<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">I’m having a problem with injecting keys through the metadata service (actually nova-api). The keys are not being written to the authorized_keys file. Actually it doesn’t look like they are available from the metadata api. When the instance
is booting I get this error: <span style="font-family:"Courier New"">“cc_ssh.py[WARNING]: applying credentials failed!”</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">This is the from api.log. Notice “404” when trying get the keys.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">2013-03-21 17:54:58 16357 INFO nova.api.ec2 [-] 0.388398s 10.10.16.17 GET /latest/metadata/public-keys/0/openssh-key None:None 404 [curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.14.0.0
zlib/1.2.3 libidn/1.18 libssh2/1.4.2] text/plain text/html<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">2013-03-21 17:54:58 16357 INFO nova.metadata.wsgi.server [-] 10.10.16.17 - - [21/Mar/2013 17:54:58] "GET /latest/metadata/public-keys/0/openssh-key HTTP/1.1" 404 278 0.389426<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal">I’m not running the metadata-api, only nova-api on each of three nodes. Nova.conf related to meta-data config is as follows:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Controller/Compute 1<o:p></o:p></p>
<p class="MsoNormal">enabled_apis = ec2,osapi_compute,metadata<o:p></o:p></p>
<p class="MsoNormal">metadata_host = 10.10.12.245<o:p></o:p></p>
<p class="MsoNormal">metadata_port = 8775<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Compute 2<o:p></o:p></p>
<p class="MsoNormal">enabled_apis = ec2,osapi_compute,metadata<o:p></o:p></p>
<p class="MsoNormal">metadata_host = 10.10.12.246<o:p></o:p></p>
<p class="MsoNormal">metadata_port = 8775<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Compute 3<o:p></o:p></p>
<p class="MsoNormal">enabled_apis = ec2,osapi_compute,metadata<o:p></o:p></p>
<p class="MsoNormal">metadata_host = 10.10.12.247<o:p></o:p></p>
<p class="MsoNormal">metadata_port = 8775<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">While logged into the VM, I can run
<a href="http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key">http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key</a> and the ssh key is returned. So I guess the metadata service is working properly. Do I need to have the .ssh directory
and the authorized_keys file already in place and with the correct permissions?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">Rick<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><u><span style="font-size:14.0pt;color:#990000">Richard Minton<o:p></o:p></span></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt">LMICC Systems Administrator<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">4000 Geerdes Blvd, 13D31<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">King of Prussia, PA 19406<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Phone: 610-354-5482<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>