nova list报未经授权错误

本帖最后由 onelovetom 于 2017-3-10 23:07 编辑

keystone 10.11.101.4
glance 10.11.101.5
nova 10.11.101.6
在nova上执行：nova list
报ERROR: Unauthorized (HTTP 401）       下面是debug信息。

root@kapi:~# nova --debug list

REQ: curl -i 'http://10.11.101.4:5000/v2.0/tokens' -X POST -H "Content-Type: application/json" -H "Accept: application/json" -H "User-Agent: python-novaclient" -d '{"auth": {"tenantName": "serviceTenant", "passwordCredentials": {"username": "service_admin", "password": "service_pass"}}}'

New session created for: (http://10.11.101.4:5000)
INFO (connectionpool:264) Starting new HTTP connection (1): 10.11.101.4
DEBUG (connectionpool:395) Setting read timeout to 600.0
DEBUG (connectionpool:435) "POST /v2.0/tokens HTTP/1.1" 200 1508
RESP: [200] CaseInsensitiveDict({'date': 'Fri, 10 Mar 2017 14:08:50 GMT', 'vary': 'X-Auth-Token', 'content-length': '1508', 'content-type': 'application/json', 'x-distribution': 'Ubuntu'})
RESP BODY: {"access": {"token": {"issued_at": "2017-03-10T14:08:50.285282", "expires": "2017-03-10T15:08:50Z", "id": "67a5d4a2b7ed40e8a9ccb340e96bff41", "tenant": {"description": "service tenant", "enabled": true, "id": "cfb92f7692464dee8761b307d6f208c8", "name": "serviceTenant"}}, "serviceCatalog": [{"endpoints": [{"adminURL": "http://10.11.101.5:9292/v2", "region": "RegionOne", "internalURL": "http://10.11.101.5:9292/v2", "id": "316ee67c8dfc474ab4841e003d6d80b3", "publicURL": "http://10.11.101.5:9292/v2"}], "endpoints_links": [], "type": "image", "name": "glance"}, {"endpoints": [{"adminURL": "http://10.11.101.6:8774/v2/cfb92f7692464dee8761b307d6f208c8", "region": "RegionOne", "internalURL": "http://10.11.101.6:8774/v2/cfb92f7692464dee8761b307d6f208c8", "id": "69f774c8f2c74060bfb16534881d854b", "publicURL": "http://10.11.101.6:8774/v2/cfb92f7692464dee8761b307d6f208c8"}], "endpoints_links": [], "type": "compute", "name": "nova"}, {"endpoints": [{"adminURL": "http://10.11.101.4:35357/v2.0", "region": "RegionOne", "internalURL": "http://10.11.101.4:5000/v2.0", "id": "95ab1e4708664441a920b8ec77de5e49", "publicURL": "http://10.11.101.4:5000/v2.0"}], "endpoints_links": [], "type": "identity", "name": "keystone"}], "user": {"username": "service_admin", "roles_links": [], "id": "cb81cd2eb7fa4a2882b9a48042a83405", "roles": [{"name": "admin"}, {"name": "_member_"}], "name": "service_admin"}, "metadata": {"is_admin": 0, "roles": ["58fe65fb73fa4c88969f4092818ee883", "9fe2ff9ee4384b1894a90878d3e92bab"]}}}

REQ: curl -i 'http://10.11.101.6:8774/v2/cfb92f7692464dee8761b307d6f208c8/servers/detail' -X GET -H "X-Auth-Project-Id: serviceTenant" -H "User-Agent: python-novaclient" -H "Accept: application/json" -H "X-Auth-Token: 67a5d4a2b7ed40e8a9ccb340e96bff41"

New session created for: (http://10.11.101.6:8774)
INFO (connectionpool:264) Starting new HTTP connection (1): 10.11.101.6
DEBUG (connectionpool:395) Setting read timeout to 600.0
DEBUG (connectionpool:435) "GET /v2/cfb92f7692464dee8761b307d6f208c8/servers/detail HTTP/1.1" 401 23
RESP: [401] CaseInsensitiveDict({'date': 'Fri, 10 Mar 2017 14:08:53 GMT', 'content-length': '23', 'content-type': 'text/plain', 'www-authenticate': "Keystone uri='http://10.11.101.4:5000/v2.0'"})
RESP BODY: Authentication required

