ubuntu - openstack CRITICAL keystonemiddleware.auth_token [-] 无法验证

Question

我正在使用安装文档在 Ubuntu 16.04 上手动安装 Openstack Newton： https ://docs.openstack.org/newton/install-guide-ubuntu/glance-install.html

在填充图像服务数据库之前，我在glance-registry.conf 中遗漏了一些内容。然后我回去修复所有东西，再次填充数据库（sudo su -s /bin/sh -c “glance-manage db_sync”glance）重新启动服务，加载管理员凭据并尝试创建 Cirros 映像，但不断收到以下错误：

user1@controller:~$ openstack image create "cirros" --file cirros-0.3.4-x86_64-disk.img --disk-format qcow2 --container-format bare --public
503 Service Unavailable
The server is currently unavailable. Please try again at a later time.
    (HTTP 503)

Glance-registry.log 看起来不错：（注意不是整个日志）

2017-03-29 11:33:39.073 2084 INFO glance.common.wsgi [-] Starting 6 workers
2017-03-29 11:33:39.083 2084 INFO glance.common.wsgi [-] Started child 2119
2017-03-29 11:33:39.084 2119 INFO eventlet.wsgi.server [-] (2119) wsgi starting up on http://0.0.0.0:9191
2017-03-29 11:33:39.086 2084 INFO glance.common.wsgi [-] Started child 2120
2017-03-29 11:33:39.087 2120 INFO eventlet.wsgi.server [-] (2120) wsgi starting up on http://0.0.0.0:9191
2017-03-29 11:33:39.090 2084 INFO glance.common.wsgi [-] Started child 2121
2017-03-29 11:33:39.091 2121 INFO eventlet.wsgi.server [-] (2121) wsgi starting up on http://0.0.0.0:9191
2017-03-29 11:33:39.093 2084 INFO glance.common.wsgi [-] Started child 2122
2017-03-29 11:33:39.094 2122 INFO eventlet.wsgi.server [-] (2122) wsgi starting up on http://0.0.0.0:9191
2017-03-29 11:33:39.096 2084 INFO glance.common.wsgi [-] Started child 2123
2017-03-29 11:33:39.097 2123 INFO eventlet.wsgi.server [-] (2123) wsgi starting up on http://0.0.0.0:9191
2017-03-29 11:33:39.100 2084 INFO glance.common.wsgi [-] Started child 2124
2017-03-29 11:33:39.101 2124 INFO eventlet.wsgi.server [-] (2124) wsgi starting up on http://0.0.0.0:9191

Glance-api.log 有一些错误：（注意不是整个日志）

2017-03-29 11:33:39.326 2088 INFO glance.common.wsgi [-] Started child 2127
2017-03-29 11:33:39.327 2127 INFO eventlet.wsgi.server [-] (2127) wsgi starting up on http://0.0.0.0:9292
2017-03-29 11:33:39.330 2088 INFO glance.common.wsgi [-] Started child 2128
2017-03-29 11:33:39.330 2128 INFO eventlet.wsgi.server [-] (2128) wsgi starting up on http://0.0.0.0:9292
2017-03-29 11:33:39.334 2088 INFO glance.common.wsgi [-] Started child 2129
2017-03-29 11:33:39.334 2129 INFO eventlet.wsgi.server [-] (2129) wsgi starting up on http://0.0.0.0:9292
2017-03-29 11:33:39.338 2088 INFO glance.common.wsgi [-] Started child 2130
2017-03-29 11:33:39.339 2130 INFO eventlet.wsgi.server [-] (2130) wsgi starting up on http://0.0.0.0:9292
2017-03-29 11:36:44.200 2126 WARNING keystonemiddleware.auth_token [-] Identity response: {"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}
2017-03-29 11:36:44.322 2126 WARNING keystonemiddleware.auth_token [-] Identity response: {"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}
2017-03-29 11:36:44.323 2126 CRITICAL keystonemiddleware.auth_token [-] Unable to validate token: Identity server rejected authorization necessary to fetch token data
2017-03-29 11:36:44.326 2126 INFO eventlet.wsgi.server [-] 192.168.10.11 - - [29/Mar/2017 11:36:44] "GET /v2/schemas/image HTTP/1.1" 503 259 2.551519

管理员-openrc

export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=PASSWORDHERE
export OS_AUTH_URL=http://controller:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

