Commonly asked questions on OpenStack are covered in this topic.
Why does an SE not get deleted from Avi Load Balancer after deleting it from OpenStack?
When an SE is deleted from OpenStack, it can take 25 to 30 minutes to clean-up from Avi Load Balancer.
How to clean up using use_admin_url flag?
While using Keystone V3, openstack-cleanup API will unconditionally clean up stale users and tenants imported from OpenStack.
Is an Avi Load Balancer Controller restart required to pick up a new token from Keystone?
No, a Controller restart is not required to pick up a new token from Keystone as Avi Load Balancer does not cache any tokens. Changes in the Keystone tokens, while upgrading Keystone services or any other activity will not affect tokens used on Avi Load Balancer. The Status field under on the Avi Load Balancer UI will exhibit red color (down status) when the Keystone service is brought down during any upgrade process.
All Keystone TCP connections timeout or reset once the Keystone service is down. Once the Keystone service is up post the activity, Avi Load Balancer will re-establish TCP connection with Keystone and start the synchronization process for various authentication tokens.
Additional Information
The following errors are observed in the OpenStack log /opt/avi/log/cc_agent_openstack-cloud.log file on the Avi Load Balancer Controller.
[2017-09-26 16:35:05,028] WARNING [os_agent._get_os_tenants:617] lookup using uksc failed, need refresh: Unable to establish connection to http://10.140.1.1:5000/v3/auth/projects
[2017-09-26 16:35:09,641] ERROR [os_agent._os_health_check:1526]
{'nova': 'Unknown Error (HTTP 503) (Request-ID: req-48b6199a-6af1-4a42-be83-fa74e33f92e3)'}
[2017-09-26 16:35:09,641] ERROR [cloud_connector_agent._notif_health:598] health
{'keystone': 'service failure'}
10.140.1.1 is a Keystone authentication URL, which is used in the OpenStack cloud configuration on the Avi Load Balancer user interface.