REQ: curl -i 'http://10.11.101.4:5000/v2.0/tokens' -X POST -H "Content-Type: application/json" -H "Accept: application/json" -H "User-Agent: python-novaclient" -d '{"auth": {"passwordCredentials": {"username": "service_admin", "password": "service_pass"}, "tenantId": "cfb92f7692464dee8761b307d6f208c8"}}'

New session created for: (http://10.11.101.4:5000)
INFO (connectionpool:264) Starting new HTTP connection (1): 10.11.101.4
DEBUG (connectionpool:395) Setting read timeout to 600.0
DEBUG (connectionpool:435) "POST /v2.0/tokens HTTP/1.1" 200 1508
RESP: [200] CaseInsensitiveDict({'date': 'Fri, 10 Mar 2017 14:08:54 GMT', 'vary': 'X-Auth-Token', 'content-length': '1508', 'content-type': 'application/json', 'x-distribution': 'Ubuntu'})
RESP BODY: {"access": {"token": {"issued_at": "2017-03-10T14:08:54.136815", "expires": "2017-03-10T15:08:54Z", "id": "a38d9b07a93f4a0a9e88456f02c8132d", "tenant": {"description": "service tenant", "enabled": true, "id": "cfb92f7692464dee8761b307d6f208c8", "name": "serviceTenant"}}, "serviceCatalog": [{"endpoints": [{"adminURL": "http://10.11.101.5:9292/v2", "region": "RegionOne", "internalURL": "http://10.11.101.5:9292/v2", "id": "316ee67c8dfc474ab4841e003d6d80b3", "publicURL": "http://10.11.101.5:9292/v2"}], "endpoints_links": [], "type": "image", "name": "glance"}, {"endpoints": [{"adminURL": "http://10.11.101.6:8774/v2/cfb92f7692464dee8761b307d6f208c8", "region": "RegionOne", "internalURL": "http://10.11.101.6:8774/v2/cfb92f7692464dee8761b307d6f208c8", "id": "69f774c8f2c74060bfb16534881d854b", "publicURL": "http://10.11.101.6:8774/v2/cfb92f7692464dee8761b307d6f208c8"}], "endpoints_links": [], "type": "compute", "name": "nova"}, {"endpoints": [{"adminURL": "http://10.11.101.4:35357/v2.0", "region": "RegionOne", "internalURL": "http://10.11.101.4:5000/v2.0", "id": "95ab1e4708664441a920b8ec77de5e49", "publicURL": "http://10.11.101.4:5000/v2.0"}], "endpoints_links": [], "type": "identity", "name": "keystone"}], "user": {"username": "service_admin", "roles_links": [], "id": "cb81cd2eb7fa4a2882b9a48042a83405", "roles": [{"name": "admin"}, {"name": "_member_"}], "name": "service_admin"}, "metadata": {"is_admin": 0, "roles": ["58fe65fb73fa4c88969f4092818ee883", "9fe2ff9ee4384b1894a90878d3e92bab"]}}}

REQ: curl -i 'http://10.11.101.6:8774/v2/cfb92f7692464dee8761b307d6f208c8/servers/detail' -X GET -H "X-Auth-Project-Id: serviceTenant" -H "User-Agent: python-novaclient" -H "Accept: application/json" -H "X-Auth-Token: a38d9b07a93f4a0a9e88456f02c8132d"

New session created for: (http://10.11.101.6:8774)
INFO (connectionpool:264) Starting new HTTP connection (1): 10.11.101.6
DEBUG (connectionpool:395) Setting read timeout to 600.0
DEBUG (connectionpool:435) "GET /v2/cfb92f7692464dee8761b307d6f208c8/servers/detail HTTP/1.1" 401 23
RESP: [401] CaseInsensitiveDict({'date': 'Fri, 10 Mar 2017 14:08:57 GMT', 'content-length': '23', 'content-type': 'text/plain', 'www-authenticate': "Keystone uri='http://10.11.101.4:5000/v2.0'"})
RESP BODY: Authentication required