有什么建议么？

---

/var/log/apache2/error.log

[Wed Mar 29 09:09:24.843764 2017] [wsgi:warn] [pid 1689:tid 139998635640704] mod_wsgi: Compiled for Python/2.7.11.
[Wed Mar 29 09:09:24.852363 2017] [wsgi:warn] [pid 1689:tid 139998635640704] mod_wsgi: Runtime using Python/2.7.12.
[Wed Mar 29 09:09:24.855349 2017] [mpm_event:notice] [pid 1689:tid 139998635640704] AH00489: Apache/2.4.18 (Ubuntu) mod_wsgi/4.3.0 Python/2.7.12 configured -- resuming normal operations
[Wed Mar 29 09:09:24.855369 2017] [core:notice] [pid 1689:tid 139998635640704] AH00094: Command line: '/usr/sbin/apache2'
[Wed Mar 29 10:20:52.529214 2017] [mpm_event:notice] [pid 1689:tid 139998635640704] AH00491: caught SIGTERM, shutting down
[Wed Mar 29 10:22:50.037927 2017] [wsgi:warn] [pid 1571:tid 140332865791872] mod_wsgi: Compiled for Python/2.7.11.
[Wed Mar 29 10:22:50.068187 2017] [wsgi:warn] [pid 1571:tid 140332865791872] mod_wsgi: Runtime using Python/2.7.12.
[Wed Mar 29 10:22:50.070975 2017] [mpm_event:notice] [pid 1571:tid 140332865791872] AH00489: Apache/2.4.18 (Ubuntu) mod_wsgi/4.3.0 Python/2.7.12 configured -- resuming normal operations
[Wed Mar 29 10:22:50.071001 2017] [core:notice] [pid 1571:tid 140332865791872] AH00094: Command line: '/usr/sbin/apache2'
[Wed Mar 29 11:31:31.911160 2017] [mpm_event:notice] [pid 1571:tid 140332865791872] AH00491: caught SIGTERM, shutting down
[Wed Mar 29 11:33:34.967332 2017] [wsgi:warn] [pid 1559:tid 139850139666304] mod_wsgi: Compiled for Python/2.7.11.
[Wed Mar 29 11:33:34.979608 2017] [wsgi:warn] [pid 1559:tid 139850139666304] mod_wsgi: Runtime using Python/2.7.12.
[Wed Mar 29 11:33:34.982567 2017] [mpm_event:notice] [pid 1559:tid 139850139666304] AH00489: Apache/2.4.18 (Ubuntu) mod_wsgi/4.3.0 Python/2.7.12 configured -- resuming normal operations
[Wed Mar 29 11:33:34.982589 2017] [core:notice] [pid 1559:tid 139850139666304] AH00094: Command line: '/usr/sbin/apache2'
[Wed Mar 29 12:03:56.366665 2017] [mpm_event:notice] [pid 1559:tid 139850139666304] AH00491: caught SIGTERM, shutting down
[Thu Mar 30 13:10:43.749039 2017] [wsgi:warn] [pid 1682:tid 139702919534464] mod_wsgi: Compiled for Python/2.7.11.
[Thu Mar 30 13:10:43.764797 2017] [wsgi:warn] [pid 1682:tid 139702919534464] mod_wsgi: Runtime using Python/2.7.12.
[Thu Mar 30 13:10:43.768481 2017] [mpm_event:notice] [pid 1682:tid 139702919534464] AH00489: Apache/2.4.18 (Ubuntu) mod_wsgi/4.3.0 Python/2.7.12 configured -- resuming normal operations
[Thu Mar 30 13:10:43.768511 2017] [core:notice] [pid 1682:tid 139702919534464] AH00094: Command line: '/usr/sbin/apache2'

/var/log/glance/glance-api.log

2017-03-29 11:33:39.326 2088 INFO glance.common.wsgi [-] Started child 2127
2017-03-29 11:33:39.327 2127 INFO eventlet.wsgi.server [-] (2127) wsgi starting up on http://0.0.0.0:9292
2017-03-29 11:33:39.330 2088 INFO glance.common.wsgi [-] Started child 2128
2017-03-29 11:33:39.330 2128 INFO eventlet.wsgi.server [-] (2128) wsgi starting up on http://0.0.0.0:9292
2017-03-29 11:33:39.334 2088 INFO glance.common.wsgi [-] Started child 2129
2017-03-29 11:33:39.334 2129 INFO eventlet.wsgi.server [-] (2129) wsgi starting up on http://0.0.0.0:9292
2017-03-29 11:33:39.338 2088 INFO glance.common.wsgi [-] Started child 2130
2017-03-29 11:33:39.339 2130 INFO eventlet.wsgi.server [-] (2130) wsgi starting up on http://0.0.0.0:9292
2017-03-29 11:36:44.200 2126 WARNING keystonemiddleware.auth_token [-] Identity response: {"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}
2017-03-29 11:36:44.322 2126 WARNING keystonemiddleware.auth_token [-] Identity response: {"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}
2017-03-29 11:36:44.323 2126 CRITICAL keystonemiddleware.auth_token [-] Unable to validate token: Identity server rejected authorization necessary to fetch token data
2017-03-29 11:36:44.326 2126 INFO eventlet.wsgi.server [-] 192.168.10.11 - - [29/Mar/2017 11:36:44] "GET /v2/schemas/image HTTP/1.1" 503 259 2.551519

