
Problem 2: glance image-create doesn't work
----------------------------------------------
Using API version 2:
# glance image-create --name "cirros-0.3.3-x86_64" --file
/tmp/images/cirros-0.3.3-x86_64-disk.img --disk-format qcow2
--container-format bare --visibility public --progress
usage: glance [--version] [-d] [-v] [--get-schema] [--timeout TIMEOUT]
...
glance: error: unrecognized arguments: --name --disk-format qcow2
--container-format bare --visibility public
Let's try the help:
# glance help image-create
usage: glance image-create [--property <key=value>] [--file <FILE>]
[--progress]
<unavailable>
Create a new image.
Positional arguments:
<unavailable> Please run with connection parameters set to
retrieve
the schema for generating help for this command
Optional arguments:
--property <key=value>
Arbitrary property to associate with image. May be
used multiple times.
--file <FILE> Local file to save downloaded image data to. If
this
is not specified the image data will be written to
stdout.
--progress Show upload progress bar.
This doesn't look like the image-create I am used to.
Switching to API version 1 (I also replace "--visibility public" with
"--is-public true"):
# glance image-create --name "cirros-0.3.3-x86_64" --file
/tmp/images/cirros-0.3.3-x86_64-disk.img --disk-format qcow2
--container-format bare --is-public true --progress
'Namespace' object has no attribute 'project_domain_name'
In fact, any glance command I try, except help, comes back with this error:
# glance image-list
'Namespace' object has no attribute 'project_domain_name'
The namespace messages appear to come from the message queue. There is
nothing in the glance logs - the problem is on the client side. --debug
doesn't change the output. Meanwhile, I was made aware that a new image
upload workflow exists, but how to make it work with the CLI client is
unclear to me.
Bernd
-----Original Message-----
From: Lars Kellogg-Stedman [mailto:lars@redhat.com]
Sent: Tuesday, April 14, 2015 3:54 AM
To: Steve Gordon
Cc: rdo-list; berndbausch(a)gmail.com
Subject: Re: [Rdo-list] Fwd: [OpenStack-docs] [install-guide] (not that
much) progress with Kilo install on RHEL/Centos 7
> openstack-selinux not found in the repositories I am using.
openstack-selinux is generally available for RHEL and CentOS, but not for
Fedora. On Fedora in particular, selinux related issues are supposed to be
reported directly against selinux-policy.
When using RDO Kilo with CentOS 7, the openstack-selinux package comes from
the rdo-juno repository. Note that installing
https://repos.fedorapeople.org/repos/openstack/openstack-kilo/rdo-release-ki
lo-0.noarch.rpm
configures two repositories on your system:
[openstack-juno]
name=OpenStack Juno Repository
baseurl=http://repos.fedorapeople.org/repos/openstack/openstack-juno/epel-7/
enabled=1
skip_if_unavailable=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-RDO-Juno
[openstack-kilo]
name=Temporary OpenStack Kilo new deps
baseurl=http://repos.fedorapeople.org/repos/openstack/openstack-kilo/epel-7/
skip_if_unavailable=0
gpgcheck=0
enabled=1
I notice that the draft Kilo install guide still points at the Juno
packages:
Install the rdo-release-juno package to enable the RDO repository:
# yum install
#
http://rdo.fedorapeople.org/openstack-juno/rdo-release-juno.rpm
[from
http://docs-draft.openstack.org/92/167692/13/gate/gate-openstack-manuals-tox
-doc-publish-checkbuild/31c1ab2//publish-docs/trunk/install-guide/install/yu
m/content/ch_basic_environment.html#basics-prerequisites]
> it seems that there is no need to install it, as rules in
> /etc/selinux/targeted/contexts/files/* seem to be the same as on my
> Juno installation. So I am brave, plan to watch the audit log and go
> ahead without modifying SELinux configs.
As of last week, there were still selinux bugs open against RDO Juno.
I'm not sure what the state of the Kilo packages are at this opint, but it
seems likely that there may be issues there as well.
> My NTP server doesn't work (this has nothing to do with
OpenStack).
> This forum says that NTP needs to be started after DNS (???)
> https://forum.zentyal.org/index.php/topic,13045.0.html
> In any case, issuing a ``systemctl restart ntpd.service`` fixes the
> problem, but how can it be done automatically?
