kolla issue with multiple nova_consoleauth and HA

[James McCarthy]

I believe I have run into this issue here:
https://bugs.launchpad.net/nova/+bug/989337

In a test setup with 2 x control nodes and 2 x compute nodes, attempts to access the console of an instance only succeed 50% of the time.

I found if I shut down one of the nova_consoleauth containers, then it worked 100% of the time.

One workaround seems to be to adjust the inventory to do just that, by including a specific host here, vs 'nova' which it is typically. (I have not yet actually tested this workaround) - but definitely, manually stopping one of the nova_consoleauth containers prevents the failures.

[nova-consoleauth:children]
control01

Another potential way to address this is to bring memcache into the mix. By having memcache in the configuration here should also circumvent the issue.

[Sam Yaple (s8m)]

Sorry guys. been meaning to fix this. I brought this up in the HA documents. There are two ways to fix this.

1. Setup HAproxy as source balanced for Horizon and nova-consoleauth
2. Setup Horizon and nova-consoleauth to use memcached

I do not like memcached due to its nature. It has no security and with a single oneliner you can rip all of the valid tokens out of a memcached server. Since most environments are not configured correctly from a network security point of view what ends up happening is that from an unprivileged guest in a VM I can get undetected admin access to the entire OpenStack environment.

As such, I am strongly against making anything memcache the default option, but I am ok with making it configurable. I will work up the source patch today and we can discuss it on Wednesday.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/233430

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/233430
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=2ea87ebdb7b15011c2825d23dc160ef0aa76fa0e
Submitter: Jenkins
Branch: master

commit 2ea87ebdb7b15011c2825d23dc160ef0aa76fa0e
Author: Sam Yaple <email address hidden>
Date: Thu Oct 15 08:54:36 2015 +0000

    Use memcache for consoleauth and horizon

    Unfortunately there was no was to avoid memcache for consoleauth, so
    we might as well take advantage of it for Horizon as well.

    Change-Id: Idd338a025b031f6b50fe0c9f03c2c8d862f9d4c0
    Closes-Bug: #1504606
    Closes-Bug: #1504800

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/liberty
Review: https://review.openstack.org/235409

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/235409
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=6f24cac8416fc09bc5b9a2a74a8b303f7d1ef5f4
Submitter: Jenkins
Branch: stable/liberty

commit 6f24cac8416fc09bc5b9a2a74a8b303f7d1ef5f4
Author: Sam Yaple <email address hidden>
Date: Thu Oct 15 08:54:36 2015 +0000

    Use memcache for consoleauth and horizon

    Unfortunately there was no was to avoid memcache for consoleauth, so
    we might as well take advantage of it for Horizon as well.

    Change-Id: Idd338a025b031f6b50fe0c9f03c2c8d862f9d4c0
    Closes-Bug: #1504606
    Closes-Bug: #1504800
    (cherry picked from commit 2ea87ebdb7b15011c2825d23dc160ef0aa76fa0e)