DEBUG (shell:777) Unauthorized (HTTP 401)
Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/novaclient/shell.py", line 774, in main
OpenStackComputeShell().main(map(strutils.safe_decode, sys.argv[1:]))
  File "/usr/lib/python2.7/dist-packages/novaclient/shell.py", line 710, in main
args.func(self.cs, args)
  File "/usr/lib/python2.7/dist-packages/novaclient/v1_1/shell.py", line 1138, in do_list
search_opts=search_opts)
  File "/usr/lib/python2.7/dist-packages/novaclient/v1_1/servers.py", line 587, in list
return self._list("/servers%s%s" % (detail, query_string), "servers")
  File "/usr/lib/python2.7/dist-packages/novaclient/base.py", line 64, in _list
_resp, body = self.api.client.get(url)
  File "/usr/lib/python2.7/dist-packages/novaclient/client.py", line 283, in get
return self._cs_request(url, 'GET', **kwargs)
  File "/usr/lib/python2.7/dist-packages/novaclient/client.py", line 275, in _cs_request
raise e
Unauthorized: Unauthorized (HTTP 401)
ERROR: Unauthorized (HTTP 401)

在keystone(10.11.101.4)上查询用户如下

下面是nova(10.11.101.6)的环境变量

下面是nova上的/etc/nova/nova.conf片段
nova.conf.jpg

/etc/nova/api-paste.ini片段
api.ini.jpg

大牛帮忙看下，为什么提示未经授权，是哪设错了

easthome001 · 发表于 2017-3-11 07:31:50

token生效了吗？
环境变量source一下

例子参考
openstack【juno】入门【keystone篇】九：创建openstack客户端环境变量脚本
http://www.aboutyun.com/forum.php?mod=viewthread&tid=11430

楼主哪个版本的，找到官网对应的配置即可

onelovetom · 发表于 2017-3-11 11:12:13

@easthome001
您好！我已经source过了，env看了环境变量已经有效了啊！我的版本是kilo

我还想问一下：keystone.conf里的token项的driver更改会影响认证吗
我用的driver=keystone.token.backends.sql.Token
书上是driver=keystone.token.persistence.backends.sql.Token，当时keystone报错起不来，所以改了 QQ图片20170311111226.png

desehawk · 发表于 2017-3-11 12:32:21

onelovetom 发表于 2017-3-11 11:12
@easthome001
您好！我已经source过了，env看了环境变量已经有效了啊！我的版本是kilo

别安装kilo了，官网有些链接失效了。安装M版吧
openstack M版中文安装文档

或则Juno版。

about云有提供的相关失效的，配置文件
openstack【juno】入门【准备篇】零：整体介绍
http://www.aboutyun.com/forum.php?mod=viewthread&tid=11722

onelovetom · 发表于 2017-3-11 12:36:16

desehawk 发表于 2017-3-11 12:32
别安装kilo了，官网有些链接失效了。安装M版吧
openstack M版中文安装文档

感谢版主的关心和指导，我是按一本书《openstack部署实践》上做的，结果才做了4分之一，到nova部分就出错做不下去了

easthome001 · 发表于 2017-3-11 14:46:55

onelovetom 发表于 2017-3-11 12:36
感谢版主的关心和指导，我是按一本书《openstack部署实践》上做的，结果才做了4分之一，到nova部分就出错 ...

安装这里是没有问题，后面可能会遇到问题。
这里楼主创建了三个用户。你用的是哪个用户？source的又是哪个用户，尽量上图

onelovetom · 发表于 2017-3-11 18:50:18

谢谢您了，我找出问题所在了，我是参照张子凡先生的《optenstack部署实践》第二版这本书做的
里面单词拼错了，
/etc/nova/api-paste.ini里的，一段 auth-portocol =http 应该是protocol
改回来就正常了