If you're seeing this on a RHEL or Fedora system, you should open a bug in
bugzilla so we can track this issue and maybe come up with an appropriate
solution.
> ------------------------------------
> Section 2, Rabbit MQ installation:
> ------------------------------------
>
> CONTENT: The guide asks for adding a line to
/etc/rabbitmq/rabbitmq.config.
> Scratching my head because I don't have that file, but then
I see
> that it may not always exist. Perhaps this should be made clearer to
> accommodate slow thinkers.
There's a bug open on that for RHEL:
https://bugzilla.redhat.com/show_bug.cgi?id=1134956
We should probably clone that to RDO as well.
> ``yum install openstack-keystone python-keystoneclient``:
dependency
> python-cryptography can't be found
>
> After adding this repo (found via internet search):
>
> [npmccallum-python-cryptography]
> name=Copr repo for python-cryptography owned by npmccallum
[...]
> This looks very much like a packaging error, and I hope it will
> eventually go away.
You shouldn't require COPR repositories for anything. If you encounter a
repeatable packaging error, make sure to open a bugzilla so that folks are
aware of the issue.
On CentOS 7 right now, I am able to install both python-keystoneclient and
openstack-keystone without any errors, using only the base, RDO, and EPEL
repositories.
> CONTENT: Why are we using API v2, not v3? Why a separate
adminurl
> port, and same port for internal and publicurl? Some clarification would
help.
I suspect the answer to all of the above is, "because legacy". v3 support
has only recently been showing up in all of the services, and many folks
still aren't familiar with the newer APIs. The admin/non-admin port
separation is another historical oddity that we have to live with. With
Keystone v2, at least, there are some features only available through the
admin api on the admin port.
> Major problems with glance. I am stuck with problem 3 below.
> ERROR glance.common.config [-] Unable to load
glance-api-keystone
> from configuration file /usr/share/glance/glance-api-dist-paste.ini.
> Got: ImportError('No module named elasticsearch',)
There is a known problem that has been corrected in the latest Kilo
packages. There was no corresponding bz filed (via apevec, irc).
> Trying to upload an image now fails because of wrong
credentials????
> Haven't resolved this yet. Any glance request is rejected with
> # glance image-list
> Invalid OpenStack Identity credentials.
Debugging this will probably require someone looking over your shoulder at
your glance configuration.
--
Lars Kellogg-Stedman <lars(a)redhat.com> | larsks @ {freenode,twitter,github}
Cloud Engineering / OpenStack | http://blog.oddbit.com/
3:07 a.m.
On 04/16/2015 06:40 AM, Bernd Bausch wrote:
Who can help installing Kilo on Centos 7? I am trying it out in view
of
updating the install guide on docs.openstack.org and have showstopper
problems early in the process.
Bernd, I am already testing with CentOS 7 (stopped after Keystone
yesterday and will continue with Apache2/Memcache for Keystone today). I
will have a look at your Glance issues after completing the necessary
changes in the Keystone section.
Christian.
7 a.m.
On 04/16/2015 06:40 AM, Bernd Bausch wrote:
Problem 2: glance image-create doesn't work
Bernd, do you work with
https://repos.fedorapeople.org/repos/openstack/openstack-kilo/epel-7/?
Then you are still using the old packages (2014.2).
Milestone 3 packages for 2015.1 are available at
https://repos.fedorapeople.org/repos/openstack/openstack-trunk/epel-7/kil....
I do not know if we already have usable RC1 packages, I have not yet
found them.
Christian.
7:23 a.m.
On 04/16/2015 02:00 PM, Christian Berendt wrote:
I do not know if we already have usable RC1 packages, I have not yet
found them.
Ah, Alan mentioned it in an other mail on this list:
---snip---
1. yum install epel-release
2. yum install
http://rdoproject.org/repos/openstack-kilo/rdo-release-kilo.rpm
3. cd /etc/yum.repos.d; wget
http://trunk.rdoproject.org/centos70/latest-RDO-trunk-CI/delorean.repo
---snap---
Christian.
10:43 a.m.
Hi Bernd,
if you are interested we also work on new installer called RDO-Manager.
