yahoo-eng-team team mailing list archive

[Dave McCowan <dmccowan@xxxxxxxxx>]

** No longer affects: barbican

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1623488

Title:
  Documentation needed to clarify how to configure auth_endpoint for
  image signing

Status in OpenStack Compute (nova):
  Confirmed
Status in openstack-manuals:
  Opinion

Bug description:
  Description
  ===========
  By default Barbican uses http://localhost:5000/v3 for the auth_endpoint (where keystone is). Users should know that this can be changed in nova.conf. This will solve the issue of Barbican being unable to connect to Keystone.

  Steps to reproduce
  ==================
  If keystone is not on localhost then Barbican will not being able to connect to Keystone. Also, using this documentation to create a signed image:

  https://github.com/openstack/glance/blob/master/doc/source/signature.rst

  Then booting the image using 'nova boot'.

  Note: verify_glance_signatures must be set to true in nova.conf

  Expected result
  ===============
  Barbican should connect to Keystone to authorize credentials when booting a signed image.

  Actual result
  =============
  Barbican cannot connect to Keystone and booting a signed image fails.

  Environment
  ===========
  This is using the mitaka branch.


  This also happens in Glance:
  https://bugs.launchpad.net/glance/+bug/1620539

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1623488/+subscriptions