Cloudkitty not authorized to list projects

asked 2020-05-29 09:13:54 -0600

apdibbo gravatar image

updated 2020-06-03 04:53:18 -0600

Hi,

I am getting the following error when starting cloudkitty-processor after deploying cloudkitty onto a queens openstack:

2020-05-29 14:03:12.211 4125670 WARNING cloudkitty.storage [-] gnocchi storage backend is deprecated and will be removed in a future release.
2020-05-29 14:03:12.339 4125670 CRITICAL cloudkitty [-] Unhandled error: Forbidden: You are not authorized to perform the requested action: identity:list_projects. (HTTP 403) (Request-ID: req-2cd3711d-6e0d-4861-ab1f-cee196a1a00f)
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty Traceback (most recent call last):
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty   File "/usr/bin/cloudkitty-processor", line 10, in <module>
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty     sys.exit(main())
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty   File "/usr/lib/python2.7/site-packages/cloudkitty/cli/processor.py", line 32, in main
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty     processor.process()
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty   File "/usr/lib/python2.7/site-packages/cloudkitty/orchestrator.py", line 278, in process
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty     self._load_tenant_list()
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty   File "/usr/lib/python2.7/site-packages/cloudkitty/orchestrator.py", line 249, in _load_tenant_list
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty     self._tenants = self.fetcher.get_tenants()
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty   File "/usr/lib/python2.7/site-packages/cloudkitty/tenant_fetcher/keystone.py", line 68, in get_tenants
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty     return self._do_get_tenants(auth_version_mapping)
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty   File "/usr/lib/python2.7/site-packages/cloudkitty/tenant_fetcher/keystone.py", line 74, in _do_get_tenants
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty     tenant_list = getattr(self.admin_ks, tenants_attr).list()
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty   File "/usr/lib/python2.7/site-packages/keystoneclient/v3/projects.py", line 138, in list
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty     **kwargs)
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty   File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 75, in func
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty     return f(*args, **new_kwargs)
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty   File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 397, in list
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty     self.collection_key)
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty   File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 125, in _list
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty     resp, body = self.client.get(url, **kwargs)
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty   File "/usr/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 304, in get
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty     return self.request(url, 'GET', **kwargs)
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty   File "/usr/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 463, in request
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty     resp = super(LegacyJsonAdapter, self).request(*args, **kwargs)
2020-05-29 14:03:12.339 4125670 ERROR cloudkitty   File "/usr/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 189, in request
2020-05-29 14:03:12.339 ...
(more)
edit retag flag offensive close merge delete

Comments

I'd make sure that all the settings in the ks_auth section are correct. Also check for messages in the keystone log.

One detail that's often incorrect is the capitalization of domain default/Default. Lower-case might be the domain ID, upper-case the domain name. Or perhaps vice-versa.

Bernd Bausch gravatar imageBernd Bausch ( 2020-05-31 20:01:29 -0600 )edit

You can test the settings with openstack token issue after initializing the OS_... environment variables with these values.

Bernd Bausch gravatar imageBernd Bausch ( 2020-05-31 20:03:38 -0600 )edit

Yeah, when I use the same values I can issue a token and list projects but still doesnt work in cloudkitty, any ideas?

apdibbo gravatar imageapdibbo ( 2020-06-01 05:27:28 -0600 )edit

Anything in the Keystone log?

Bernd Bausch gravatar imageBernd Bausch ( 2020-06-01 07:42:40 -0600 )edit

Added extract from keystone log to end of original post

apdibbo gravatar imageapdibbo ( 2020-06-01 08:50:32 -0600 )edit