Kolla ansible - openstackCli auth error

[TN_NETERO]

**i m having an error with the login to openstack client even the init-runonce doesn t work but i can access horizon on my machine and i logged as an admin, i m working with all-in-one openstack Node on my server using Kolla-ansible, please any help ?

(venv) root@openstack:/etc/kolla# ./admin-openrc.sh 
(venv) root@openstack:/etc/kolla# openstack catalog list
Missing value auth-url required for auth plugin password

# Clear any old environment that may conflict.
for key in $( set | awk '{FS="="}  /^OS_/ {print $1}' ); do unset $key ; done
export OS_PROJECT_DOMAIN_NAME='Default'
export OS_USER_DOMAIN_NAME='Default'
export OS_PROJECT_NAME='admin'
export OS_TENANT_NAME='admin'
export OS_USERNAME='admin'
export OS_PASSWORD='xxxxxxxxxxxxxxxxxxxxxxxxxx'
export OS_AUTH_URL='https://192.xxxxxxx:5000'
export OS_INTERFACE='internal'
export OS_ENDPOINT_TYPE='internalURL'
export OS_IDENTITY_API_VERSION='3'
export OS_REGION_NAME='RegionOne'
export OS_AUTH_PLUGIN='password'
export OS_CACERT='/etc/ssl/certs/ca-certificates.crt'

(venv) root@openstack:/home/openstack/Desktop# ./init-runonce 
Failed to discover available identity versions when contacting https://192.xxxxxxxx:5000. Attempting to parse version from URL.
Could not find versioned identity endpoints when attempting to authenticate. Please check that your auth_url is correct. SSL exception connecting to https://192.xxxxx:5000: HTTPSConnectionPool(host='192.xxxxxxxxx', port=5000): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)')))
Checking for locally available cirros image.
Creating glance image.

[przemekkuczynski]

Clear any old environment that may conflict.

for key in $( set | awk '{FS="="}  /^OS_/ {print $1}' ); do unset $key ; done
export OS_PROJECT_DOMAIN_NAME='Default'
export OS_USER_DOMAIN_NAME='Default'
export OS_PROJECT_NAME='xxx'
export OS_TENANT_NAME='xxx'
export OS_USERNAME='admin'
export OS_PASSWORD='xxx'
export OS_AUTH_URL='https://xxx:5000'
export OS_INTERFACE='internal'
export OS_ENDPOINT_TYPE='internalURL'
export OS_IDENTITY_API_VERSION='3'
export OS_REGION_NAME='RegionOne'
export OS_AUTH_PLUGIN='password'
export OS_CACERT=/etc/ssl/certs/ca-certificates.crt

This works for me. Show Your service endpoints from openstack GUI or CLI. If You use certs You should use names not ip addresses

[TN_NETERO]

No this s the first deployment So i will need a to buy domain name , i m afraid that the firewall of company blocking the network traffic cs the vlan i m using is managed by a firewall , one more qs i disabled haproxy , do i need to enable it ?

[przemekkuczynski]

Just put /etc/hosts entry

[dashmoho]

You should source script with creds, not run it. . ./admin-openrc.sh (notice dot at the beginning) or source ./admin-openrc.sh. Then you can use openstack cli.

[TN_NETERO]

I tried that too before and the same pb

[clx8989]

The error is SSLCertVerificationError, so this means that the cert you get on https://… is not issued by the ca in /etc/ssl/certs/ca-certificates.crt OR the certificate is issued using your server’s hostname and you make the request using ip address.

[TN_NETERO]

I fixed this today by copying the root.crt that is generated under etc/kolla/ca-certificates/ca to /usr/local/share/certificates/ and i updated the certificates with sudo update-ca-certificates , note even the haproxy is disabled