Neutron Metadata Agent on Kilo is misconfigured for authentication parameters (user, password, tenant)

Fix proposed to branch: liberty
Review: https://review.openstack.org/328430

Fix proposed to branch: kilo
Review: https://review.openstack.org/328432

Using the neutron service user and tenant resulted in 401 errors[1]. I confirmed via a manual curl, that the admin user, password, and tenant is required[0]. Not the neutron service user.

[0]
curl -i http://172.22.192.250:35357/v2.0/tokens -X POST -H "User-Agent: python-neutronclient" -d '{"auth": {"tenantName": "admin", "passwordCredentials": {"username": "admin", "password": "99a1b1ff0f8ce
root@infra-node4_neutron_agents_container-644e8f83:/usr/local/lib/python2.7/dist-packages/oslo_messaging/_drivers# curl -i http://172.22.192.250:35357/v2.0/tokens -X POST -H "User-Agent: python-neutronclient" -H "Content-Type: application/json" -d '{"auth": {"tenantName": "admin", "passwordCredentials": {"username"
: "admin", "password": "REDACTED"}}}'
HTTP/1.1 200 OK
Date: Fri, 10 Jun 2016 17:42:25 GMT
Server: Apache
Vary: X-Auth-Token
x-openstack-request-id: req-875f321a-8a01-49c4-a4fd-209061561e2d
Content-Length: 4487
Content-Type: application/json

[1]
root@infra-node4_neutron_agents_container-644e8f83:/usr/local/lib/python2.7/dist-packages/oslo_messaging/_drivers# curl -i http://172.22.192.250:35357/v2.0/tokens -X POST -H "User-Agent: python-neutronclient" -H "Content-Type: application/json" -d '{"auth": {"tenantName": "service", "passwordCredentials": {"username": "neutron", "password": "REDACTED"}}}'
HTTP/1.1 401 Unauthorized
Date: Fri, 10 Jun 2016 17:43:21 GMT
Server: Apache
Vary: X-Auth-Token
x-openstack-request-id: req-513aca0b-ec2a-4603-82e3-286969203b6e
WWW-Authenticate: Keystone uri="http://172.22.192.250:35357"
Content-Length: 114
Content-Type: application/json

{"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}

Paul, you said that the upstream config reference wasn't using the admin URL for Keystone, right? I wonder if we need to change that as a result of this too. Thoughts?

Reviewed: https://review.openstack.org/328430
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible/commit/?id=b271778e16a83aefb0e704a9aca0ef09f405084c
Submitter: Jenkins
Branch: liberty

commit b271778e16a83aefb0e704a9aca0ef09f405084c
Author: Ian Cordasco <email address hidden>
Date: Fri Jun 10 12:35:41 2016 -0500

    Use correct keystone auth parameters

    Neutron Metadata Agent uses the authentication parameters as a fallback
    method in the event that communication with Neutron API over RPC fails.
    In the fallback case, it looks for Keystone v2.0 authentication
    credentials but looks for them under the names:

    - admin_user
    - admin_password
    - admin_tenant_name

    Which can be the service user information. We were previously
    configuring Keystone v3 authentication parameters in this space and this
    causes 400 Bad Request responses from Keystone (since the Agent has null
    values for those config options).

    Further, the metadata agent does not need to use the admin URL to
    authenticate. Instead, it can use the internal URL to retrieve its token
    and then authenticate to Neutron API over HTTP.

    Change-Id: Ib413d3f3f3351bef29b0e68a2cfb96b7f3dff3c3
    Closes-bug: 1591282
    Closes-bug: 1590957

Reviewed: https://review.openstack.org/328432
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible/commit/?id=75deb166c8922f7ceb120d3892ae1ac4fa4702bb
Submitter: Jenkins
Branch: kilo

commit 75deb166c8922f7ceb120d3892ae1ac4fa4702bb
Author: Ian Cordasco <email address hidden>
Date: Fri Jun 10 12:35:41 2016 -0500

    Use correct keystone auth parameters

    Neutron Metadata Agent uses the authentication parameters as a fallback
    method in the event that communication with Neutron API over RPC fails.
    In the fallback case, it looks for Keystone v2.0 authentication
    credentials but looks for them under the names:

    - admin_user
    - admin_password
    - admin_tenant_name

    Which can be the service user information. We were previously
    configuring Keystone v3 authentication parameters in this space and this
    causes 400 Bad Request responses from Keystone (since the Agent has null
    values for those config options).

    Further, the metadata agent does not need to use the admin URL to
    authenticate. Instead, it can use the internal URL to retrieve its token
    and then authenticate to Neutron API over HTTP.

    Change-Id: Ib413d3f3f3351bef29b0e68a2cfb96b7f3dff3c3
    Closes-bug: 1591282
    Closes-bug: 1590957
    (cherry picked from commit b271778e16a83aefb0e704a9aca0ef09f405084c)

This issue was fixed in the openstack/openstack-ansible 12.0.15 release.

This issue was fixed in the openstack/openstack-ansible 11.2.17 release.