OpenStack tenant is not visible or imported into VMware Avi Load Balancer

Products

• VMware Avi Load Balancer

Issue/Introduction

• When integrating an OpenStack cloud deployment with the VMware Avi Load Balancer, a newly created tenant inside OpenStack is not visible or listed under the Avi Controller Tenant. 

Environment

VMware AVI Load Balancer

OpenStack cloud

Cause

1. The Avi Controller's OpenStack cloud connector dynamically discovers and maps tenants based on the user sessions interacting with the Keystone API.
2. For the first time if a newly created tenant does not have any active user sessions mapping it back to Avi, or if the Keystone user account currently configured/used to authenticate with the Avi Cloud is not explicitly a member of that specific tenant, Avi will fail to import it automatically.
3. The entry can be identified in the controller's /var/lib/avi/log/cc_agent_<cloudname>.log confirming that the tenant synchronization/garbage collection is ignoring the new tenant because it hasn't been explicitly imported:
   e.g.:
   • • [20##-06-18 01:58:23,289] INFO [os_gc.gc_os_resources:740] Ignoring GC for tenant <tenant_name>, not imported in Avi

Resolution

To successfully import and map the missing OpenStack tenant into the Avi Controller, you must initiate an authentication sync using a Keystone user who is explicitly assigned to that tenant.

Steps to resolve:

1. Identify a valid OpenStack Keystone user account that is explicitly mapped as a member of the missing tenant.

   • Example: If User U1 is part of tenant T1, and T1 only contains user U1, you must use U1's credentials.

2. Log in to the Avi Controller using these specific user Keystone credentials.

3. Once authenticated, the Avi Cloud Connector will evaluate the user's Keystone project scope and automatically discover, sync, and import the missing tenant (T1) into the Avi Controller.

4. Verify the visibility of the tenant under the Avi Controller tenant dropdown menu.