/var/log/glance/glance-registry.log

2017-03-29 11:33:39.073 2084 INFO glance.common.wsgi [-] Starting 6 workers
2017-03-29 11:33:39.083 2084 INFO glance.common.wsgi [-] Started child 2119
2017-03-29 11:33:39.084 2119 INFO eventlet.wsgi.server [-] (2119) wsgi starting up on http://0.0.0.0:9191
2017-03-29 11:33:39.086 2084 INFO glance.common.wsgi [-] Started child 2120
2017-03-29 11:33:39.087 2120 INFO eventlet.wsgi.server [-] (2120) wsgi starting up on http://0.0.0.0:9191
2017-03-29 11:33:39.090 2084 INFO glance.common.wsgi [-] Started child 2121
2017-03-29 11:33:39.091 2121 INFO eventlet.wsgi.server [-] (2121) wsgi starting up on http://0.0.0.0:9191
2017-03-29 11:33:39.093 2084 INFO glance.common.wsgi [-] Started child 2122
2017-03-29 11:33:39.094 2122 INFO eventlet.wsgi.server [-] (2122) wsgi starting up on http://0.0.0.0:9191
2017-03-29 11:33:39.096 2084 INFO glance.common.wsgi [-] Started child 2123
2017-03-29 11:33:39.097 2123 INFO eventlet.wsgi.server [-] (2123) wsgi starting up on http://0.0.0.0:9191
2017-03-29 11:33:39.100 2084 INFO glance.common.wsgi [-] Started child 2124
2017-03-29 11:33:39.101 2124 INFO eventlet.wsgi.server [-] (2124) wsgi starting up on http://0.0.0.0:9191

Answer 1

我以前遇到过同样的麻烦。

日志显示用户想要从 keystone 获取令牌，但 keystone 拒绝了，因为 wsgi，身份验证是这样的。就像您的密码错误，但您的密码绝对正确。

• 检查您的 /etc/keystone/keystone-paste.ini 是否存在
• 检查你的梯形失真版本

• 检查你的 yum 源是否匹配你的 openstack 版本

  例如：

  如果我的 openstack 版本是 ocata，但我使用这个

  yum install centos-release-openstack-liberty
  

  如果我这样做了，我的基石肯定在工作

Answer 2

我有完全相同的问题。相同的日志文件条目等等。我发现我的用户浏览密码错误。我通过使用重置它

（openstack用户列表..找出用户ID）

openstack user set --password GLANCE_PWD  (user id)

Answer 3

我发现了这个问题并使用以下步骤进行了纠正：

1. 检查您在 openrc 文件或glance-api.conf 中设置的密码
2. 使用相同的密码更新 openstack 映像用户密码。3 重启image和apache的服务。希望它会奏效。

Answer 4

看起来您的glance-api.conf/glance-registry.conf文件在一个或多个参数中有错字。

逐行重新访问配置文件并检查任何问题。

我记得，就我而言，我在project_name变量中有一个拼写错误，导致了类似的问题。

Answer 5

以下错误可能表明您的 Glance 缺少 keystone 凭据，在您的 Glance 配置文件中您应该有：

[keystone_authtoken]
admin_user=glance
admin_password=___SOME_SECRET_PASSWORD_GOES_HERE___
admin_tenant_name=service

2017-03-29 11:36:44.200 2126 警告 keystonemiddleware.auth_token [-] 身份响应：{“错误”：{“消息”：“您提出的请求需要身份验证。”，“代码”：401，“标题": "Unauthorized"}} 2017-03-29 11:36:44.322 2126 WARNING keystonemiddleware.auth_token [-] Identity response: {"error": {"message": "The request requires authentication.", " code": 401, "title": "Unauthorized"}} 2017-03-29 11:36:44.323 2126 CRITICAL keystonemiddleware.auth_token [-] 无法验证令牌：身份服务器拒绝了获取令牌数据所需的授权

Answer 6

您的 Glance API 和 Glance 注册表似乎很好，但都在 WSGI 模式下工作，因此您需要有一些 Apache 或其他 httpd 服务器来接受 API 调用，通过 WSGI 将它们发送到您的 galnce 服务器，获得响应并将其发送回客户。我建议查看您的 apache/httpd 服务器日志，您可能会找到更多信息，为什么会出现 500 错误。