onelovetom · 发表于 2017-3-11 21:33:03

@easthome001 @desehawk
大神再帮我看下啊！我执行：nova  image-list
报错如下：
----------------------------------------------
ERROR: The server has either erred or is incapable of performing the requested operation. (HTTP 500) (Request-ID: req-f35a3fb2-b085-433c-bd03-e68d76113c17)
---------------------------------------------
下面是nova --debug image-list 时nova-api.log日志信息：
》》》》》》》》》
2017-03-11 21:21:17.283 1140 INFO urllib3.connectionpool [-] Starting new HTTP connection (1): 10.11.101.4
2017-03-11 21:21:17.319 1140 ERROR nova.api.openstack [req-97a3bf3c-8e37-4b34-93ce-889a2fe422b0 85815ea17d254bb3884a3f8551db2650 2e2259c41c494ccea7e05d64667ac47a] Caught error: Error communicating with http://192.168.2.226:9292 [Errno 111] ECONNREFUSED
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack Traceback (most recent call last):
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/nova/api/openstack/__init__.py", line 125, in __call__
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    return req.get_response(self.application)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/webob/request.py", line 1320, in send
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    application, catch_exc_info=False)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/webob/request.py", line 1284, in call_application
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    app_iter = application(self.environ, start_response)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/webob/dec.py", line 144, in __call__
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    return resp(environ, start_response)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/keystoneclient/middleware/auth_token.py", line 583, in __call__
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    return self.app(env, start_response)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/webob/dec.py", line 144, in __call__
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    return resp(environ, start_response)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/webob/dec.py", line 144, in __call__
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    return resp(environ, start_response)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/routes/middleware.py", line 131, in __call__
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    response = self.app(environ, start_response)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/webob/dec.py", line 144, in __call__
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    return resp(environ, start_response)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/webob/dec.py", line 130, in __call__
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    resp = self.call_func(req, *args, **self.kwargs)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/webob/dec.py", line 195, in call_func
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    return self.func(req, *args, **kwargs)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/nova/api/openstack/wsgi.py", line 919, in __call__
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    content_type, body, accept)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/nova/api/openstack/wsgi.py", line 985, in _process_stack
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    action_result = self.dispatch(meth, request, action_args)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/nova/api/openstack/wsgi.py", line 1072, in dispatch
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    return method(req=request, **action_args)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/nova/api/openstack/compute/images.py", line 202, in detail
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    **page_params)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/nova/image/glance.py", line 261, in detail
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    for image in images:
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/glanceclient/v1/images.py", line 174, in paginate
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    images = self._list(url, "images")
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/glanceclient/common/base.py", line 53, in _list
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    resp, body = self.api.json_request('GET', url)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/glanceclient/common/http.py", line 268, in json_request
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    resp, body_iter = self._http_request(url, method, **kwargs)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack File "/usr/lib/python2.7/dist-packages/glanceclient/common/http.py", line 237, in _http_request
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack    raise exc.CommunicationError(message=message)
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack CommunicationError: Error communicating with http://192.168.2.226:9292 [Errno 111] ECONNREFUSED
2017-03-11 21:21:17.319 1140 TRACE nova.api.openstack
2017-03-11 21:21:17.324 1140 INFO nova.api.openstack [req-97a3bf3c-8e37-4b34-93ce-889a2fe422b0 85815ea17d254bb3884a3f8551db2650 2e2259c41c494ccea7e05d64667ac47a] http://10.11.101.6:8774/v2/2e225 ... ac47a/images/detail returned with HTTP 500
2017-03-11 21:21:17.328 1140 INFO nova.osapi_compute.wsgi.server [req-97a3bf3c-8e37-4b34-93ce-889a2fe422b0 85815ea17d254bb3884a3f8551db2650 2e2259c41c494ccea7e05d64667ac47a] 10.11.101.6 "GET /v2/2e2259c41c494ccea7e05d64667ac47a/images/detail HTTP/1.1" status: 500 len: 335 time: 0.0499730
》》》》》》》》》》》》》》》》》》
我注意到  连接到http://192.168.2.226:9292去了，这是nova服务机器的外网IP，应该是连接glance机器的IP：http://10.11.101.5:9292
nova:10.11.101.6 192.168.2.226
glance:10.11.101.5  192.168.2.225
endpoint是 QQ图片20170311213330.png

不知道是哪里配置错了，我是kilo版

图文精华

nova list报未经授权错误

已有(7)人评论

最佳新人

活跃会员

热心会员

推广达人

优秀版主

推荐 /2