ODL + VPP security group failed

[Ashley Lai]

ODL+VPP deployed successful but failed on security group.

jenkins@s9l:~/bin$ nova secgroup-list
ERROR: The server has either erred or is incapable of performing the requested operation. (HTTP 500) (Request-ID: req-cb7ed65e-60f0-4f32-87da-c0d3e6b5ed2f)
jenkins@s9l:~/bin$ nova secgroup-add-rule default tcp 22 22 0.0.0.0/0
ERROR: The server has either erred or is incapable of performing the requested operation. (HTTP 500) (Request-ID: req-366e1434-5a2d-4d0b-8891-9f9efa633723)
jenkins@s9l:~/bin$

bundle:
oil_deployment:
  bootstrap:
    to:
    - maas=apsaras.oil
  overrides:
    openstack-origin: ppa:cisco-vpp/icehouse-proposed
  relations:
  - - keystone
    - mysql
  - - nova-cloud-controller
    - glance
  - - nova-cloud-controller
    - keystone
  - - nova-cloud-controller
    - mysql
  - - nova-cloud-controller
    - rabbitmq-server
  - - glance
    - keystone
  - - glance
    - mysql
  - - cinder
    - glance
  - - cinder
    - keystone
  - - cinder
    - nova-cloud-controller
  - - cinder
    - mysql
  - - cinder
    - rabbitmq-server
  - - openstack-dashboard
    - keystone
  - - heat
    - mysql
  - - heat
    - rabbitmq-server
  - - heat
    - keystone
  - - ceilometer:identity-service
    - keystone:identity-service
  - - ceilometer
    - rabbitmq-server
  - - ceilometer
    - mongodb
  - - ceilometer-agent
    - ceilometer
  - - nova-compute:amqp
    - rabbitmq-server:amqp
  - - nova-compute
    - nova-cloud-controller
  - - nova-compute
    - glance
  - - ceilometer-agent
    - nova-compute
  - - neutron-api:neutron-plugin-api-subordinate
    - neutron-api-odl:neutron-plugin-api-subordinate
  - - nova-compute:neutron-plugin
    - openvswitch-odl:neutron-plugin
  - - neutron-gateway
    - openvswitch-odl
  - - openvswitch-odl:ovsdb-manager
    - odl-controller:ovsdb-manager
  - - neutron-api-odl:odl-controller
    - odl-controller:controller-api
  - - neutron-api
    - mysql
  - - neutron-api
    - rabbitmq-server
  - - neutron-api
    - nova-cloud-controller
  - - neutron-api
    - keystone
  - - neutron-gateway:amqp
    - rabbitmq-server:amqp
  - - neutron-gateway:neutron-plugin-api
    - neutron-api:neutron-plugin-api
  - - neutron-gateway
    - nova-cloud-controller
  - - odl-controller:controller-api
    - openvswitch-odl:controller-api
  - - ceph
    - glance
  - - ceph
    - nova-compute
  - - ceph
    - cinder
  series: trusty
  services:
    ceilometer:
      branch: lp:charms/ceilometer
      to:
      - lxc:ceph=0
    ceilometer-agent:
      branch: lp:charms/ceilometer-agent
    ceph:
      branch: lp:charms/ceph
      hwreqs:
        storage: /dev/fioa /dev/sdb /dev/sdc /dev/sdd /dev/sde /dev/sdf /dev/sdg /dev/sdh
          /dev/sdj
      num_units: 1
      options:
        fsid: 6547bd3e-1397-11e2-82e5-53567c8d32dc
        monitor-count: 1
        monitor-secret: AQCXrnZQwI7KGBAAiPofmKEXKxu5bUzoYLVkbQ==
        osd-devices: /dev/fioa /dev/sdb /dev/sdc /dev/sdd /dev/sde /dev/sdf /dev/sdg
          /dev/sdh /dev/sdj
        osd-reformat: 'yes'
      to:
      - maas=arnolt.oil
    cinder:
      branch: lp:charms/trusty/cinder
      options:
        block-device: None
        ceph-osd-replication-count: 1
        glance-api-version: 2
        overwrite: 'true'
        remove-missing-force: true
      to:
      - maas=gulon.oil
    glance:
      branch: lp:charms/trusty/glance
      options:
        ceph-osd-replication-count: 1
        debug: false
        verbose: false
      to:
      - lxc:cinder=0
    heat:
      branch: lp:charms/heat
      to:
      - lxc:neutron-gateway=0
    keystone:
      branch: lp:charms/trusty/keystone
      options:
        admin-password: openstack
        admin-token: ubuntutesting
      to:
      - lxc:nova-cloud-controller=0
    mongodb:
      branch: lp:charms/trusty/mongodb
      to:
      - lxc:ceph=0
    mysql:
      branch: lp:charms/trusty/mysql
      options:
        max-connections: 300
      to:
      - lxc:cinder=0
    neutron-api:
      branch: lp:charms/trusty/neutron-api
      options:
        manage-neutron-plugin-legacy-mode: false
        neutron-security-groups: true
      to:
      - lxc:neutron-gateway=0
    neutron-api-odl:
      branch: lp:~openstack-charmers/charms/trusty/neutron-api-odl/vpp
      options:
        overlay-network-type: vxlan gre
        security-groups: false
    neutron-gateway:
      branch: lp:charms/trusty/neutron-gateway
      options:
        instance-mtu: 1400
        plugin: ovs-odl
      to:
      - maas=hayward-10.oil
    nova-cloud-controller:
      branch: lp:charms/trusty/nova-cloud-controller
      to:
      - maas=hayward-19.oil
    nova-compute:
      branch: lp:charms/trusty/nova-compute
      hwreqs:
        compute: kvm
      num_units: 1
      options:
        enable-live-migration: false
        hugepages: 70%
        manage-neutron-plugin-legacy-mode: false
        virt-type: kvm
      to:
      - ceph=0
    odl-controller:
      branch: lp:~sdn-charmers/charms/trusty/odl-controller/trunk
      options:
        install-url: http://10.245.0.10/odl/distribution-karaf-1.1.0-10009.tar.gz
        profile: cisco-vpp
      to:
      - lxc:nova-cloud-controller=0
    openstack-dashboard:
      branch: lp:charms/trusty/openstack-dashboard
      to:
      - lxc:ceph=0
    openvswitch-odl:
      branch: lp:~openstack-charmers/charms/trusty/openvswitch-odl/trunk
    rabbitmq-server:
      branch: lp:charms/trusty/rabbitmq-server
      to:
      - lxc:cinder=0
  total_machines: 5

