Haproxy resource doesn't check nonlocal_bind option for already created namespace

[slava valyavskiy]

Detailed bug description:
 I encountered a case when 'ip_nonlocal_bind' option was set to '0' during the cluster re-deployment.
 """
 root@node-1:~# ip netns exec haproxy /sbin/sysctl net.ipv4.ip_nonlocal_bind --values
 0
 """
 As result, haproxy resource wouldn't able to start.
 I didn't find an enemy service what had changed this value, but, anyway, I suppose it would be nice to add corresponding check into ocf script.
Steps to reproduce:
 Re-deploy fuel with changed number of database or any other nodes what service is under Haproxy control.
Expected results:
 Haproxy resource works fine.
Actual result:
 Haproxy resource is broken.
Reproducibility:
 One time in several re-deployments.
Workaround:
 No
Impact:
 Re-Deployment is failed
Description of the environment:
 Versions of components: MOS-10.0
Additional information:
 Not applicable

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/384982

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/384982
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=dfbb81604d76398285ec48b3ddab12c4a470c753
Submitter: Jenkins
Branch: master

commit dfbb81604d76398285ec48b3ddab12c4a470c753
Author: Viacheslav Valyavskiy <email address hidden>
Date: Tue Oct 11 15:35:56 2016 +0300

    To check nonlocal_bind option for already created namespaces

    Change-Id: Ic92b194445882b364564ff0139e2e2dcff9287d4
    Closes-bug: 1632320

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/385394

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/385394
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=902e651cf19b09f13be9264053a6650b47ad79e7
Submitter: Jenkins
Branch: stable/mitaka

commit 902e651cf19b09f13be9264053a6650b47ad79e7
Author: Viacheslav Valyavskiy <email address hidden>
Date: Tue Oct 11 15:35:56 2016 +0300

    To check nonlocal_bind option for already created namespaces

    Change-Id: Ic92b194445882b364564ff0139e2e2dcff9287d4
    Closes-bug: 1632320
    (cherry picked from commit dfbb81604d76398285ec48b3ddab12c4a470c753)

[TatyanaGladysheva (tgladysheva)]

Verified on 9.2 snapshot #464.

Steps to verify:
1) Deploy 9.2 cluster
2) Install 3.19.0-* kernel to nodes and then reboot nodes:
sudo apt-get install linux-generic-lts-vivid
Check result:
root@node-1:~# uname -r
3.19.0-68-generic
3) Check value of net.ipv4.ip_nonlocal_bind:
root@node-1:~# ip netns exec haproxy /sbin/sysctl net.ipv4.ip_nonlocal_bind --values
1
4) Set incorrect value for ipv4.ip_nonlocal_bind manually:
root@node-1:~# ip netns exec haproxy /sbin/sysctl -w net.ipv4.ip_nonlocal_bind=0
net.ipv4.ip_nonlocal_bind = 0
5) Restart haproxy resource:
crm resource restart clone_p_haproxy
6) Check value of net.ipv4.ip_nonlocal_bind after haproxy restarting:
root@node-1:~# ip netns exec haproxy /sbin/sysctl net.ipv4.ip_nonlocal_bind --values
1

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/420777

[Olivier Bourdon (olivierbourdon38)]

This bug impacts Zabbix Fuel plugin deployment on MOS 10.0
The proposed fix has been successfully validated

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/420777
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=e090d8e86f4e9e09e71cbd880326fa318ba1148d
Submitter: Jenkins
Branch: stable/newton

commit e090d8e86f4e9e09e71cbd880326fa318ba1148d
Author: Viacheslav Valyavskiy <email address hidden>
Date: Tue Oct 11 15:35:56 2016 +0300

    To check nonlocal_bind option for already created namespaces

    Change-Id: Ic92b194445882b364564ff0139e2e2dcff9287d4
    Closes-bug: 1632320
    (cherry picked from commit dfbb81604d76398285ec48b3ddab12c4a470c753)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/fuel-library 11.0.0.0rc1 release candidate.