Uploaded image for project: 'Red Hat OpenStack Services on OpenShift'
  1. Red Hat OpenStack Services on OpenShift
  2. OSPRH-26252

IdentityService class uses ambiguous rules to detect Keystone v2 endpoints

XMLWordPrintable

    • Storage Integration Sprint 18, Storage Integration Sprint 19
    • 2
    • Important

      To Reproduce Steps to reproduce the behavior:
      Customer is trying to run tempest in environment where public URL contains 'v2':

      | ID | regionOne            | keystone     | identity      | True    | public    | https://keystone-public-openstack.examplev2.com       |
      

      IdentityService class of python-tempestconf has very ambiguous rules to detect keystone v2 endpoints (instead of validating suffix, check returns success if 'v2' can be found anywhere in URL endpoint:

      class IdentityService(VersionedService):
          def __init__(self, name, s_type, service_url, token,
                       disable_ssl_validation, client=None, **kwargs):
              super(IdentityService, self).__init__(
                  name, s_type, service_url, token, disable_ssl_validation,
                  client, **kwargs)
              self.extensions_v3 = []
              version = ''
              if 'v2' in self.service_url:
                  version = '/v2.0'
                  url_parse = urllib.parse.urlparse(self.service_url)
                  self.service_url = '{}://{}{}'.format(url_parse.scheme,
                                                        url_parse.netloc, version)
      
          def set_extensions(self):
              if 'v2' in self.service_url:
                  body = self.do_get(self.service_url + '/extensions')
                  body = json.loads(body)
                  values = body['extensions']['values']
                  self.extensions = list(map(lambda x: x['alias'], values))
                  return
      

      So when customer tries to run tempest, they end up getting the following trace:

      2026-01-29 09:48:58.796 12 CRITICAL tempest [-] Unhandled error: config_tempest.services.base.ServiceError: Request on service 'identity' with url 'https://keystone-public-openstack.examplev2.com/v2.0/extensions' failed with code 404
      2026-01-29 09:48:58.796 12 ERROR tempest Traceback (most recent call last):
      2026-01-29 09:48:58.796 12 ERROR tempest   File "/usr/bin/discover-tempest-config", line 10, in <module>
      2026-01-29 09:48:58.796 12 ERROR tempest     sys.exit(main())
      2026-01-29 09:48:58.796 12 ERROR tempest   File "/usr/lib/python3.9/site-packages/config_tempest/main.py", line 617, in main
      2026-01-29 09:48:58.796 12 ERROR tempest     config_tempest(
      2026-01-29 09:48:58.796 12 ERROR tempest   File "/usr/lib/python3.9/site-packages/config_tempest/main.py", line 559, in config_tempest
      2026-01-29 09:48:58.796 12 ERROR tempest     services = Services(clients, conf, credentials)
      2026-01-29 09:48:58.796 12 ERROR tempest   File "/usr/lib/python3.9/site-packages/config_tempest/services/services.py", line 42, in __init__
      2026-01-29 09:48:58.796 12 ERROR tempest     self.discover()
      2026-01-29 09:48:58.796 12 ERROR tempest   File "/usr/lib/python3.9/site-packages/config_tempest/services/services.py", line 115, in discover
      2026-01-29 09:48:58.796 12 ERROR tempest     service.set_extensions()
      2026-01-29 09:48:58.796 12 ERROR tempest   File "/usr/lib/python3.9/site-packages/config_tempest/services/identity.py", line 41, in set_extensions
      2026-01-29 09:48:58.796 12 ERROR tempest     body = self.do_get(self.service_url + '/extensions')
      2026-01-29 09:48:58.796 12 ERROR tempest   File "/usr/lib/python3.9/site-packages/config_tempest/services/base.py", line 80, in do_get
      2026-01-29 09:48:58.796 12 ERROR tempest     raise ServiceError("Request on service '%s' with url '%s' failed"
      2026-01-29 09:48:58.796 12 ERROR tempest config_tempest.services.base.ServiceError: Request on service 'identity' with url 'https://keystone-public-openstack.examplev2.com/v2.0/extensions' failed with code 404
      

      Expected behavior
      I believe that Keystone v2 API endpoint was deprecated for a while, so right decision is to probably drop related code. But if it is impossible, then check should be fixed to validate suffix instead of whole URL.

      Bug impact
      Acceptance tests are blocked

      Known workaround
      None: I doubt that endpoint URL can be changed in all situations

      Additional context
      Data including must-gather is attached to the case, trace can be found in namespaces/openstack/pods/tempest-tests/logs/tempest-tests-tests-runner.log

              ltoscano1@redhat.com Luigi Toscano
              rhn-support-astupnik Alex Stupnikov
              Douglas Mendizabal
              rhos-storage-integration
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated: