Better conductor deployment

[Oleksii Aleksieiev]

Here is several issues with how MOS deploys conductor.

1 By default all deployment variants assume deployments with conductor enabled. But this requires to remove sql_connection option in nova.conf on compute nodes. MOS does not do this. it keeps sql_connection option in nova.conf on compute nodes while all compute services are configured to use conductor.
One of the reason for creating conductor service was to provide security level for nova.

2 by default it not possible to disable conductor using MOS tools. Customers who prefer performance over security should have this options. Conductor can introduce significant delay in all actions required database access.

This two enchantments are tied together.

The following actions are required to disable usage of conductor.

On all compute nodes:

1 make use mysql port is accessible from compute nodes and all necessary grange are present.
2 add into nova.conf
[DEFAULT]
sql_connection = mysql://nova:password@mysqlhost/nova_db

[conductor]
use_local=true

 3 service openstack-nova-compute restart

4 optionally stop conductor process on controllers

Monitoring tuning may be required..

[Dmitry Mescheryakov (dmitrymex)]

This task requires change only in Nova deployment, no need to change anything in Nova code. So I am removing MOS as an affected project.

[Vladimir Kuklin (vkuklin)]

This bug requires altering of reference architecture - Won't Fix for 6.0.x

[Matthew Mosesohn (raytrac3r)]

I fail to understand how nova-conductor on computes is more secure than running it on controllers. Computes have a higher likelihood of being compromised.

From nova-conductor docs, it says that nova-conductor should not be deployed on compute nodes:
http://docs.openstack.org/kilo/config-reference/content/section_conductor.html

[Matthew Mosesohn (raytrac3r)]

After talking with Roman P, we realized we have DB config in nova.conf on computes, but it should be removed since it is not in use. Conductors are run in controllers as they should be.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/229310

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/229310
Committed: https://git.openstack.org/cgit/stackforge/fuel-library/commit/?id=7c1694dc2f573f8714f1845cf446bdcec5d01420
Submitter: Jenkins
Branch: master

commit 7c1694dc2f573f8714f1845cf446bdcec5d01420
Author: Matthew Mosesohn <email address hidden>
Date: Wed Sep 30 12:05:01 2015 +0300

    Remove database_connection from compute

    Compute uses nova-conductor for communciation
    and not a direct database connection. The
    current database connection is unused and
    should be removed.

    Change-Id: Ied0e04d16779abaebd821f0d65b65ddfbf71316f
    Related-Bug: #1355509

[Matthew Mosesohn (raytrac3r)]

The related issue (DB connection in compute settings) is fixed, but we are not moving nova-conductor off of controllers at this time.