[rdo-users] Gnocchi Authentication Method

[Abraham A]

This is a question for a best known method to configure authentication.

Which version of Gnocchi are you using

The Gnocchi and related packages installed through YUM and their versions
are the following:

- gnocchi-api.noarch 4.3.2-1.el7
- gnocchi-common.noarch 4.3.2-1.el7
- gnocchi-doc.noarch 4.3.2-1.el7
- gnocchi-metricd.noarch 4.3.2-1.el7
- gnocchi-statsd.noarch 4.3.2-1.el7
- collectd.x86_64 5.8.1-1.el7
- python2-collectd-gnocchi.noarch 1.7.1-1.el7

How to reproduce your problem

The cluster is a:

- One controller node
- Two compute nodes
- Virtual machines instances
- Bare metal instances

OpenStack version Stein installed using PackStack with Telemetry service
enabled and the following projects:

- Collectd
- collectd-gnocchi plugin

And our existing Gnocchi authentication method is keystone.

What is the result that you get

We are collecting data through collected, collectd-gnocchi from our
controller and compute nodes without any issue, using keystone
authentication method:

Gnocchi

[keystone_authtoken]
www_authenticate_uri=http://10.10.10.6:5000/v3
auth_uri=http://10.10.10.6:5000/v3
auth_type=password
auth_version=v3
auth_url=http://10.10.10.6:5000
username=gnocchi
password=somepassword
user_domain_name=Default
project_name=services
project_domain_name=Default

collectd-gnocchi

<Plugin python>
        <Module collectd_gnocchi>
                Auth_Mode keystone
                Auth_Url "http://10.10.10.6:5000"
                Username admin
                Project_Name admin
                Password somepassword
                User_Domain_Name default
                Project_Domain_Name default
                ResourceType controller_node
        </Module>
</Plugin>

The next step is to enable the collection of data through collected,
collectd-gnocchi plugin in virtual machines and bare metal instances but
existing keystone configuration requires us to have the collectd-gnocchi
password in plaint text.

What is result that you expected

What is the best know method to enable our virtual machines and bare metal
instances send data from collected through collectd-gnocchi without
exposing the gnocchi password in plain text?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rdoproject.org/pipermail/users/attachments/20200331/5d76a4ca/attachment.html>