After restore fuel master node iptables rules contain extra records

[Kirill Omelchenko]

http://jenkins-product.srt.mirantis.net:8080/view/0_master_swarm/job/master_fuelmain.system_test.centos.thread_1/149/testReport/%28root%29/backup_restore_master_base/backup_restore_master_base/

After restore of backed up master node two iptable rules appear:

-A FORWARD -i eth0 -o docker0 -p tcp -m state --state NEW -m tcp --dport 8000 -m comment --comment "nginx-tcp-8000-accept" -j ACCEPT
-A POSTROUTING -s 10.108.25.0/24 -p tcp -m tcp --dport 8000 -m comment --comment "nginx-tcp-8000-unmasquerade" -j ACCEPT

which doesn't seem to affect master node in any way
(manual deletion of those rules makes no observable changes, Fuel web-UI is accessible)

[Matthew Mosesohn (raytrac3r)]

This is an issue where iptables fails to insert rules under heavy load. This is going to be intermittent and not easy to fix.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/117496

[Kirill Omelchenko (komelchenko)]

After the fix rules regarding ports 8000, 8080 start to randomly disappear on the restored system.

[Matthew Mosesohn (raytrac3r)]

Based on the conversation with Kirill, the insertion of rules randomly works and fails. It needs to be refactored and thoroughly tested. There needs to be more serious research here to figure out the best way to handle this. Moving to 6.0.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Matthew Mosesohn (<email address hidden>) on branch: master
Review: https://review.openstack.org/117496
Reason: this does not solve the iptables bug because results are still random and unpredictable.

[Dmitry Borodaenko (angdraug)]

Proposed change was abandoned, resetting status back to Confirmed.

[Matthew Mosesohn (raytrac3r)]

The best way to solve this is to upgrade Docker, so we don't have to use iptables workarounds for this outdated docker we're running. We won't need all the ugly hacks for deploying on Docker.

[Matthew Mosesohn (raytrac3r)]

6.0 release-notes info: Sometimes iptables rules are missing immediately after restoring a Fuel deployment. This can be worked around in most cases by restarting Fuel Master.

[Matthew Mosesohn (raytrac3r)]

added to release notes: https://review.openstack.org/#/c/133022/

[Vladimir Kuklin (vkuklin)]

Docker was upgraded to 1.4.x in 6.1 release