Access to keystone is denied for requests outside Fuel master node in CentOS7 (Fuel 8 build 310)

[Mikhail Chernik]

Due to blocked access to keystone it is currently impossible to run e.g. scripts which use nailgun API from a host outside cluster on Fuel 8.0 build 310.

Following rules in keystone container blocks access:

26 48 2880 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport ports 5000 ADDRTYPE match src-type LOCAL /* 047 keystone_local */
27 11 660 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport ports 5000 /* 048 keystone_block_ext */ reject-with icmp-port-unreachable

[Alexander Makarov (amakarov)]

It has nothing with keystone. Please reassign to proper team. For example to those, who develops those scripts.

[Aleksander Mogylchenko (amogylchenko)]

By default access to keystone is blocked from all networks but admin:
https://github.com/openstack/fuel-library/blob/master/deployment/puppet/nailgun/manifests/iptables.pp#L200

What is your setup? How many networks? Can you provide iptables rules here?

[Aleksander Mogylchenko (amogylchenko)]

Sorry, correct link should be:
https://github.com/openstack/fuel-library/blob/master/deployment/puppet/nailgun/manifests/iptables.pp#L223

[Mikhail Chernik (mchernik)]

We have a Jenkins job which creates and deploys a cluster with script. It runs on Jenkins slave host and interacts with Fuel by means of Nailgun API, so the source of requests is outside the cluster network address space.

[Matthew Mosesohn (raytrac3r)]

What address are you interacting with? It should be on the same network as Fuel admin IP. We explictly block it to reduce threats. Your job could add an extra iptables rule.

[Igor Marnat (imarnat)]

Why is it medium? If this problem affects results of automated tests, it should be at least high. Raising to high.

[Mikhail Chernik (mchernik)]

We use the public interface of Fuel master node, the same which serves Fuel UI.

Adding an iptables rule is not a problem, but does it mean there is no more automation API available from, say, an engneer's host?

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/252550

[Matthew Mosesohn (raytrac3r)]

If swift tries to set up on /srv/node instead of /var/lib/glance/node ( https://github.com/openstack/fuel-library/blob/master/deployment/puppet/osnailyfacter/modular/swift/swift.pp#L53 ), then something is being configured wrong

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/252550
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=916676b1e3d8b1b388ecfbb352114af5b99acc83
Submitter: Jenkins
Branch: master

commit 916676b1e3d8b1b388ecfbb352114af5b99acc83
Author: Ivan Suzdal <email address hidden>
Date: Wed Dec 2 21:47:47 2015 +0300

    Allow access to keystone_port from anywhere.

    Change-Id: I24ca56c709c26e79a63521f265534219a6322a1c
    Closes-Bug: #1521955

[Egor Kotko (ykotko)]

ISO #506