Ask Your Question
0

Launch Instance, nova-conductor ACCESS_REFUSED

asked 2019-06-23 06:01:57 -0500

brainheadz gravatar image

updated 2019-06-23 11:45:56 -0500

Hello everyone,

I am getting following error when I try to launch a instance:

# /var/log/nova/nova-conductor.log
ERROR oslo_messaging.rpc.server AccessRefused: (0, 0): (403) ACCESS_REFUSED - Login was refused using authentication mechanism AMQPLAIN. For details see the broker logfile.

I followed the https://docs.openstack.org/install-guide/ (Installation Guide) and did the https://docs.openstack.org/install-guide/openstack-services.html#minimal-deployment-for-stein (Minimal Deployment for Stein).

This is just a test-setup and nova, keystone, glance, neutron, placement are running on the same machine.

After finishing the Installation Guide I went on with https://docs.openstack.org/install-guide/launch-instance-provider.html (Launch Instance Provider) but the instance creation got stuck and I think it's related to the error above.

My System:

➜ root@horizon /root # cat /etc/centos-release
CentOS Linux release 7.6.1810 (Core)

➜ root@horizon /root # openstack --version
openstack 3.18.0

If I restart the openstack-nova-conductor service it connects to rabbit an the connection ist established.

➜ root@horizon /root # systemctl restart openstack-nova-conductor
➜ root@horizon /root # systemctl status openstack-nova-conductor
● openstack-nova-conductor.service - OpenStack Nova Conductor Server
   Loaded: loaded (/usr/lib/systemd/system/openstack-nova-conductor.service; enabled; vendor preset: disabled)
   Active: active (running) since Sun 2019-06-23 12:34:20 CEST; 46s ago
 Main PID: 28512 (nova-conductor)
    Tasks: 3
   CGroup: /system.slice/openstack-nova-conductor.service
           ├─28512 /usr/bin/python2 /usr/bin/nova-conductor
           ├─28525 /usr/bin/python2 /usr/bin/nova-conductor
           └─28526 /usr/bin/python2 /usr/bin/nova-conductor

Jun 23 12:34:08 horizon.aurora.local systemd[1]: Starting OpenStack Nova Conductor Server...
Jun 23 12:34:20 horizon.aurora.local systemd[1]: Started OpenStack Nova Conductor Server.

Output of the logfile:

# /var/log/rabbitmq/rabbit@horizon.log
=INFO REPORT==== 23-Jun-2019::12:34:21 ===
accepting AMQP connection <0.1031.0> (10.0.0.5:46342 -> 10.0.0.5:5672)

=INFO REPORT==== 23-Jun-2019::12:34:22 ===
Connection <0.1031.0> (10.0.0.5:46342 -> 10.0.0.5:5672) has a client-provided name: nova-conductor:28525:d9a97e37-ba7b-4eeb-b9d1-0a8a82cb1e48

=INFO REPORT==== 23-Jun-2019::12:34:22 ===
connection <0.1031.0> (10.0.0.5:46342 -> 10.0.0.5:5672 - nova-conductor:28525:d9a97e37-ba7b-4eeb-b9d1-0a8a82cb1e48): user 'openstack' authenticated and granted access to vhost '/'

=INFO REPORT==== 23-Jun-2019::12:34:22 ===
accepting AMQP connection <0.1049.0> (10.0.0.5:46344 -> 10.0.0.5:5672)

=INFO REPORT==== 23-Jun-2019::12:34:22 ===
Connection <0.1049.0> (10.0.0.5:46344 -> 10.0.0.5:5672) has a client-provided name: nova-conductor:28526:48c254f4-7aa5-4ac4-9a97-e3de5e854f70

=INFO REPORT==== 23-Jun-2019::12:34:22 ===
connection <0.1049.0> (10.0.0.5:46344 -> 10.0.0.5:5672 - nova-conductor:28526:48c254f4-7aa5-4ac4-9a97-e3de5e854f70): user 'openstack' authenticated and granted access to vhost '/'

=INFO REPORT==== 23-Jun-2019::12:34:22 ===
accepting AMQP connection <0.1067.0> (10.0.0.5:46346 -> 10.0.0.5:5672)

=INFO REPORT==== 23-Jun-2019::12:34:22 ===
Connection <0.1067.0> (10.0.0.5:46346 -> 10.0.0.5:5672) has a client-provided name: nova-conductor:28525:8767e474-d319-4acb-951c-612cc4b7148e

=INFO REPORT==== 23-Jun-2019::12:34:22 ===
connection <0.1067.0> (10.0.0.5:46346 -> 10.0.0.5:5672 ...
(more)
edit retag flag offensive close merge delete

1 answer

Sort by » oldest newest most voted
0

answered 2019-06-23 12:34:47 -0500

brainheadz gravatar image

Problem is solved. Thanks to https://ask.openstack.org/en/question/114594/instance-stuck-in-build-amqplain-login-refused-user-openstack-invalid-credentials/ (this) question. But I want to provide a more detailed answer:

The transport_url in the nova_api database was not correct. I must have overseen that while investigating the error.

I think I misstyped it during the installation process and changed/corrected it later. But the transport_url in the database was not updated.

You can verfiy it with a oneliner:

I've used nova as username to login to the database.

➜ root@horizon /root # mysql -unova -p nova_api -e "select id,transport_url from cell_mappings where transport_url='$(grep transport_url /etc/nova/nova.conf | grep -o rabbit.*$)';"

or step by step for manual comparsion:

➜ root@horizon /root # grep transport_url /etc/nova/nova.conf | grep -o rabbit.*$
rabbit://openstack:RABBIT_PASS@horizon.aurora.local

➜ root@horizon /root # mysql -unova -p nova_api
Enter password:

MariaDB [nova_api]> select id,transport_url from cell_mappings;
+----+------------------------------------------------------+
| id | transport_url                                        |
+----+------------------------------------------------------+
|  1 | none:///                                             |
|  2 | rabbit://openstack:RABBIT_PASS@horizon.aurora.local |
+----+------------------------------------------------------+
2 rows in set (0.001 sec)

MariaDB [nova_api]>

In my case the passwords were different and I updated the transport_url by hand:

MariaDB [nova_api]> update cell_mappings set transport_url="rabbit://openstack:RABBIT_PASS@horizon.aurora.local" where id=2;

My last question is:

Is there a command which updates the transport_url in the nova_api database and why and when are some nova services using the credentials of nova.conf and some the one provided by the database?

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Get to know Ask OpenStack

Resources for moderators

Question Tools

1 follower

Stats

Asked: 2019-06-23 06:01:57 -0500

Seen: 31 times

Last updated: Jun 23