Ask Your Question

keystone tenant-list fails w/ API version mismatch

asked 2016-12-02 13:45:32 -0500

fortunepickle gravatar image

updated 2016-12-02 13:48:13 -0500

Running keystone tenant-list fails with The resource could not be found. (HTTP 404).

After running the same command with --debug, I've found out that the following curl command is being called:

curl -i -X GET http://<ip>:35357/v3/tenants -H "User-Agent: python-keystoneclient" -H "X-Auth-Token: <token>"

When I directly run the same curl command with /v3/tenants changed to v2.0/tenants I seem to get a correct response:

HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 19:39:52 GMT
Server: Apache/2.4.7 (Ubuntu)
Vary: X-Auth-Token
x-openstack-request-id: req-6ed58a46-49a0-4e4a-8790-dd254985b7d2
Content-Length: 275
Content-Type: application/json

{"tenants_links": [], "tenants": [{"description": "Bootstrap project for initializing the cloud.", "enabled": true, "id": "ee92b7f988134221afd8cd1e8ea16322", "name": "admin"}, {"description": "", "enabled": true, "id": "2238f8fc20f44f59b2e100de3d7b429c", "name": "service"}]}

I've also tried to run the same curl command with v3/projects, getting a correct response as well:

HTTP/1.1 200 OK
Date: Fri, 02 Dec 2016 19:41:28 GMT
Server: Apache/2.4.7 (Ubuntu)
Vary: X-Auth-Token
x-openstack-request-id: req-954c15ff-7aa7-4e85-8f59-a9aa2b178010
Content-Length: 669
Content-Type: application/json

{"links": {"self": "", "previous": null, "next": null}, "projects": [{"is_domain": false, "description": "", "links": {"self": ""}, "enabled": true, "id": "2238f8fc20f44f59b2e100de3d7b429c", "parent_id": "default", "domain_id": "default", "name": "service"}, {"is_domain": false, "description": "Bootstrap project for initializing the cloud.", "links": {"self": ""}, "enabled": true, "id": "ee92b7f988134221afd8cd1e8ea16322", "parent_id": "default", "domain_id": "default", "name": "admin"}]}

My questions are:

  • Why isn't keystone using the correct version?
  • How do I make keystone use the correct version number?

Other info:

  • Keystone client version: 0.7.1
  • Keystone version: 9.2.1
edit retag flag offensive close merge delete



If it's not the correct version, something wasn't done correctly during installation or upgrade. In any case, the keystone client has been deprecated for a few releases and is obsolete in Newton. Have you tried openstack project list?

Bernd Bausch gravatar imageBernd Bausch ( 2016-12-02 17:11:07 -0500 )edit

In case you are running Mitaka, the keystone client should be version2.1.0 or higher. See releasenotes:

Bernd Bausch gravatar imageBernd Bausch ( 2016-12-03 03:56:10 -0500 )edit

Thank you Bernd,

Using 'openstack project list' solved the issue.

Also, I realized I was using a really old version for the keystone client, as you suggested in your second comment (it should have been obvious to me, but, oh well...).

Thank you!

fortunepickle gravatar imagefortunepickle ( 2016-12-04 10:38:38 -0500 )edit

1 answer

Sort by ยป oldest newest most voted

answered 2016-12-03 15:38:29 -0500

volenbovsky gravatar image

Related to comment of Bernd above - you need to use 'openstack' commands for that - Keystone CLI client only supports Identity V2 and it sounds that your OS_IDENTITY_API_VERSION is set to 3. Or AUTH_URL stuff... Check printenv or force particular version (in that case you could force V2 for a test) Maybe your cloud is not configured to use Identity V2 or misconfigured when it comes to that Check: -openstack catalog list -Some V2 /V3 information is in - and I think in case we will POST on / you will get whatever versions are there (both V2 and V3...)

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Get to know Ask OpenStack

Resources for moderators

Question Tools

1 follower


Asked: 2016-12-02 13:45:32 -0500

Seen: 584 times

Last updated: Dec 03 '16