It is project based on OpenStack's official deployment tool called
TripleO [0].
If you are interested you can have a look to the project's homepage [1]
and follow installation guide [2]
If you have any questions, feel free to contact me, I am happy to help.
[0] TripleO: https://wiki.openstack.org/wiki/TripleO
[1] RDO-Manager Home Page: https://www.rdoproject.org/RDO-Manager
[2] RDO-Manager User Guide:
http://repos.fedorapeople.org/repos/openstack-m/instack-undercloud/html/i...
Cheers
-- Jarda
https://www.rdoproject.org/RDO-Manager
On 16/04/15 06:40, Bernd Bausch wrote:
Who can help installing Kilo on Centos 7? I am trying it out in view
of
updating the install guide on docs.openstack.org and have showstopper
problems early in the process.
Thanks to Lars' input I corrected my repositories and got rid of what looked
like packaging errors. I am meeting new problems though and am not sure if
they are due to misconfiguration, or if Kilo still works only in a narrow
setting, or bugs (hard to believe, since I am doing nothing fancy)?
My OS is CentOS Linux release 7.1.1503 (Core), plus epel-release-7-5.
I use these instructions
http://docs-draft.openstack.org/92/167692/13/gate/gate-openstack-manuals-tox
-doc-publish-checkbuild/31c1ab2//publish-docs/trunk/install-guide/install/yu
m with a few changes:
- rdo-release-kilo-0.noarch.rpm instead of the juno rpm
- manually installing, enabling and starting memcached
- manually adding the _member_ role to keystone
----------------------------------------------------------
PROBLEM 1: I am unable to use memcached as token backend
----------------------------------------------------------
In keystone.conf:
[token]
driver=keystone.token.persistence.backends.memcache.Token
An attempt to request a token hangs, either ``openstack token issue`` or
``curl -i -X POST http://kilocontrol:35357/v2.0/tokens ...``. On the server
side, the hang is in the method() call inside
/lib/python2.7/site-packages/keystone/common/wsgi.py. If I use a wrong
password or malformed credentials, I get the expected error message, so that
I assume that the problem occurs after authentication. memcached is running
and accessible, but there is no traffic on its port 11211. I don't know
enough to trace any further.
My workaround is to use a different backend, sql.
----------------------------------------------
Problem 2: glance image-create doesn't work
----------------------------------------------
Using API version 2:
# glance image-create --name "cirros-0.3.3-x86_64" --file
/tmp/images/cirros-0.3.3-x86_64-disk.img --disk-format qcow2
--container-format bare --visibility public --progress
usage: glance [--version] [-d] [-v] [--get-schema] [--timeout TIMEOUT]
...
glance: error: unrecognized arguments: --name --disk-format qcow2
--container-format bare --visibility public
Let's try the help:
# glance help image-create
usage: glance image-create [--property <key=value>] [--file <FILE>]
[--progress]
<unavailable>
Create a new image.
Positional arguments:
<unavailable> Please run with connection parameters set to
retrieve
the schema for generating help for this command
Optional arguments:
--property <key=value>
Arbitrary property to associate with image. May be
used multiple times.
--file <FILE> Local file to save downloaded image data to. If
this
is not specified the image data will be written to
stdout.
--progress Show upload progress bar.
This doesn't look like the image-create I am used to.
Switching to API version 1 (I also replace "--visibility public" with
"--is-public true"):
# glance image-create --name "cirros-0.3.3-x86_64" --file
/tmp/images/cirros-0.3.3-x86_64-disk.img --disk-format qcow2
--container-format bare --is-public true --progress
'Namespace' object has no attribute 'project_domain_name'
In fact, any glance command I try, except help, comes back with this error:
# glance image-list
'Namespace' object has no attribute 'project_domain_name'
The namespace messages appear to come from the message queue. There is
nothing in the glance logs - the problem is on the client side. --debug
doesn't change the output. Meanwhile, I was made aware that a new image
upload workflow exists, but how to make it work with the CLI client is
unclear to me.
