HA deployments with ManageFirewall: True broken

[Ben Nemec]

Due to some missing pacemaker port openings, it is currently impossible to deploy with HA and ManageFirewall: True. The deploy hangs on the first overcloud services deployment step. Patches are already submitted to address this: https://review.openstack.org/#/c/330249/

That series (probably minus turning the firewall on by default, which would not be eligible for backport IMO) will also need backports to Mitaka and Liberty.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/330249
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=a4c9e1b9f64544e5be971481e2df205dc6f7634b
Submitter: Jenkins
Branch: master

commit a4c9e1b9f64544e5be971481e2df205dc6f7634b
Author: Ben Nemec <email address hidden>
Date: Wed Jun 15 17:25:18 2016 -0500

    Allow pacemaker ports in firewall

    This is required to allow ha deployments with ManageFirewall: True
    These are the ports documented in [1].

    1: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html-single/Configuring_the_Red_Hat_High_Availability_Add-On_with_Pacemaker/index.html#s1-firewalls-HAAR

    Change-Id: I446cc0ed863df15e28fa8ec1f5e2a06c5c03af8c
    Closes-Bug: 1594470

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/334022

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/liberty
Review: https://review.openstack.org/334026

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/334022
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=f45b6f4bdaa3d96dc21b08caaa1c5eb9118a9926
Submitter: Jenkins
Branch: stable/mitaka

commit f45b6f4bdaa3d96dc21b08caaa1c5eb9118a9926
Author: Ben Nemec <email address hidden>
Date: Wed Jun 15 17:25:18 2016 -0500

    Allow pacemaker ports in firewall

    This is required to allow ha deployments with ManageFirewall: True
    These are the ports documented in [1].

    1: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html-single/Configuring_the_Red_Hat_High_Availability_Add-On_with_Pacemaker/index.html#s1-firewalls-HAAR

    Change-Id: I446cc0ed863df15e28fa8ec1f5e2a06c5c03af8c
    Closes-Bug: 1594470
    (cherry picked from commit a4c9e1b9f64544e5be971481e2df205dc6f7634b)

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/tripleo-heat-templates 5.0.0.0b2 development milestone.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/334026
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=5678fb16213ddd60e0ee5b38c19d0b11699a8c3c
Submitter: Jenkins
Branch: stable/liberty

commit 5678fb16213ddd60e0ee5b38c19d0b11699a8c3c
Author: Ben Nemec <email address hidden>
Date: Wed Jun 15 17:25:18 2016 -0500

    Allow pacemaker ports in firewall

    This is required to allow ha deployments with ManageFirewall: True
    These are the ports documented in [1].

    1: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html-single/Configuring_the_Red_Hat_High_Availability_Add-On_with_Pacemaker/index.html#s1-firewalls-HAAR

    Change-Id: I446cc0ed863df15e28fa8ec1f5e2a06c5c03af8c
    Closes-Bug: 1594470
    (cherry picked from commit a4c9e1b9f64544e5be971481e2df205dc6f7634b)
    (cherry picked from commit f45b6f4bdaa3d96dc21b08caaa1c5eb9118a9926)

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/tripleo-heat-templates 2.1.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 2.1.0 release.