Fuel for OpenStack

Fuel UI page is not available

Bug #1521557 reported by Alexey Galkin on 2015-12-01

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	Fuel for OpenStack	Fix Released	Critical	Stanislaw Bogatkin	Fuel for OpenStack 8.0

Bug Description

Affected:

when deploying on server having an external address.

Steps to reproduce:

1.Deploy fuel 8.0 iso #233.
2.Try to received Fuel UI page.

Excepted result:
Successfully obtained the page content

Actual result:
Page not available.
http://paste.openstack.org/show/480484/

but if we repeat the same operation with the master node - it all works:

http://paste.openstack.org/show/480481/

VERSION:
  feature_groups:
    - mirantis
  production: "docker"
  release: "8.0"
  openstack_version: "2015.1.0-8.0"
  api: "1.0"
  build_number: "233"
  build_id: "233"
  fuel-nailgun_sha: "0a2f99530cf7246acf85db643032a0550168aac5"
  python-fuelclient_sha: "b1ffe1cae9ce7b612d3f746c8e2e2fde6f732748"
  fuel-agent_sha: "bd67efbadabfd8242c979c50b7d61a251621621a"
  fuel-nailgun-agent_sha: "a33a58d378c117c0f509b0e7badc6f0910364154"
  astute_sha: "b60624ee2c5f1d6d805619b6c27965a973508da1"
  fuel-library_sha: "ed9c5c91eda71bfcdcd3e08f91fa3627ea87829c"
  fuel-ostf_sha: "a98973482f839554d90cc1c071d625a01e018cfe"
  fuel-createmirror_sha: "3cb98030d4a12992ea1cda1f464f035980569d2f"
  fuelmenu_sha: "fcb15df4fd1a790b17dd78cf675c11c279040941"
  shotgun_sha: "25a0cc461a9fa4f7684f04cef0ff4ad9aa99a64d"
  network-checker_sha: "0b1b94a9685c6471d6911dff7ecac10b7bd2625f"
  fuel-upgrade_sha: "1e894e26d4e1423a9b0d66abd6a79505f4175ff6"
  fuelmain_sha: "2eca6adc33f02e02cd812e1d4be7c70e05fd07db"

UPDATE:

Tested on fuel 8.0 iso #212 - everything works correctly.

See original description

Tags:

Timur Nurlygayanov (tnurlygayanov) on 2015-12-01

Changed in fuel:
importance:	Undecided → Critical
status:	New → Confirmed
description:	updated

Timur Nurlygayanov (tnurlygayanov) on 2015-12-01

summary:

- Fuel-ui page not available
+ Fuel UI page is not available

Alexey Galkin (agalkin) on 2015-12-01

description:

updated

Revision history for this message

Timur Nurlygayanov (tnurlygayanov) wrote on 2015-12-01:

Hi dev team, looks like it is blocker for QA team

Dmitry Klenov (dklenov) on 2015-12-01

tags:

added: area-library

Stanislaw Bogatkin (sbogatkin) on 2015-12-01

Changed in fuel:
assignee:	Fuel Library Team (fuel-library) → Stanislaw Bogatkin (sbogatkin)

Revision history for this message

Stanislaw Bogatkin (sbogatkin) wrote on 2015-12-02:

Spawn a ha deployment on ISO 237, then:

^_^ -> curl -k https://10.109.0.2:8443
<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <title></title>
    <meta http-equiv="X-UA-Compatible" content="IE=Edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta name="theme-color" content="#394c59">
    <meta name="description" content="">
    <meta name="author" content="">
    <meta http-equiv="cache-control" content="no-cache" />
    <meta http-equiv="expires" content="0" />
    <meta http-equiv="pragma" content="no-cache" />
    <link rel="shortcut icon" href="static/favicon.ico" type="image/x-icon">
    <link rel="stylesheet" type="text/css" href="static/styles/layout.css">
    <script type="text/javascript">
      (function() {
        'use strict';
        var mainContainer, loadingErrors = [];

        function showError(error) {
          if (error) loadingErrors.push(error);
          if (mainContainer && loadingErrors.length) mainContainer.textContent = loadingErrors.join('; ');
        }

        function loadScript(src, errorMessage) {
          var script = document.createElement('script');
          script.type = 'text/javascript';
          script.src = src;
          script.onerror = showError.bind(null, errorMessage);
          document.head.appendChild(script);
        }

        document.addEventListener('DOMContentLoaded', function() {
          mainContainer = document.getElementById('main-container');
          mainContainer.style.display = 'block';
          showError();
        });

// checks code taken from https://github.com/Modernizr/Modernizr
var hasCookies = (function() {
... <omitted for brevity>

^_^ -> echo $?
0

So, bug reporter should look onto firewall rules on host node, probably. Marked as invalid.

