Commonly asked questions on OpenStack are covered in this topic.
Why does an SE not get deleted from NSX Advanced Load Balancer after deleting it from OpenStack?
When an SE is deleted from OpenStack, it can take 25 to 30 minutes to clean-up from NSX Advanced Load Balancer.
How to clean up using use_admin_url flag?
While using Keystone V3, openstack-cleanup API will unconditionally clean up stale users and tenants imported from OpenStack.
Is an NSX Advanced Load Balancer Controller restart required to pick up a new token from Keystone?
No, a Controller restart is not required to pick up a new token from Keystone as NSX Advanced Load Balancer does not cache any tokens. Changes in the Keystone tokens, while upgrading Keystone services or any other activity will not affect tokens used on NSX Advanced Load Balancer. The Status field under on the NSX Advanced Load Balancer UI will exhibit red color (down status) when the Keystone service is brought down during any upgrade process.
All Keystone TCP connections timeout or reset once the Keystone service is down. Once the Keystone service is up post the activity, NSX Advanced Load Balancer will re-establish TCP connection with Keystone and start the synchronization process for various authentication tokens.
Additional Information
The following errors are observed in the OpenStack log /opt/avi/log/cc_agent_openstack-cloud.log file on the NSX Advanced Load Balancer Controller.
[2017-09-26 16:35:05,028] WARNING [os_agent._get_os_tenants:617] lookup using uksc failed, need refresh: Unable to establish connection to http://10.140.1.1:5000/v3/auth/projects
[2017-09-26 16:35:09,641] ERROR [os_agent._os_health_check:1526]
{'nova': 'Unknown Error (HTTP 503) (Request-ID: req-48b6199a-6af1-4a42-be83-fa74e33f92e3)'}
[2017-09-26 16:35:09,641] ERROR [cloud_connector_agent._notif_health:598] health
{'keystone': 'service failure'}
10.140.1.1 is a Keystone authentication URL, which is used in the OpenStack cloud configuration on the NSX Advanced Load Balancer user interface.
