newer versions of docker switch FORWARD chain to DROP by default
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
tripleo |
Fix Released
|
Critical
|
Alex Schultz |
Bug Description
see https:/
Newer versions of docker cause the FORWARD chain default action to be switched to DROP on the undercloud when it it is installed. This causes issues with deployments because traffic is no longer passing as expected.
Changed in tripleo: | |
assignee: | nobody → Alex Schultz (alex-schultz) |
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to puppet-tripleo (master) | #1 |
OpenStack Infra (hudson-openstack) wrote : Fix proposed to instack-undercloud (master) | #2 |
Fix proposed to branch: master
Review: https:/
Changed in tripleo: | |
status: | Triaged → In Progress |
OpenStack Infra (hudson-openstack) wrote : Related fix merged to puppet-tripleo (master) | #3 |
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: master
commit 21101149f269f13
Author: Alex Schultz <email address hidden>
Date: Sun Feb 18 11:01:04 2018 -0700
Add firewall chain support
Add ability to manage firewall chains with the firewallchain resource.
Change-Id: Ib75f97748540b9
Related-Bug: #1750194
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-heat-templates (master) | #4 |
Related fix proposed to branch: master
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Fix merged to instack-undercloud (master) | #5 |
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: master
commit da31c6e5baaf4ab
Author: Alex Schultz <email address hidden>
Date: Sun Feb 18 11:07:22 2018 -0700
Ensure FORWARD is ACCEPT by default
Newer versions of docker have switched to updating the FORWARD chain to
be DROP by default. This causes issues with the deployment. Update the
FORWARD chains to be ACCEPT by default.
Depends-On: Ib75f97748540b9
Closes-Bug: #1750194
Change-Id: I93be7138e6a61c
Changed in tripleo: | |
status: | In Progress → Fix Released |
OpenStack Infra (hudson-openstack) wrote : Related fix merged to tripleo-heat-templates (master) | #6 |
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: master
commit a1ec856e61532da
Author: Alex Schultz <email address hidden>
Date: Mon Feb 19 15:10:01 2018 -0700
Add firewall chain configuration
Adds the ability to specify firewall chains via heat templates.
Additionally newer versions of docker have switched to updating
the FORWARD chain to DROP by default. Neutron needs this to be
ACCEPT by default. This change adds the ability to specify
firewall chains via templates.
Depends-On: Ib75f97748540b9
Change-Id: I15ec9216013a1b
Related-Bug: #1750194
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to puppet-tripleo (stable/pike) | #7 |
Related fix proposed to branch: stable/pike
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Fix proposed to instack-undercloud (stable/pike) | #8 |
Fix proposed to branch: stable/pike
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-heat-templates (stable/pike) | #9 |
Related fix proposed to branch: stable/pike
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to instack-undercloud (master) | #10 |
Related fix proposed to branch: master
Review: https:/
OpenStack Infra (hudson-openstack) wrote : | #11 |
Related fix proposed to branch: master
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Fix proposed to instack-undercloud (master) | #12 |
Fix proposed to branch: master
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Change abandoned on instack-undercloud (master) | #13 |
Change abandoned by Alex Schultz (<email address hidden>) on branch: master
Review: https:/
Reason: https:/
OpenStack Infra (hudson-openstack) wrote : | #14 |
Change abandoned by Alex Schultz (<email address hidden>) on branch: master
Review: https:/
Reason: https:/
Changed in tripleo: | |
status: | Fix Released → In Progress |
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to puppet-tripleo (master) | #15 |
Related fix proposed to branch: master
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-heat-templates (master) | #16 |
Related fix proposed to branch: master
Review: https:/
Changed in tripleo: | |
importance: | High → Critical |
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to instack-undercloud (master) | #17 |
Related fix proposed to branch: master
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Fix merged to instack-undercloud (master) | #18 |
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: master
commit bfb758b5e792c83
Author: Alex Schultz <email address hidden>
Date: Thu Feb 22 23:01:49 2018 -0700
Fix bootstrap NAT
Docker will switch the FORWARD filter to DROP if it sets the ip_forward
to 1. Previously we were doing this in a post configuration element
rather than in the puppet run itself. This change moves the ip_forward=1
to puppet so it runs prior to docker being installed. Additionally we
are ensuring that the full set of network rules are being added to the
FORWARD filter because previously we were only setting half of them.
This would allow us to actually not have to use ACCEPT as the default
for the FORWARD filter but this would require additional testing.