Bernd
-----Original Message-----
From: Lars Kellogg-Stedman [mailto:lars@redhat.com]
Sent: Tuesday, April 14, 2015 3:54 AM
To: Steve Gordon
Cc: rdo-list; berndbausch(a)gmail.com
Subject: Re: [Rdo-list] Fwd: [OpenStack-docs] [install-guide] (not that
much) progress with Kilo install on RHEL/Centos 7
>> openstack-selinux not found in the repositories I am using.
openstack-selinux is generally available for RHEL and CentOS, but not for
Fedora. On Fedora in particular, selinux related issues are supposed to be
reported directly against selinux-policy.
When using RDO Kilo with CentOS 7, the openstack-selinux package comes from
the rdo-juno repository. Note that installing
https://repos.fedorapeople.org/repos/openstack/openstack-kilo/rdo-release-ki
lo-0.noarch.rpm
configures two repositories on your system:
[openstack-juno]
name=OpenStack Juno Repository
baseurl=http://repos.fedorapeople.org/repos/openstack/openstack-juno/epel-7/
enabled=1
skip_if_unavailable=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-RDO-Juno
[openstack-kilo]
name=Temporary OpenStack Kilo new deps
baseurl=http://repos.fedorapeople.org/repos/openstack/openstack-kilo/epel-7/
skip_if_unavailable=0
gpgcheck=0
enabled=1
I notice that the draft Kilo install guide still points at the Juno
packages:
> Install the rdo-release-juno package to enable the RDO repository:
>
> # yum install
> #
> http://rdo.fedorapeople.org/openstack-juno/rdo-release-juno.rpm
[from
http://docs-draft.openstack.org/92/167692/13/gate/gate-openstack-manuals-tox
-doc-publish-checkbuild/31c1ab2//publish-docs/trunk/install-guide/install/yu
m/content/ch_basic_environment.html#basics-prerequisites]
>> it seems that there is no need to install it, as rules in
>> /etc/selinux/targeted/contexts/files/* seem to be the same as on my
>> Juno installation. So I am brave, plan to watch the audit log and go
>> ahead without modifying SELinux configs.
As of last week, there were still selinux bugs open against RDO Juno.
I'm not sure what the state of the Kilo packages are at this opint, but it
seems likely that there may be issues there as well.
>> My NTP server doesn't work (this has nothing to do with OpenStack).
>> This forum says that NTP needs to be started after DNS (???)
>> https://forum.zentyal.org/index.php/topic,13045.0.html
>> In any case, issuing a ``systemctl restart ntpd.service`` fixes the
>> problem, but how can it be done automatically?
If you're seeing this on a RHEL or Fedora system, you should open a bug in
bugzilla so we can track this issue and maybe come up with an appropriate
solution.
>> ------------------------------------
>> Section 2, Rabbit MQ installation:
>> ------------------------------------
>>
>> CONTENT: The guide asks for adding a line to
/etc/rabbitmq/rabbitmq.config.
>> Scratching my head because I don't have that file, but then I see
>> that it may not always exist. Perhaps this should be made clearer to
>> accommodate slow thinkers.
There's a bug open on that for RHEL:
https://bugzilla.redhat.com/show_bug.cgi?id=1134956
We should probably clone that to RDO as well.
>> ``yum install openstack-keystone python-keystoneclient``: dependency
>> python-cryptography can't be found
>>
>> After adding this repo (found via internet search):
>>
>> [npmccallum-python-cryptography]
>> name=Copr repo for python-cryptography owned by npmccallum
> [...]
>> This looks very much like a packaging error, and I hope it will
>> eventually go away.
You shouldn't require COPR repositories for anything. If you encounter a
repeatable packaging error, make sure to open a bugzilla so that folks are
aware of the issue.
On CentOS 7 right now, I am able to install both python-keystoneclient and
openstack-keystone without any errors, using only the base, RDO, and EPEL
repositories.
>> CONTENT: Why are we using API v2, not v3? Why a separate adminurl
>> port, and same port for internal and publicurl? Some clarification would
help.
I suspect the answer to all of the above is, "because legacy". v3 support
has only recently been showing up in all of the services, and many folks
still aren't familiar with the newer APIs. The admin/non-admin port
separation is another historical oddity that we have to live with. With
Keystone v2, at least, there are some features only available through the
admin api on the admin port.
>> Major problems with glance. I am stuck with problem 3 below.
