CRITICAL keystonemiddleware.auth_token [-] Unable to validate token: Failed to fetch token data from identity server

Question

I am building openstack (Yoga version on Ubuntu 22.04) high availability using ssl configuration. I was able to get other services to work using https (except neutron, cinder and dashboard), but Nova throws the error in /var/log/nova/nova-api.log below:

CRITICAL keystonemiddleware.auth_token [-] Unable to validate token: Failed to fetch token data from identity server: keystonemiddleware.auth_token._exceptions.ServiceError: Failed to fetch token data from identity server

When I run the command below to get token for user "nova" I am able to get a token:

openstack --os-auth-url https://controller:5000/v3 --os-project-domain-name Default --os-user-domain-name Default --os-project-name service --os-username nova --os-password token issue

Controller is the virtual hostname for all controllers (x3). I have all nodes (controller and Compute nodes) configured in /etc/hosts file.

My configuration is as follows: admin-openrc

export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=<admin-password>
export OS_AUTH_URL=https://controller:5000/v3
#export OS_SERVICE_TOKEN=
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2

/etc/nova/nova.conf

[keystone_authtoken]

www_authenticate_uri = https://controller:5000
auth_url = https://controller:5000
memcached_servers = 192.168.120.11:11211,192.168.120.12:11211,192.168.120.13:11211
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = nova
password = <nova-passwd>

Your assistance is highly appreciated. Please let me know if you require more info.

Thank you

Answer 1

Thank you for your assistance in advance. I discovered that when I use the config below, everything works fine

frontend glance-api-front
        bind 192.168.100.10:9292
        default_backend glance-api-back

backend glance-api-back
        balance source
        option  tcpka
        option  httpchk
#       option  tcplog
        server controller1 192.168.100.11:9292 check inter 2000 rise 2 fall 5
        server controller2 192.168.100.12:9292 check backup inter 2000 rise 2 fall 5
        server controller3 192.168.100.13:9292 check backup inter 2000 rise 2 fall 5

but when I try to simulate failure of active controller node, I get the error below:

"An unexpected error prevented the server from fulfilling your request. (HTTP 500) (Request-ID: req-8d4979ac-c0f0-4900-94b8-814b855c5853)"

not sure how to configure HA to failover to backup controller nodes

Thank you