Previously we had tried switching the default policy back to ACCEPT,
however given that docker is not configuring the iptables rule until
it's installed and started, the puppet rules do not actually apply on
the installation of the undercloud. The puppet management of the
defaults for the FORWARD chain only gets updated on a subsequent run of
the installer which will not work.
Change-Id: Ieae6a74f7269bd
Closes-Bug: #1750194
Closes-Bug: #1750874
Changed in tripleo: | |
status: | In Progress → Fix Released |
OpenStack Infra (hudson-openstack) wrote : Fix proposed to instack-undercloud (stable/pike) | #19 |
Fix proposed to branch: stable/pike
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Fix merged to instack-undercloud (stable/pike) | #20 |
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: stable/pike
commit 50217d7a93dce7f
Author: Alex Schultz <email address hidden>
Date: Thu Feb 22 23:01:49 2018 -0700
Fix bootstrap NAT
Docker will switch the FORWARD filter to DROP if it sets the ip_forward
to 1. Previously we were doing this in a post configuration element
rather than in the puppet run itself. This change moves the ip_forward=1
to puppet so it runs prior to docker being installed. Additionally we
are ensuring that the full set of network rules are being added to the
FORWARD filter because previously we were only setting half of them.
This would allow us to actually not have to use ACCEPT as the default
for the FORWARD filter but this would require additional testing.
Conflicts:
instack_
instack_
Change-Id: Ieae6a74f7269bd
Closes-Bug: #1750194
Closes-Bug: #1750874
(cherry picked from commit bfb758b5e792c83
tags: | added: in-stable-pike |
OpenStack Infra (hudson-openstack) wrote : Change abandoned on instack-undercloud (stable/pike) | #21 |
Change abandoned by Alex Schultz (<email address hidden>) on branch: stable/pike
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Change abandoned on puppet-tripleo (stable/pike) | #22 |
Change abandoned by Alex Schultz (<email address hidden>) on branch: stable/pike
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Change abandoned on tripleo-heat-templates (stable/pike) | #23 |
Change abandoned by Alex Schultz (<email address hidden>) on branch: stable/pike
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/instack-undercloud 8.3.0 | #24 |
This issue was fixed in the openstack/
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to puppet-tripleo (master) | #26 |
Related fix proposed to branch: master
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Change abandoned on puppet-tripleo (master) | #27 |
Change abandoned by Alex Schultz (<email address hidden>) on branch: master
Review: https:/
Reason: this won't work due to stages, we need to be targeted
OpenStack Infra (hudson-openstack) wrote : Change abandoned on instack-undercloud (master) | #28 |
Change abandoned by Alex Schultz (<email address hidden>) on branch: master
Review: https:/
Reason: this doesn't work
OpenStack Infra (hudson-openstack) wrote : Related fix merged to puppet-tripleo (master) | #29 |
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: master
commit 20cdbd3c6b18bb8
Author: Alex Schultz <email address hidden>
Date: Mon Mar 5 12:23:05 2018 -0700
Ensure ip_forward set before Docker
Docker will attempt to configure iptables rules if it finds that
ip_forward is not enabled prior to the docker daemon getting started.
We should ensure that this gets configured prior to Docker being
configured if we are configuring it with puppet.
Change-Id: I6ea6fb8ed300d2
Needed-By: I557e4a41c4e5be
Related-Bug: #1750194
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to puppet-tripleo (stable/queens) | #30 |
Related fix proposed to branch: stable/queens
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to puppet-tripleo (stable/pike) | #31 |
Related fix proposed to branch: stable/pike
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/instack-undercloud 7.4.10 | #32 |
This issue was fixed in the openstack/
OpenStack Infra (hudson-openstack) wrote : Related fix merged to puppet-tripleo (stable/pike) | #33 |
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: stable/pike
commit 7a1b8c7ab47ccec
Author: Alex Schultz <email address hidden>
Date: Mon Mar 5 12:23:05 2018 -0700
Ensure ip_forward set before Docker
Docker will attempt to configure iptables rules if it finds that
ip_forward is not enabled prior to the docker daemon getting started.
We should ensure that this gets configured prior to Docker being
configured if we are configuring it with puppet.
Change-Id: I6ea6fb8ed300d2
Needed-By: I557e4a41c4e5be
Related-Bug: #1750194
(cherry picked from commit 20cdbd3c6b18bb8
OpenStack Infra (hudson-openstack) wrote : Related fix merged to puppet-tripleo (stable/queens) | #34 |
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: stable/queens
commit 2083903250d4e51
Author: Alex Schultz <email address hidden>
Date: Mon Mar 5 12:23:05 2018 -0700
Ensure ip_forward set before Docker
Docker will attempt to configure iptables rules if it finds that
ip_forward is not enabled prior to the docker daemon getting started.
