☰

如何在没有 SSL 验证的情况下运行 openstack 组件的 cli？

tag-icon • tag-icon ssl command-line-interface openstack nova glance
如何在没有 SSL 验证的情况下运行 openstack 组件的 cli？

（我使用IPv6_Address真实 IP 地址代替）

.openrc环境：

export OS_CLOUD=mycloud
export OS_USERNAME=myusername
export OS_PASSWORD=mypassword
export OS_PROJECT_NAME=myproject
export OS_AUTH_URL=https://[IPv6_Address]:5000/v3

如果在文件中设置此配置clouds.yml：

  mycloud:
    identity_api_version: "3"
    region_name: RegionOne
    verify: False
    auth:
      auth_url: https://[IPv6_Address]:5000/v3
      user_domain_name: "Default"
      project_name: "myproject"
      project_domain_name: "default"

跑步可以奏效openstack server list。但这次跑步nova list

No handlers could be found for logger "keystoneauth.identity.generic.base"
ERROR (SSLError): SSL exception connecting to https://[IPv6_Address]:5000/v3/auth/tokens: HTTPSConnectionPool(host='IPv6_Address', port=5000): Max retries exceeded with url: /v3/auth/tokens (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",),))

尝试nova list --insecure得到了

/usr/lib/python2.7/site-packages/urllib3/connectionpool.py:847: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
  InsecureRequestWarning)
/usr/lib/python2.7/site-packages/urllib3/connectionpool.py:847: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
  InsecureRequestWarning)
/usr/lib/python2.7/site-packages/urllib3/connectionpool.py:847: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
  InsecureRequestWarning)
/usr/lib/python2.7/site-packages/urllib3/connectionpool.py:847: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
  InsecureRequestWarning)
usage: nova [--version] [--debug] [--os-cache] [--timings]
            [--os-region-name <region-name>] [--service-type <service-type>]
            [--service-name <service-name>]
            [--os-endpoint-type <endpoint-type>]
            [--os-compute-api-version <compute-api-ver>]
            [--os-endpoint-override <bypass-url>] [--insecure]
            [--os-cacert <ca-certificate>] [--os-cert <certificate>]
            [--os-key <key>] [--timeout <seconds>] [--collect-timing]
            [--os-auth-type <name>] [--os-auth-url OS_AUTH_URL]
            [--os-system-scope OS_SYSTEM_SCOPE] [--os-domain-id OS_DOMAIN_ID]
            [--os-domain-name OS_DOMAIN_NAME] [--os-project-id OS_PROJECT_ID]
            [--os-project-name OS_PROJECT_NAME]
            [--os-project-domain-id OS_PROJECT_DOMAIN_ID]
            [--os-project-domain-name OS_PROJECT_DOMAIN_NAME]
            [--os-trust-id OS_TRUST_ID]
            [--os-default-domain-id OS_DEFAULT_DOMAIN_ID]
            [--os-default-domain-name OS_DEFAULT_DOMAIN_NAME]
            [--os-user-id OS_USER_ID] [--os-username OS_USERNAME]
            [--os-user-domain-id OS_USER_DOMAIN_ID]
            [--os-user-domain-name OS_USER_DOMAIN_NAME]
            [--os-password OS_PASSWORD]
            <subcommand> ...
error: unrecognized arguments: --insecure
Try 'nova help ' for more information.

如果本地没有 SSL 证书文件来连接到 openstack https api，如何运行nova,glance命令？是否有.novarc,.glancerc配置文件来使用它们？

我也尝试创建一个nova.rc与 openrc 具有相同配置的文件，然后将其作为 source。但结果是一样的。

答案1

要使用“--insecure”选项运行 nova，你必须对语法更加严格。
nova --insecure list应该可以工作，但
nova list --insecure应该会给出与 @rawmain 发布的相同的错误

答案2

虽然我对您的问题并不熟悉，但是 OpenStack 正在尝试将其服务客户端转移到统一的客户端，即 OpenStack 客户端。

以下是关于我刚才提到的一些链接（维多利亚版本）：

https://docs.openstack.org/python-openstackclient/victoria/

https://docs.openstack.org/python-openstackclient/victoria/cli/decoder.html

在这种情况下，为了您的目的，您可以通过“openstack --insecure”进入cli环境

https://docs.openstack.org/python-openstackclient/latest/cli/man/openstack.html

相关内容