Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Gnocchi - Keystone Unable to Validate Token

I am trying to set up Ceilometer with Gnocchi running Ocata RDO on RHEL7. Gnocchi has been installed and configured. However, after starting the Gnocchi api and metricd, I keep getting an error when attempting to test Gnicchi. When I run gnocchi metric list, I get the following error:

[~]# gnocchi metric list
{"message": "The server is currently unavailable. Please try again at a later time.<br /><br />\n\n\n", "code": "503 Service Unavailable", "title": "Service Unavailable"} (HTTP 503)

At the same time, I get the following error from /etc/var/log/gnocchi/gnocchi.log:

2017-10-27 00:32:27.241 3231 WARNING keystonemiddleware.auth_token [-] Identity response: {"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}
2017-10-27 00:32:27.242 3231 CRITICAL keystonemiddleware.auth_token [-] Unable to validate token: Identity server rejected authorization necessary to fetch token data

I also get the following from stderr on gnocchi-api:

[~]# gnocchi-api -p 8041 -b 0.0.0.0
Option "verbose" from group "DEFAULT" is deprecated for removal.  Its value may be silently ignored in the future.
********************************************************************************
STARTING test server gnocchi.rest.app.build_wsgi_app
Available at http://gcp-openstack:8041/
DANGER! For testing only, do not use in production
********************************************************************************
10.9.47.55 - - [26/Oct/2017 23:32:21] "GET /v1/metric HTTP/1.1" 503 170

The [keystone_authtoken] section in my /etc/gnocchi/gnocchi.conf is as follows:

[keystone_authtoken]
auth_type = password
auth_url = http://controller:5000/v3
project_domain_name = Default
user_domain_name = Default
project_name = service
username = gnocchi
password = P@ssw0rd
interface = internalURL
region_name = RegionOne

Does anyone have any suggestions for troubleshooting this issue? I have already sourced admin-openrc before running the Gnocchi client. So, I am not sure why I am receiving this message. My admin-openrc is as follows:

[~]# cat admin-openrc 
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=admin_P@ssw0rd
export OS_AUTH_URL=http://controller:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
export OS_AUTH_TYPE=password

Are there any other environment variables I am supposed to be setting?

Gnocchi - Keystone Unable to Validate Token

I am trying to set up Ceilometer with Gnocchi running Ocata RDO on RHEL7. Gnocchi has been installed and configured. However, after starting the Gnocchi api and metricd, I keep getting an error when attempting to test Gnicchi. When I run gnocchi metric list, I get the following error:

[~]# gnocchi metric list
{"message": "The server is currently unavailable. Please try again at a later time.<br /><br />\n\n\n", "code": "503 Service Unavailable", "title": "Service Unavailable"} (HTTP 503)

At the same time, I get the following error from /etc/var/log/gnocchi/gnocchi.log:

2017-10-27 00:32:27.241 3231 WARNING keystonemiddleware.auth_token [-] Identity response: {"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}
2017-10-27 00:32:27.242 3231 CRITICAL keystonemiddleware.auth_token [-] Unable to validate token: Identity server rejected authorization necessary to fetch token data

I also get the following from stderr on gnocchi-api:

[~]# gnocchi-api -p 8041 -b 0.0.0.0
Option "verbose" from group "DEFAULT" is deprecated for removal.  Its value may be silently ignored in the future.
********************************************************************************
STARTING test server gnocchi.rest.app.build_wsgi_app
Available at http://gcp-openstack:8041/
DANGER! For testing only, do not use in production
********************************************************************************
10.9.47.55 - - [26/Oct/2017 23:32:21] "GET /v1/metric HTTP/1.1" 503 170

The [keystone_authtoken] section in my /etc/gnocchi/gnocchi.conf is as follows:

[keystone_authtoken]
auth_type = password
auth_url = http://controller:5000/v3
project_domain_name = Default
user_domain_name = Default
project_name = service
username = gnocchi
password = P@ssw0rd
interface = internalURL
region_name = RegionOne

Does anyone have any suggestions for troubleshooting this issue? I have already sourced admin-openrc before running the Gnocchi client. So, I am not sure why I am receiving this message. My admin-openrc is as follows:

[~]# cat admin-openrc 
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=admin_P@ssw0rd
export OS_AUTH_URL=http://controller:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
export OS_AUTH_TYPE=password

Are there any other environment variables I am supposed to be setting?

Update: I also see the following in the gnocchi.log when starting gnocchi-api:

2017-10-31 13:25:09.843 96717 WARNING keystonemiddleware._common.config [-] The option "__file__" in conf is not known to auth_token
2017-10-31 13:25:09.843 96717 WARNING keystonemiddleware._common.config [-] The option "configkey" in conf is not known to auth_token
2017-10-31 13:25:09.844 96717 WARNING keystonemiddleware._common.config [-] The option "here" in conf is not known to auth_token
2017-10-31 13:25:09.847 96717 WARNING keystonemiddleware.auth_token [-] AuthToken middleware is set with keystone_authtoken.service_token_roles_required set to False. This is backwards compatible but deprecated behaviour. Please set this to True.
2017-10-31 13:25:09.852 96717 WARNING keystonemiddleware.auth_token [-] Configuring auth_uri to point to the public identity endpoint is required; clients may not be able to authenticate against an admin endpoint