Heat resource CloudFormation::WaitConditionHandle should use Public VIP

[Andrey Danin]

Detailed bug description:
 Reproduced in MOS 8.0. The Heat resource AWS::CloudFormation::WaitConditionHandle returns an URL which is based on Management VIP though it's impossible to reach this URL from an instance because the Management network is intended to be unreachable from the Floating (Public) network. This Heat resource should return URLs based on Public VIP instead.

Steps to reproduce:
 Install MOS 8.0 in any configuration. Create a stack with the mentioned resource and reuse this resource from cloud-init using the cfn-signal tool. An example may be found here https://blog.zhaw.ch/icclab/manage-instance-startup-order-in-openstack-heat-templates/
 As an alternative you may just check what IP the 'heat_waitcondition_server_url' stanza from /etc/heat/heat.conf contains.

Expected results:
 Triggering the received URL with cfn-signal should trigger AWS::CloudFormation::WaitCondition resource.
 Or the mentioned above stanza should use Public VIP.

Actual result:
 cfn-signal returns "No route to host'.

Reproducibility:
 Every time.

Workaround:
 Manually correct the stanza in heat.conf on all the controllers and restart all heat-* services on all the controllers.
 Or use the OS::Heat::WaitConditionHandle resource instead.

Impact:
 Any deployment with MOS 8.0. Probably MOS 7.0 and 9.x are affected. Although the problem itself is not so important because it's easy to fix it manually and there is a twin resource OS::Heat::WaitConditionHandle, however those kinds of problems force people to maintain separate templates for Fuel-based OSt and other OSt distributions which have this issue fixed.

Description of the environment:
 Operation system: Ubuntu 14.04
 Versions of components: Any
 Reference architecture: Any
 Network model: Any
 Related projects installed: none
Additional information:
 none

[Oleksii Chuprykov (ochuprykov)]

It works on 9.1.
I see in heat.conf:
heat_waitcondition_server_url=http://172.16.0.3:8000/v1/waitcondition which is public url.
heat_waitcondition_server_url is used only in one place for generating ec2 signed url which you pass to cfn-signal, so I think it is safe to change it to public url. Also, OS::Heat::WaitConditionHandle works because it uses another signal transport with public url (by default).

[Alexey Stupnikov (astupnikov)]

Closing as Won't fix for MOS7 and MOS8 as this bug is not customer-found and we only merge Critical/Security/Customer-found fixes to MOS7 and MOS8.