rabbitmq 对虚拟主机的访问被拒绝

Question

I set up a controller host with rabbitmq-server running. From the nova host, I see that the nova-conductor cannot be reached. I checked on the controller host and I see the following in the logs :

  access to vhost 'None' refused for user 'openstack'

I have the following configuration settings for rabbitmq on the controller host:

    rabbitmqctl list_users
    Listing users ...
    guest   [administrator]
    openstack       []

When I list permissions I see openstack can access all resources

    list_permissions
    Listing permissions in vhost "/" ...
    guest   .*      .*      .*
    openstack       .*      .*      .*

I am able to authenticate with the rabbitmq-server - just unable to access the / vhost. For debugging, I would like to set up so that any client can access any resource (turn off access control altogether). Is that possible.

Thanks

Answer 1

access to vhost 'None' refused for user 'openstack'

Something is trying to access a vhost named None , which doesn't exist. The default vhost is named / . Since None is a keyword in Python I suspect there is an application bug or mis-configuration somewhere.

It's not possible to disable access control so I suggest creating a well-known user and password to use.

Answer 2

This is caused by a relatively new change in either Kombu or oslo.messages . Previously if a virtual_host was not provided, it would default to / . This is no longer the case.

For it to work your transport_url needs to at the very least have one / at the end.

transport_url = rabbit://stackrabbit:secretrabbit@127.0.0.1:5672/

You can take a look at for example devstack here as a reference.

The actual upstream fix for the issue is available here .

Answer 3

You can also send http requests to the vhost to get/set user permissions. You have to specify the host name as part of the url, but since the default vhost is '/' you have to substitute it for '%2F' ie http://<ip>:<port>/api/vhosts/%2F/permissions

eg

 curl -i -u guest:guest -h "content-type:application/json" -GET http://localhost:15672/api/permissions/%2F/guest

You can find a full list of api options by going to http://<ip>:<port>/api/index.html