OpenStack Shared File Systems Service (Manila)

manila's devstack plugin fails with tls_proxy enabled

Bug #1816836 reported by Goutham Pacha Ravi on 2019-02-20

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	OpenStack Shared File Systems Service (Manila)	Fix Released	Medium	Goutham Pacha Ravi	OpenStack Shared File Systems Service (Manila) stein-3

Bug Description

This bug was exposed in https://review.openstack.org/#/c/625191/ (Relevant log files have been attached to this bug report). Manila's devstack plugin sets the listen port to 18786 when tls_proxy has been enabled on devstack, but performs a health check on the API service on the default/non-tls port (8786) [2]. This check causes devstack to fail.

[1] https://github.com/openstack/manila/blob/22d25e8/devstack/plugin.sh#L280
[2] https://github.com/openstack/manila/blob/22d25e8/devstack/plugin.sh#L830

Tags:

Goutham Pacha Ravi (gouthamr) on 2019-02-20

Changed in manila:
importance:	Undecided → Medium

Tom Barron (tpb) on 2019-02-20

Changed in manila:
milestone:	none → stein-3
tags:	added: devstack tls

Revision history for this message

Goutham Pacha Ravi (gouthamr) wrote on 2019-02-20:

devstacklog_ 625191.txt Edit (8.5 MiB, text/plain)

DevStack log from review https://review.openstack.org/#/c/625191/8

Revision history for this message

Goutham Pacha Ravi (gouthamr) wrote on 2019-02-20:

manila_conf_625191.txt Edit (7.6 KiB, text/plain)

Manila config log from https://review.openstack.org/#/c/625191/8

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-02-21: Fix proposed to manila (master)

Fix proposed to branch: master
Review: https://review.openstack.org/638320

Changed in manila:
assignee:	nobody → Goutham Pacha Ravi (gouthamr)
status:	New → In Progress

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-02-21: Related fix proposed to manila (master)

Related fix proposed to branch: master
Review: https://review.openstack.org/638335

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-02-21: Change abandoned on manila (master)

Change abandoned by Goutham Pacha Ravi (<email address hidden>) on branch: master
Review: https://review.openstack.org/638335
Reason: Will revisit with zuulv3, the variable used here is wrong, I should have used devstack_services, however some of our jobs use OVERRIDE_ENABLED_SERVICES, which may break things.

Tom Barron (tpb) on 2019-02-22

tags:

added: security

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-03-01: Fix merged to manila (master)

Reviewed: https://review.openstack.org/638320
Committed: https://git.openstack.org/cgit/openstack/manila/commit/?id=8f1c7dc91fb1e00784f6228526d95f4434ba8a01
Submitter: Zuul
Branch: master

commit 8f1c7dc91fb1e00784f6228526d95f4434ba8a01
Author: Goutham Pacha Ravi <email address hidden>
Date: Wed Feb 20 18:00:45 2019 -0800

Fix tls-proxy issues with the devstack plugin

    Enabling tls-proxy allows devstack to
    set up a tls proxy server that front-ends
    interactions with the manila-api and
    terminates tls connections.

    Also enable tls-proxy in dummy and lvm
    jobs. The dummy driver job is configured
    to run the in-built wsgi server, the lvm
    job is configured to use mod-wsgi.

Closes-Bug: #1816836
Change-Id: I48b0ccc082604d78242ba61bee94a45efeb2467b

Changed in manila:
status:	In Progress → Fix Released

Goutham Pacha Ravi (gouthamr) on 2019-03-01

tags:

added: backport-potential

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-03-01: Fix proposed to manila (stable/rocky)

Fix proposed to branch: stable/rocky
Review: https://review.openstack.org/640230

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-03-01: Change abandoned on manila (stable/rocky)

Change abandoned by Goutham Pacha Ravi (<email address hidden>) on branch: stable/rocky
Review: https://review.openstack.org/640230

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-03-19: Fix merged to manila (stable/rocky)

Reviewed: https://review.openstack.org/640230
Committed: https://git.openstack.org/cgit/openstack/manila/commit/?id=edc60f76c2818351f8a6d1090a5549970b1891cc
Submitter: Zuul
Branch: stable/rocky

commit edc60f76c2818351f8a6d1090a5549970b1891cc
Author: Goutham Pacha Ravi <email address hidden>
Date: Wed Feb 20 18:00:45 2019 -0800

Fix tls-proxy issues with the devstack plugin

    Enabling tls-proxy allows devstack to
    set up a tls proxy server that front-ends
    interactions with the manila-api and
    terminates tls connections.

    Also enable tls-proxy in dummy and lvm
    jobs. The dummy driver job is configured
    to run the in-built wsgi server, the lvm
    job is configured to use mod-wsgi.

    Closes-Bug: #1816836
    Change-Id: I48b0ccc082604d78242ba61bee94a45efeb2467b
    (cherry picked from commit 8f1c7dc91fb1e00784f6228526d95f4434ba8a01)

tags:

added: in-stable-rocky

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-03-22: Fix included in openstack/manila 8.0.0.0rc1

#10

This issue was fixed in the openstack/manila 8.0.0.0rc1 release candidate.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-03-26: Fix included in openstack/manila 7.2.0

#11

This issue was fixed in the openstack/manila 7.2.0 release.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-04-15: Fix proposed to manila (stable/queens)

#12

Fix proposed to branch: stable/queens
Review: https://review.openstack.org/652769

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-04-16: Fix merged to manila (stable/queens)

#13

Reviewed: https://review.openstack.org/652769
Committed: https://git.openstack.org/cgit/openstack/manila/commit/?id=72fb56c5c4ffef535ed046bc1fb73eef68f13612
Submitter: Zuul
Branch: stable/queens

commit 72fb56c5c4ffef535ed046bc1fb73eef68f13612
Author: Goutham Pacha Ravi <email address hidden>
Date: Wed Feb 20 18:00:45 2019 -0800

Fix tls-proxy issues with the devstack plugin

    Enabling tls-proxy allows devstack to
    set up a tls proxy server that front-ends
    interactions with the manila-api and
    terminates tls connections.

    Also enable tls-proxy in dummy and lvm
    jobs. The dummy driver job is configured
    to run the in-built wsgi server, the lvm
    job is configured to use mod-wsgi.

    Closes-Bug: #1816836
    Change-Id: I48b0ccc082604d78242ba61bee94a45efeb2467b
    (cherry picked from commit 8f1c7dc91fb1e00784f6228526d95f4434ba8a01)
    (cherry picked from commit edc60f76c2818351f8a6d1090a5549970b1891cc)