【OpenStack】novaにてcinderボリュームをデタッチする時に「cindercllient.exceptions.ClientExceptin」が出てデタッチできない

OS：CentOS9Stream
OpenStack　Version：Anterope

nova-compute.logのエラー内容

2024-06-08 10:50:30.772 39033 WARNING os_brick.initiator.connectors.base [None req-3f355489-1527-4b96-a94e-06818e392779 11fd4f0c50f2488ea3e315773f7000c3 005a63fa957545ae81d3e9c89cbd7069 - - default default] Service needs to call os_brick.setup() before connecting volumes, if it doeskn't it will break on the next release
2024-06-08 10:50:31.504 39033 ERROR nova.volume.cinder [None req-3f355489-1527-4b96-a94e-06818e392779 11fd4f0c50f2488ea3e315773f7000c3 005a63fa957545ae81d3e9c89cbd7069 - - default default] Delete attachment failed for attachment 189e8ce6-d1cb-47bf-9732-c2b7388981bf. Error: ConflictNovaUsingAttachment: Detach volume from instance 6d287b5b-5dc6-4d01-9b4d-a1e65efeda33 using the Compute API (HTTP 409) (Request-ID: req-fd7cb88d-1e5d-4284-ae16-b86fcd60ebd0) Code: 409: cinderclient.exceptions.ClientException: ConflictNovaUsingAttachment: Detach volume from instance 6d287b5b-5dc6-4d01-9b4d-a1e65efeda33 using the Compute API (HTTP 409) (Request-ID: req-fd7cb88d-1e5d-4284-ae16-b86fcd60ebd0)
2024-06-08 10:50:31.550 39033 ERROR oslo_messaging.rpc.server [None req-3f355489-1527-4b96-a94e-06818e392779 11fd4f0c50f2488ea3e315773f7000c3 005a63fa957545ae81d3e9c89cbd7069 - - default default] Exception during message handling: cinderclient.exceptions.ClientException: ConflictNovaUsingAttachment: Detach volume from instance 6d287b5b-5dc6-4d01-9b4d-a1e65efeda33 using the Compute API (HTTP 409) (Request-ID: req-fd7cb88d-1e5d-4284-ae16-b86fcd60ebd0)


2024-06-08 10:50:31.550 39033 ERROR oslo_messaging.rpc.server cindercllient.exceptions.ClientExceptin: ConflictNovaUsingAttachment: Detach volume from instance 6d287b5b-5dc6-4d01-9b4d-a1e65efeda33 using the Compute API (HTTP 409) (Request-ID: req-fd7cb88d-1e5d-4284-ae16-b86fcd60ebd0)

仮想マシンにボリュームのアタッチはできるのだけど、デタッチする時にエラーとなってしまう。

どうやら、2023/5/10以降にリリースされたcinderでは、novaとcinderの連携時にservice_tokenを使うようにする必要があるということみたい。

https://docs.openstack.org/cinder/latest/configuration/block-storage/service-token.html

リファレンスの通り以下設定を入れるとうまくいくはず。

nova.conf(computeノード)

[keystone_authtoken]
service_token_roles_required = true
service_token_roles = service

[service_user]
send_service_user_token = true
auth_url = https://controller01.osp.local:5000
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = nova
password = servicepassword
insecure = true

cinder.conf(controllerノード)

[service_user]
send_service_user_token = true
auth_url = https://controller01.osp.local:5000
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = cinder
password = servicepassword
insecure = true

cinder.conf(storageノード)

[service_user]
send_service_user_token = true
auth_url = https://controller01.osp.local:5000
auth_type = password
project_domain_name = default
user_domain_name = default
project_name = service
username = cinder
password = servicepassword
insecure = true

service roleを作成する

openstack role create service
openstack role add --user cinder --project service service
openstack role add --user nova --project service service