Migrate from keystone v2.0 to v3 isn't as easy like just changing the endpoints at the database, every service must be configured to authenticate against keystone v3.
I've been working on that the past few days looking for a method, with the purpose of facilitate operators life's who need this kind of migration.
I have to thank Adam Young work, i followed his blog to make a first configuration idea, after that, i configured all core services to make use of keystone v3. If you want to check Adam's blog, follow this link: http://adam.younglogic.com/2015/05/rdo-v3-only/
I used OpenStack Liberty installed with RDO packstack over CentOS 7 servers. The example IP used is 192.168.200.168, use your own according your needs. Password used for all services is PASSWD1234, use your own password, you can locate your passwords at the packstack answer file.
Horizon
First we configure Horizon with keystone v3 as below:
mysql --user keystone_admin --password=PASSWD1234 keystone -e "select interface, url from endpoint where service_id = (select id from service where service.type = 'identity');"
Change your public, admin and internal endpoints with v3 at the end, instead of v2.0
mysql --user keystone_admin --password=PASSWD1234 keystone -e "update endpoint set url = 'http://192.168.200.178:5000/v3' where interface ='internal' and service_id = (select id from service where service.type = 'identity');"
mysql --user keystone_admin --password=PASSWD1234 keystone -e "update endpoint set url = 'http://192.168.200.178:5000/v3' where interface ='public' and service_id = (select id from service where service.type = 'identity');"
mysql --user keystone_admin --password=PASSWD1234 keystone -e "update endpoint set url = 'http://192.168.200.178:35357/v3' where interface ='admin' and service_id = (select id from service where service.type = 'identity');"
Ensure the endpoints are properly created
mysql --user keystone_admin --password=KEYSTONE_DB_PW keystone -e "select interface, url from endpoint where service_id = (select id from service where service.type = 'identity');"
Create a source file or edit keystonerc_admin with the following data
Comment both pipelines, in public_api and admin_api
vi /usr/share/keystone/keystone-dist-paste.ini
[pipeline:public_api]
# The last item in this pipeline must be public_service or an equivalent
# application. It cannot be a filter.
#pipeline = sizelimit url_normalize request_id build_auth_context token_auth admin_token_auth json_body ec2_extension user_crud_extension public_service
[pipeline:admin_api]
# The last item in this pipeline must be admin_service or an equivalent
# application. It cannot be a filter.
#pipeline = sizelimit url_normalize request_id build_auth_context token_auth admin_token_auth json_body ec2_extension s3_extension crud_extension admin_service
Comment v2.0 entries in composite:main and admin sections.
Edit nova.conf and add the auth content inside keystone_authtoken, don't forget to comment the lines related to the last auth method, which were commented in glance section.
Most issues occurs in the authentication between nova and neutron services, if instances does not launch as expected, review [nova] and [neutron] sections.