We should ensure that this gets configured prior to Docker being
configured if we are configuring it with puppet.
Change-Id: I6ea6fb8ed300d2
Needed-By: I557e4a41c4e5be
Related-Bug: #1750194
(cherry picked from commit 20cdbd3c6b18bb8
tags: | added: in-stable-queens |
OpenStack Infra (hudson-openstack) wrote : Related fix merged to tripleo-heat-templates (master) | #35 |
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: master
commit 75ee85b1e45b09a
Author: Alex Schultz <email address hidden>
Date: Tue Feb 27 12:52:55 2018 -0700
Add KernelIpForward configuration
Expose the configuration of net.ipv4.ip_forward via the kernel service.
Depends-On: I6ea6fb8ed300d2
Change-Id: I557e4a41c4e5be
Related-Bug: #1750194
OpenStack Infra (hudson-openstack) wrote : Related fix proposed to tripleo-heat-templates (stable/queens) | #36 |
Related fix proposed to branch: stable/queens
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Related fix merged to tripleo-heat-templates (stable/queens) | #37 |
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: stable/queens
commit 25eba575b5cc959
Author: Alex Schultz <email address hidden>
Date: Tue Feb 27 12:52:55 2018 -0700
Add KernelIpForward configuration
Expose the configuration of net.ipv4.ip_forward via the kernel service.
Depends-On: I6ea6fb8ed300d2
Change-Id: I557e4a41c4e5be
Related-Bug: #1750194
(cherry picked from commit 75ee85b1e45b09a
OpenStack Infra (hudson-openstack) wrote : Fix proposed to instack-undercloud (stable/ocata) | #38 |
Fix proposed to branch: stable/ocata
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Fix proposed to instack-undercloud (stable/newton) | #39 |
Fix proposed to branch: stable/newton
Review: https:/
OpenStack Infra (hudson-openstack) wrote : Fix merged to instack-undercloud (stable/newton) | #40 |
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: stable/newton
commit 663dad2a37fed79
Author: Alex Schultz <email address hidden>
Date: Thu Feb 22 23:01:49 2018 -0700
Fix bootstrap NAT
Docker will switch the FORWARD filter to DROP if it sets the ip_forward
to 1. Previously we were doing this in a post configuration element
rather than in the puppet run itself. This change moves the ip_forward=1
to puppet so it runs prior to docker being installed. Additionally we
are ensuring that the full set of network rules are being added to the
FORWARD filter because previously we were only setting half of them.
This would allow us to actually not have to use ACCEPT as the default
for the FORWARD filter but this would require additional testing.
Conflicts:
elements/
elements/
Change-Id: Ieae6a74f7269bd
Closes-Bug: #1750194
Closes-Bug: #1750874
(cherry picked from commit bfb758b5e792c83
(cherry picked from commit 50217d7a93dce7f
tags: | added: in-stable-newton |
OpenStack Infra (hudson-openstack) wrote : Fix merged to instack-undercloud (stable/ocata) | #41 |
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: stable/ocata
commit 256fecbf508f075
Author: Alex Schultz <email address hidden>
Date: Thu Feb 22 23:01:49 2018 -0700
Fix bootstrap NAT
Docker will switch the FORWARD filter to DROP if it sets the ip_forward
to 1. Previously we were doing this in a post configuration element
rather than in the puppet run itself. This change moves the ip_forward=1
to puppet so it runs prior to docker being installed. Additionally we
are ensuring that the full set of network rules are being added to the
FORWARD filter because previously we were only setting half of them.
This would allow us to actually not have to use ACCEPT as the default
for the FORWARD filter but this would require additional testing.
Conflicts:
elements/
elements/
Change-Id: Ieae6a74f7269bd
Closes-Bug: #1750194
Closes-Bug: #1750874
(cherry picked from commit bfb758b5e792c83
(cherry picked from commit 50217d7a93dce7f
tags: | added: in-stable-ocata |
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/instack-undercloud 6.1.6 | #42 |
This issue was fixed in the openstack/
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/instack-undercloud 5.3.8 | #43 |
This issue was fixed in the openstack/
Related fix proposed to branch: master /review. openstack. org/545707
Review: https:/