>> ERROR glance.common.config [-] Unable to load glance-api-keystone
>> from configuration file /usr/share/glance/glance-api-dist-paste.ini.
>> Got: ImportError('No module named elasticsearch',)
There is a known problem that has been corrected in the latest Kilo
packages. There was no corresponding bz filed (via apevec, irc).
>> Trying to upload an image now fails because of wrong credentials????
>> Haven't resolved this yet. Any glance request is rejected with
>> # glance image-list
>> Invalid OpenStack Identity credentials.
Debugging this will probably require someone looking over your shoulder at
your glance configuration.
--
Lars Kellogg-Stedman <lars(a)redhat.com> | larsks @ {freenode,twitter,github}
Cloud Engineering / OpenStack | http://blog.oddbit.com/
_______________________________________________
Rdo-list mailing list
Rdo-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/rdo-list
To unsubscribe: rdo-list-unsubscribe(a)redhat.com
10:48 a.m.
On 04/16/2015 05:43 PM, Jaromir Coufal wrote:
If you are interested you can have a look to the project's
homepage [1]
and follow installation guide [2]
Thanks for pointing to this guide. We are working on the official
OpenStack Installation Guide at the moment. This is a manual step by
step installation, we do not use distribution specific installers there.
http://docs.openstack.org/juno/install-guide/install/yum/content/
Christian.
11:35 a.m.
----------------------------------------------------------
PROBLEM 1: I am unable to use memcached as token backend
----------------------------------------------------------
In keystone.conf:
[token]
driver=keystone.token.persistence.backends.memcache.Token
An attempt to request a token hangs, either ``openstack token issue`` or
``curl -i -X POST http://kilocontrol:35357/v2.0/tokens ...``. On the server
side, the hang is in the method() call inside
This appears to be an selinux issue:
# audit2allow -a
#============= keystone_t ==============
allow keystone_t memcache_port_t:tcp_socket name_connect;
If I put selinux in permissive mode, I am able to successfully use the
memcache driver.
----------------------------------------------
Problem 2: glance image-create doesn't work
----------------------------------------------
Using API version 2:
# glance image-create --name "cirros-0.3.3-x86_64" --file
/tmp/images/cirros-0.3.3-x86_64-disk.img --disk-format qcow2
--container-format bare --visibility public --progress
usage: glance [--version] [-d] [-v] [--get-schema] [--timeout TIMEOUT]
...
glance: error: unrecognized arguments: --name --disk-format qcow2
--container-format bare --visibility public
I am not able to reproduce your problem. By default, the glance
client operates with API version 1, so you would use the '--is-public'
parameter:
glance image-create --name cirros-public \
--file cirros-0.3.3-x86_64-disk.img --disk-format qcow2 \
--container-format bare --is-public True
If you use version 2 of the API, '--is-public' is replaced with
'--visibility':
glance --os-image-api-version=2 image-create --name cirros-public \
--file cirros-0.3.3-x86_64-disk.img --disk-format qcow2 \
--container-format bare --visibility public
Both of these commands worked successfully for me.
--
Lars Kellogg-Stedman <lars(a)redhat.com> | larsks @ {freenode,twitter,github}
Cloud Engineering / OpenStack | http://blog.oddbit.com/
2:29 p.m.
New subject: [Rdo-list] Fwd: [OpenStack-docs] [install-guide] (not that much) progress with Kilo install on RHEL/Centos 7
I forget which thread we're on now, but apparently the glance client/server
(and associated workflow for images) changed between kilo-2 and kilo-3. We
need to address this in the installation guide (and probably every other
piece of documentation)... once I can figure out how it works now because
people like to make significant changes without documenting them and the
client help is useless.
On Thu, Apr 16, 2015 at 11:35 AM, Lars Kellogg-Stedman <lars(a)redhat.com>
wrote:
> ----------------------------------------------------------
> PROBLEM 1: I am unable to use memcached as token backend
> ----------------------------------------------------------
>
> In keystone.conf:
>
> [token]
> driver=keystone.token.persistence.backends.memcache.Token
>
> An attempt to request a token hangs, either ``openstack token issue`` or
> ``curl -i -X POST http://kilocontrol:35357/v2.0/tokens ...``. On the
server
> side, the hang is in the method() call inside
This appears to be an selinux issue:
# audit2allow -a
#============= keystone_t ==============
allow keystone_t memcache_port_t:tcp_socket name_connect;
If I put selinux in permissive mode, I am able to successfully use the
memcache driver.