[Ashley Lai (alai)]

Keystone log shows:

(keystone.common.wsgi): 2015-11-24 18:59:29,193 WARNING Could not find token, 79dfb53f59e341438aa75936a03e1881.
(keystone.common.wsgi): 2015-11-24 19:59:29,262 WARNING Could not find token, fb9bd502f68f4fa3a3f9ea3ab078592c.

[James Page (james-page)]

This is the issue:

    neutron-api-odl:
      branch: lp:~openstack-charmers/charms/trusty/neutron-api-odl/vpp
      options:
        overlay-network-type: vxlan gre
        security-groups: false

security-groups: True should resolve this; be aware that we've seen some issues with ODL/OpenStack in consistently applying security groups to instances.

[James Page (james-page)]

Also please could you use:

  lp:~openstack-charmers/charms/trusty/neutron-api-odl/next

Thanks!

[David Ames (thedac)]

Ashely,

Two things. Please retry with secutiry-groups set to true

    neutron-api-odl:
      branch: lp:~openstack-charmers/charms/trusty/neutron-api-odl/vpp
      options:
        overlay-network-type: vxlan gre
        security-groups: true

Second, there is a bug for ODL itself (not the charms) where secgroups work intermittently. I'll get you that bug shortly.

[Ashley Lai (alai)]

Thanks James and David for the help. I've tried the two suggestions and was able to create security group. However when launching the VM it gave me the following error. Is this a known issue you mention above? Thanks.

$ nova boot --flavor 2 --image a0a75f2a-3c69-41cd-9048-dd2070073703 --key-name ashleykey --nic net-id=59569d99-1886-4194-a9e2-662c538c3d77 --security_group default precise_VM

$ nova list
+--------------------------------------+--------------------------+--------+------------+-------------+----------+
| ID | Name | Status | Task State | Power State | Networks |
+--------------------------------------+--------------------------+--------+------------+-------------+----------+
| c7607b2b-d4bd-4df5-ad88-ed830ce9b396 | precise_VM | ERROR | - | NOSTATE | |
+--------------------------------------+--------------------------+--------+------------+-------------+----------+

$ nova console-log c7607b2b-d4bd-4df5-ad88-ed830ce9b396
ERROR: Unable to get console (HTTP 404) (Request-ID: req-52d426bf-1a2d-407c-8b28-46222365f414)

$ nova show c7607b2b-d4bd-4df5-ad88-ed830ce9b396
+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Property | Value |
+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| OS-DCF:diskConfig | MANUAL |
| OS-EXT-AZ:availability_zone | nova |
| OS-EXT-SRV-ATTR:host | arnolt |
| OS-EXT-SRV-ATTR:hypervisor_hostname | arnolt.oil |
| OS-EXT-SRV-ATTR:instance_name | instance-00000002 |
| OS-EXT-STS:power_state | 0 ...