yahoo-eng-team team mailing list archive

Thread
Date
[Bug 2098168] [NEW] Cinder: volume attach fails (unauthorized API req)

To: yahoo-eng-team@xxxxxxxxxxxxxxxxxxx
From: Friedrich Eierspeis <2098168@xxxxxxxxxxxxxxxxxx>
Date: Thu, 13 Feb 2025 05:50:38 -0000
Reply-to: Bug 2098168 <2098168@xxxxxxxxxxxxxxxxxx>
Sender: noreply@xxxxxxxxxxxxx
Public bug reported:

Description
===========

When attaching a volume (or creating an instance including a volume) the operation fails because Nova cannot authenticate against Cinder. The log file asks to create a bug report.
The installation is using service tokens as described here: https://docs.openstack.org/cinder/2024.1/configuration/block-storage/service-token.html


Steps to reproduce
==================

In Horizon, there are different ways to attach a volume (at instance
creation or later, on the instance and volume tab, all leading to the
same outcome), therefore this is just one possible way.

* Create a new instance without a volume
* Create a volume
* Go the the instance tab, use the menu right to the instance and select attach, select the volume and try to attach it. Getting an error message:

Error: Unable to attach volume.
Unexpected API Error. Please report this at http://bugs.launchpad.net/nova/ and attach the Nova API log if possible. <class 'cinderclient.exceptions.Unauthorized'> (HTTP 500)


Expected result
===============

Volume attached to instance without an error.


Actual result
=============

Authentication error, Nova cannot use Cinder functions and therefore no
volume is attached to the instance.


Analysis
========

There are multiple requests to Cinder (especially three subsequents with
the later two failing with 401). As soon as the service token is used,
the requests fail. The attachment contains HTTP headers for one
successful and one failing request.


Environment
===========

This is a default Ubuntu Noble installation following this guide:
https://docs.openstack.org/2024.1/install/

# dpkg -l | grep nova
ii  nova-api                                         3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute - API frontend
ii  nova-common                                      3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute - common files
ii  nova-compute                                     3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute - compute node base
ii  nova-compute-kvm                                 3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute - compute node (KVM)
ii  nova-compute-libvirt                             3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute - compute node libvirt support
ii  nova-conductor                                   3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute - conductor service
ii  nova-novncproxy                                  3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute - NoVNC proxy
ii  nova-scheduler                                   3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute - virtual machine scheduler
ii  python3-nova                                     3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute Python 3 libraries
ii  python3-novaclient                               2:18.5.0-0ubuntu1                                    all          client library for OpenStack Compute API - 3.x


# kvm --version
QEMU emulator version 8.2.2 (Debian 1:8.2.2+ds-0ubuntu1.5)
Copyright (c) 2003-2023 Fabrice Bellard and the QEMU Project developers

Using Neutron with openvswitch, lvm backend for Cinder

** Affects: nova
     Importance: Undecided
         Status: New

** Attachment added: "details.txt"
   https://bugs.launchpad.net/bugs/2098168/+attachment/5857036/+files/details.txt

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/2098168

Title:
  Cinder: volume attach fails (unauthorized API req)

Status in OpenStack Compute (nova):
  New

Bug description:
  Description
  ===========

  When attaching a volume (or creating an instance including a volume) the operation fails because Nova cannot authenticate against Cinder. The log file asks to create a bug report.
  The installation is using service tokens as described here: https://docs.openstack.org/cinder/2024.1/configuration/block-storage/service-token.html

  
  Steps to reproduce
  ==================

  In Horizon, there are different ways to attach a volume (at instance
  creation or later, on the instance and volume tab, all leading to the
  same outcome), therefore this is just one possible way.

  * Create a new instance without a volume
  * Create a volume
  * Go the the instance tab, use the menu right to the instance and select attach, select the volume and try to attach it. Getting an error message:

  Error: Unable to attach volume.
  Unexpected API Error. Please report this at http://bugs.launchpad.net/nova/ and attach the Nova API log if possible. <class 'cinderclient.exceptions.Unauthorized'> (HTTP 500)

  
  Expected result
  ===============

  Volume attached to instance without an error.

  
  Actual result
  =============

  Authentication error, Nova cannot use Cinder functions and therefore
  no volume is attached to the instance.


  Analysis
  ========

  There are multiple requests to Cinder (especially three subsequents
  with the later two failing with 401). As soon as the service token is
  used, the requests fail. The attachment contains HTTP headers for one
  successful and one failing request.


  Environment
  ===========

  This is a default Ubuntu Noble installation following this guide:
  https://docs.openstack.org/2024.1/install/

  # dpkg -l | grep nova
  ii  nova-api                                         3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute - API frontend
  ii  nova-common                                      3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute - common files
  ii  nova-compute                                     3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute - compute node base
  ii  nova-compute-kvm                                 3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute - compute node (KVM)
  ii  nova-compute-libvirt                             3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute - compute node libvirt support
  ii  nova-conductor                                   3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute - conductor service
  ii  nova-novncproxy                                  3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute - NoVNC proxy
  ii  nova-scheduler                                   3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute - virtual machine scheduler
  ii  python3-nova                                     3:29.0.1-0ubuntu1.4                                  all          OpenStack Compute Python 3 libraries
  ii  python3-novaclient                               2:18.5.0-0ubuntu1                                    all          client library for OpenStack Compute API - 3.x

  
  # kvm --version
  QEMU emulator version 8.2.2 (Debian 1:8.2.2+ds-0ubuntu1.5)
  Copyright (c) 2003-2023 Fabrice Bellard and the QEMU Project developers

  Using Neutron with openvswitch, lvm backend for Cinder

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/2098168/+subscriptions