> ----------------------------------------------
> Problem 2: glance image-create doesn't work
> ----------------------------------------------
>
> Using API version 2:
>
> # glance image-create --name "cirros-0.3.3-x86_64" --file
> /tmp/images/cirros-0.3.3-x86_64-disk.img --disk-format qcow2
> --container-format bare --visibility public --progress
> usage: glance [--version] [-d] [-v] [--get-schema] [--timeout
TIMEOUT]
> ...
> glance: error: unrecognized arguments: --name --disk-format qcow2
> --container-format bare --visibility public
I am not able to reproduce your problem. By default, the glance
client operates with API version 1, so you would use the '--is-public'
parameter:
glance image-create --name cirros-public \
--file cirros-0.3.3-x86_64-disk.img --disk-format qcow2 \
--container-format bare --is-public True
If you use version 2 of the API, '--is-public' is replaced with
'--visibility':
glance --os-image-api-version=2 image-create --name cirros-public \
--file cirros-0.3.3-x86_64-disk.img --disk-format qcow2 \
--container-format bare --visibility public
Both of these commands worked successfully for me.
--
Lars Kellogg-Stedman <lars(a)redhat.com> | larsks @
{freenode,twitter,github}
Cloud Engineering / OpenStack | http://blog.oddbit.com/
_______________________________________________
Rdo-list mailing list
Rdo-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/rdo-list
To unsubscribe: rdo-list-unsubscribe(a)redhat.com
8:03 p.m.
New subject: [Rdo-list] Fwd: [OpenStack-docs] [install-guide] (not that much) progress with Kilo install on RHEL/Centos 7
You might try setting the OS_TENANT_NAME environment variable (in addition
to OS_PROJECT_NAME) and then try the glance image-create command again.
Still investigating further.
On Thu, Apr 16, 2015 at 2:29 PM, Matt Kassawara <mkassawara(a)gmail.com>
wrote:
I forget which thread we're on now, but apparently the glance
client/server (and associated workflow for images) changed between kilo-2
and kilo-3. We need to address this in the installation guide (and probably
every other piece of documentation)... once I can figure out how it works
now because people like to make significant changes without documenting
them and the client help is useless.
On Thu, Apr 16, 2015 at 11:35 AM, Lars Kellogg-Stedman <lars(a)redhat.com>
wrote:
> > ----------------------------------------------------------
> > PROBLEM 1: I am unable to use memcached as token backend
> > ----------------------------------------------------------
> >
> > In keystone.conf:
> >
> > [token]
> > driver=keystone.token.persistence.backends.memcache.Token
> >
> > An attempt to request a token hangs, either ``openstack token issue`` or
> > ``curl -i -X POST http://kilocontrol:35357/v2.0/tokens ...``. On the
> server
> > side, the hang is in the method() call inside
>
> This appears to be an selinux issue:
>
> # audit2allow -a
> #============= keystone_t ==============
> allow keystone_t memcache_port_t:tcp_socket name_connect;
>
> If I put selinux in permissive mode, I am able to successfully use the
> memcache driver.
>
> > ----------------------------------------------
> > Problem 2: glance image-create doesn't work
> > ----------------------------------------------
> >
> > Using API version 2:
> >
> > # glance image-create --name "cirros-0.3.3-x86_64" --file
> > /tmp/images/cirros-0.3.3-x86_64-disk.img --disk-format qcow2
> > --container-format bare --visibility public --progress
> > usage: glance [--version] [-d] [-v] [--get-schema] [--timeout
> TIMEOUT]
> > ...
> > glance: error: unrecognized arguments: --name --disk-format qcow2
> > --container-format bare --visibility public
>
> I am not able to reproduce your problem. By default, the glance
> client operates with API version 1, so you would use the '--is-public'
> parameter:
>
> glance image-create --name cirros-public \
> --file cirros-0.3.3-x86_64-disk.img --disk-format qcow2 \
> --container-format bare --is-public True
>
> If you use version 2 of the API, '--is-public' is replaced with
> '--visibility':
>
> glance --os-image-api-version=2 image-create --name cirros-public \
> --file cirros-0.3.3-x86_64-disk.img --disk-format qcow2 \
> --container-format bare --visibility public
>
> Both of these commands worked successfully for me.
