Cannot use internal identity endpoint?

[mauhau]

I am making my first steps with Rust and also with this SDK.

I am trying to make a simple authentication request with a given clouds.yaml in order to make some performance tests afterwards.

However I think I found a bug / limitation.

Given this clouds.yaml:

clouds:
  default:
    auth:
      auth_url: https://keystone.yaook.svc:5000/v3
      password: ***
      project_domain_name: Default
      project_name: admin
      user_domain_name: Default
      user_name: yaook-sys-maint
    cacert: /data/git/gitlab/yaook/operator/openstack_env/ca-bundle.crt
    identity_api_version: '3'
    interface: internal

Using this config it is not possible to create a session with the SDK and also not with osc:

$ $HOME/.cargo/bin/osc --os-cloud default catalog list -v -v
2026-04-08T16:40:33.032157Z DEBUG rustls_platform_verifier::verification::others: Loaded 153 CA root certificates from the system
2026-04-08T16:40:33.032658Z DEBUG discover_service_endpoint{service_type=Identity}: openstack_sdk::catalog: Using catalog endpoint `ServiceEndpoint { url: "https://keystone.yaook.svc:5000/v3", region: None, interface: Some("public"), version: ApiVersion { major: 3, minor: 0 }, min_version: None, max_version: None, pid_segment: None }` for service_type: `identity` and version `None`
2026-04-08T16:40:33.032672Z  INFO discover_service_endpoint{service_type=Identity}: openstack_sdk::openstack_async: Performing `identity` endpoint version discovery
2026-04-08T16:40:33.032696Z  INFO discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}: openstack_sdk::openstack_async: Sending request Request { method: GET, url: Url { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("keystone.yaook.svc")), port: Some(5000), path: "/v3/", query: None, fragment: None }, headers: {} }
2026-04-08T16:40:33.032749Z DEBUG discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}: reqwest::connect: starting new connection: https://keystone.yaook.svc:5000/
2026-04-08T16:40:33.041515Z DEBUG discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}: hyper_util::client::legacy::connect::http: connecting to 246.246.0.1:5000
2026-04-08T16:40:33.041806Z DEBUG discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}: hyper_util::client::legacy::connect::http: connected to 246.246.0.1:5000
2026-04-08T16:40:33.071667Z DEBUG discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}: h2::client: binding client connection
2026-04-08T16:40:33.071694Z DEBUG discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}: h2::client: client connection bound
2026-04-08T16:40:33.071702Z DEBUG discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}: h2::codec::framed_write: send frame=Settings { flags: (0x0), enable_push: 0, initial_window_size: 2097152, max_frame_size: 16384, max_header_list_size: 16384 }
2026-04-08T16:40:33.071739Z DEBUG discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}: hyper_util::client::legacy::pool: pooling idle connection for ("https", keystone.yaook.svc:5000)
2026-04-08T16:40:33.071792Z DEBUG discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}:Connection{peer=Client}: h2::codec::framed_write: send frame=WindowUpdate { stream_id: StreamId(0), size_increment: 5177345 }
2026-04-08T16:40:33.071812Z DEBUG discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}:Connection{peer=Client}: h2::codec::framed_write: send frame=Headers { stream_id: StreamId(1), flags: (0x5: END_HEADERS | END_STREAM) }
2026-04-08T16:40:33.075926Z DEBUG discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}:Connection{peer=Client}: h2::codec::framed_read: received frame=Settings { flags: (0x0), header_table_size: 4096, max_concurrent_streams: 250, initial_window_size: 1048576, max_frame_size: 1048576, max_header_list_size: 1048896 }
2026-04-08T16:40:33.075938Z DEBUG discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}:Connection{peer=Client}: h2::codec::framed_write: send frame=Settings { flags: (0x1: ACK) }
2026-04-08T16:40:33.075946Z DEBUG discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}:Connection{peer=Client}: h2::codec::framed_read: received frame=WindowUpdate { stream_id: StreamId(0), size_increment: 983041 }
2026-04-08T16:40:33.077052Z DEBUG discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}:Connection{peer=Client}: h2::codec::framed_read: received frame=Settings { flags: (0x1: ACK) }
2026-04-08T16:40:33.077058Z DEBUG discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}:Connection{peer=Client}: h2::proto::settings: received settings ACK; applying Settings { flags: (0x0), enable_push: 0, initial_window_size: 2097152, max_frame_size: 16384, max_header_list_size: 16384 }
2026-04-08T16:40:33.079642Z DEBUG discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}:Connection{peer=Client}: h2::codec::framed_read: received frame=Headers { stream_id: StreamId(1), flags: (0x4: END_HEADERS) }
2026-04-08T16:40:33.079664Z DEBUG discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}:Connection{peer=Client}: h2::codec::framed_read: received frame=Data { stream_id: StreamId(1), flags: (0x1: END_STREAM) }
2026-04-08T16:40:33.079720Z  INFO discover_service_endpoint{service_type=Identity}:request{http.uri="https://keystone.yaook.svc:5000/v3/" http.method="GET"}: openstack_sdk::openstack_async: Request completed with status 200 OK url="https://keystone.yaook.svc:5000/v3/" duration_ms=47 status=200 method="GET" request_id="req-1952d91d-ea52-474c-b94b-83a67e8d4ddb"
2026-04-08T16:40:33.079820Z DEBUG discover_service_endpoint{service_type=Identity}: openstack_sdk::openstack_async: Finished service version discovery at https://keystone.yaook.svc:5000/v3/
2026-04-08T16:40:33.079853Z DEBUG openstack_sdk::state: Error opening file `/home/maha/.osc/3750912773873197974`: Os { code: 2, kind: NotFound, message: "No such file or directory" }
2026-04-08T16:40:33.079866Z DEBUG openstack_sdk::state: Error opening file `/home/maha/.osc/3750912773873197974`: Os { code: 2, kind: NotFound, message: "No such file or directory" }
Please provide the username for the cloud `default`:

If I interpret things correctly the SDK is ignoring the interface internal:

ServiceEndpoint { url: "https://keystone.yaook.svc:5000/v3", region: None, interface: Some("public")...

[gtema]

there are 2 places currently in the code that may be causing your issue (however I do not get the issue from the description itself):

• https://github.com/gtema/openstack/blob/main/openstack_sdk/src/openstack_async.rs#L251 - register the auth_url as the public endpoint for the identity which should be contacted for the discovery (there is no way to know in advance whether it is public or internal)
• https://github.com/gtema/openstack/blob/main/openstack_sdk/src/openstack_async.rs#L538 - process the endpoints from the catalog. I assume this is the place where any info about the interface is being lost since the called method uses the passed value as a filter and discards endpoints not matching it.

[mauhau]

Basically it looks like the configured interface is not getting used by the SDK but it always uses public.

Furthermore there is no error message etc. logged. The session is just not created.