Spawn a ha deployment on ISO 237, then:

^_^ -> curl -k https://10.109.0.2:8443                                                                                                                                                     
<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <title></title>
    <meta http-equiv="X-UA-Compatible" content="IE=Edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta name="theme-color" content="#394c59">
    <meta name="description" content="">
    <meta name="author" content="">
    <meta http-equiv="cache-control" content="no-cache" />
    <meta http-equiv="expires" content="0" />
    <meta http-equiv="pragma" content="no-cache" />
    <link rel="shortcut icon" href="static/favicon.ico" type="image/x-icon">
    <link rel="stylesheet" type="text/css" href="static/styles/layout.css">
    <script type="text/javascript">
      (function() {
        'use strict';
        var mainContainer, loadingErrors = [];

function showError(error) {
          if (error) loadingErrors.push(error);
          if (mainContainer && loadingErrors.length) mainContainer.textContent = loadingErrors.join('; ');
        }

// checks code taken from https://github.com/Modernizr/Modernizr
        var hasCookies = (function() {
... <omitted for brevity>

^_^ -> echo $?                                                                                                                                                                          
0

So, bug reporter should look onto firewall rules on host node, probably. Marked as invalid.

Changed in fuel:
status:	Confirmed → Invalid

Revision history for this message

Anastasia Palkina (apalkina) wrote on 2015-12-02:

I have working UI on ISO #233.

Revision history for this message

Vasily Gorin (vgorin) wrote on 2015-12-03:

Reproduced on iso 240.
It blocks me!

Steps to reproduce:
1.Deploy fuel(build 240)
2. Try to open fuel-ui page

Expected result:
I should be get login page

Actual result:
I have got only page with Fuel logo.

OS: Mac OS X Version 10.11.1
Browser: Safari Version 9.0.1(11601.2.72)

Changed in fuel:
status:	Invalid → Confirmed

Revision history for this message

Vasily Gorin (vgorin) wrote on 2015-12-03:

It doesn't work also in Chrome Version 47.0.2526.73(64-bit) on Mac OS X 10.11.1

Revision history for this message

Vasily Gorin (vgorin) wrote on 2015-12-03:

Sorry, It works already in Chrome(long page loading), but in Safari problem still exists.

Revision history for this message

Vitaly Kramskikh (vkramskikh) wrote on 2015-12-03:

As for Safari, there is a separate bug: https://bugs.launchpad.net/fuel/+bug/1519784

Changed in fuel:
status:	Confirmed → Fix Committed

Revision history for this message

Alexey Galkin (agalkin) wrote on 2015-12-03:

Stanislaw Bogatkin, this bug was reproduced on iso #243, but it not affected iso #212 and earlier. Deployment of all iso's versions perform the same.

Steps to reproduce:
1. Deploy fuel(build 243)
2. Try to open fuel-ui page

Excepted result:
Successfully obtained the page content

Actual result:
Page not available.

Results for fuel 8.0 iso #212: http://paste.openstack.org/show/480764
Results for fuel 8.0 iso #243: http://paste.openstack.org/show/480762

Changed in fuel:
status:	Fix Committed → Confirmed

Revision history for this message

Stanislaw Bogatkin (sbogatkin) wrote on 2015-12-03:

After getting access to bug reporter environment, I've got the problem. In I39df6c22ea78ae5628f964634a3251216c888507 we introduced rule for iptables which looks like

+ firewall { '044 fuelweb_local':
+ chain => $chain,
+ port => $fuelweb_port,
+ proto => 'tcp',
+ src_type => 'LOCAL',
+ action => 'accept',
+ }
+
+ firewall { '045 fuelweb_block_ext':
+ chain => $chain,
+ port => $fuelweb_port,
+ proto => 'tcp',
+ action => 'reject',
+ }
+

--src-type LOCAL means that all addresses which looks like local for node (based on routing table) will have an access and all other will not. In case of bug reporter "local" mean small /27 subnet but for my environment it was big /24 subnet and I have IP addresses for master node and host machine both from this subnet, so this rule didn't work for me, but worked for bug reporter.

Solution is simple - we need allow access for 8443 (https) port like we do this for 8000 (http) one.

Revision history for this message

Stanislaw Bogatkin (sbogatkin) wrote on 2015-12-03:

#10

As a workaround now we have rule which give an access to eth0 interface, but in bug reporter case, it isn't eth0 - it is another one. We shouldn't hardcode things like this.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2015-12-03: Fix proposed to fuel-library (master)

#11

Fix proposed to branch: master
Review: https://review.openstack.org/253063

Changed in fuel:
status:	Confirmed → In Progress

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2015-12-07: Fix merged to fuel-library (master)

#12

Reviewed: https://review.openstack.org/253063
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=9b9f73cfd5a37c4a4fedc455cafdf78e59fd5fdb
Submitter: Jenkins
Branch: master

commit 9b9f73cfd5a37c4a4fedc455cafdf78e59fd5fdb
Author: Stanislaw Bogatkin <email address hidden>
Date: Thu Dec 3 19:49:33 2015 +0300

Change firewall rules for UI https port to less strict ones

Open UI for have an ability to reach it from non-admin network, as user can
have several networks on master node from which he have to have access to UI.

Change-Id: Ieab40fae513e65784cb36a6d0a43ff794a82b030
Closes-Bug: #1521557

Changed in fuel:
status:	In Progress → Fix Committed

Revision history for this message

Vasily Gorin (vgorin) wrote on 2015-12-22:

#13

Verified on iso #328

Changed in fuel:
status:	Fix Committed → Fix Released

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.