>
> --
> Lars Kellogg-Stedman <lars(a)redhat.com> | larsks @
> {freenode,twitter,github}
> Cloud Engineering / OpenStack | http://blog.oddbit.com/
>
>
> _______________________________________________
> Rdo-list mailing list
> Rdo-list(a)redhat.com
> https://www.redhat.com/mailman/listinfo/rdo-list
>
> To unsubscribe: rdo-list-unsubscribe(a)redhat.com
>
1:40 a.m.
It works!
My repos needed fixing, after which I have:
- a Centos 7 base installation
- epel 7.5
- openstack-kilo
- delorean
With that, my second problem (glance client refusing to cooperate) is gone.
And permissive mode is indeed a workaround for problem 2.
On the way to success, I noticed that openstack-glance doesn't have the
right set of dependencies in the delorean repo. I installed
openstack-glance-api, ...-registry, ...-doc and ...-common manually. Is this
considered a bug or are such wrinkles normal at this stage?
Thanks! I will be back with further problems. Perhaps.
Bernd
-----Original Message-----
From: Lars Kellogg-Stedman [mailto:lars@redhat.com]
Sent: Friday, April 17, 2015 1:35 AM
To: Bernd Bausch
Cc: 'rdo-list'
Subject: Re: [Rdo-list] Fwd: [OpenStack-docs] [install-guide] (not that
much) progress with Kilo install on RHEL/Centos 7
----------------------------------------------------------
PROBLEM 1: I am unable to use memcached as token backend
----------------------------------------------------------
In keystone.conf:
[token]
driver=keystone.token.persistence.backends.memcache.Token
An attempt to request a token hangs, either ``openstack token issue``
or ``curl -i -X POST http://kilocontrol:35357/v2.0/tokens ...``. On
the server side, the hang is in the method() call inside
This appears to be an selinux issue:
# audit2allow -a
#============= keystone_t ==============
allow keystone_t memcache_port_t:tcp_socket name_connect;
If I put selinux in permissive mode, I am able to successfully use the
memcache driver.
----------------------------------------------
Problem 2: glance image-create doesn't work
----------------------------------------------
Using API version 2:
# glance image-create --name "cirros-0.3.3-x86_64" --file
/tmp/images/cirros-0.3.3-x86_64-disk.img --disk-format qcow2
--container-format bare --visibility public --progress
usage: glance [--version] [-d] [-v] [--get-schema] [--timeout TIMEOUT]
...
glance: error: unrecognized arguments: --name --disk-format qcow2
--container-format bare --visibility public
I am not able to reproduce your problem. By default, the glance client
operates with API version 1, so you would use the '--is-public'
parameter:
glance image-create --name cirros-public \
--file cirros-0.3.3-x86_64-disk.img --disk-format qcow2 \
--container-format bare --is-public True
If you use version 2 of the API, '--is-public' is replaced with
'--visibility':
glance --os-image-api-version=2 image-create --name cirros-public \
--file cirros-0.3.3-x86_64-disk.img --disk-format qcow2 \
--container-format bare --visibility public
Both of these commands worked successfully for me.
--
Lars Kellogg-Stedman <lars(a)redhat.com> | larsks @ {freenode,twitter,github}
Cloud Engineering / OpenStack | http://blog.oddbit.com/
1:44 a.m.
On 04/17/2015 08:40 AM, Bernd Bausch wrote:
openstack-glance-api, ...-registry, ...-doc and ...-common manually.
Is this
considered a bug or are such wrinkles normal at this stage?
I proposed a review request to fix this in our docs:
https://review.openstack.org/#/c/174603/
Christian.
3296
days inactive
3300
days old
14 comments
7 participants
participants (7)
-
Alan Pevec -
Bernd Bausch -
Christian Berendt -
Jaromir Coufal -
Lars Kellogg-Stedman -
Matt Kassawara -
Steve Gordon