[9.x][SWARM] VIP management ip is not available from compute

[Alisa Tselovalnikova]

Detailed bug description:

 The issue was found by https://product-ci.infra.mirantis.net/job/9.x.system_test.ubuntu.multiracks_2/139/testReport/(root)/two_nodegroups_network_templates/

https://product-ci.infra.mirantis.net/job/9.x.system_test.ubuntu.thread_7/139/testReport/

Steps to reproduce:

 1. Deploy fuel master 9.x
 2. Bootstrap 3 slaves from default nodegroup
 3. Create cluster with Neutron VXLAN and custom nodegroups
 4. Bootstrap 2 slaves nodes from custom nodegroup
 5. Add 3 controller nodes from default nodegroup
 6. Add 2 compute+cinder nodes from custom nodegroup
 7. Upload 'two_nodegroups' network template
 8. Verify networks
 9. Deploy cluster
 10. Run health checks (OSTF)

Expected results:
 All steps are passed.

Actual result:

 Failed 6 OSTF tests:
  - Create volume and boot instance from it (failure) Failed to get to expected status. In error state. Please refer to OpenStack logs for more details.
  - Create volume and attach it to instance (failure) Failed to get to expected status. In error state. Please refer to OpenStack logs for more details.
  - Check network connectivity from instance via floating IP (failure) Failed to get to expected status. In error state. Please refer to OpenStack logs for more details.
  - Launch instance (failure) Failed to get to expected status. In error state. Please refer to OpenStack logs for more details.
  - Launch instance with file injection (failure) Failed to get to expected status. In error state. Please refer to OpenStack logs for more details.
  - Launch instance, create snapshot, launch instance from snapshot (failure) Failed to get to expected status. In error state. Please refer to OpenStack logs for more details.

Description of the environment:

 snapshot #566 http://paste.openstack.org/show/590677/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/411831

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/412531

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/412532

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/412531
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=926e01a1fea0ab2697e2a21afa332cfec52b15e6
Submitter: Jenkins
Branch: stable/mitaka

commit 926e01a1fea0ab2697e2a21afa332cfec52b15e6
Author: Oleksiy Molchanov <email address hidden>
Date: Fri Dec 16 16:04:17 2016 +0200

    Move rules from mangle/prerouting to filter/input

    Move ddos-protection rules from mangle to filter table, because
    mangle shouldn't be used for any filtering purpose.

    Change-Id: I9d28be251d7e504892186bf5622d14bac88d6f3b
    Closes-Bug: 1645353

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/411831
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=13322459c74dc00fd726b1864d1862ca5d8ddea0
Submitter: Jenkins
Branch: master

commit 13322459c74dc00fd726b1864d1862ca5d8ddea0
Author: Oleksiy Molchanov <email address hidden>
Date: Fri Dec 16 16:04:17 2016 +0200

    Move rules from mangle/prerouting to filter/input

    Move ddos-protection rules from mangle to filter table, because
    mangle shouldn't be used for any filtering purpose.

    Change-Id: I9d28be251d7e504892186bf5622d14bac88d6f3b
    Closes-Bug: 1645353

[TatyanaGladysheva (tgladysheva)]

Verified on 9.2 snapshot #668.

Currently test is passed:
https://product-ci.infra.mirantis.net/job/9.x.system_test.ubuntu.multiracks_2/158/testReport/(root)/two_nodegroups_network_templates/two_nodegroups_network_templates/

[Dmitry Belyaninov (dbelyaninov)]

Similar errors:
https://product-ci.infra.mirantis.net/job/9.x.system_test.ubuntu.support_dpdk/158/testReport/(root)/deploy_cluster_with_dpdk/deploy_cluster_with_dpdk/

@Oleksiy Molchanov could you please take a look

[Oleksiy Molchanov (omolchanov)]

@Dmitry, it is another bug.

[Ekaterina Shutova (eshutova)]

Verified on 9.2 snapshot #724.
Test is stable/passed: https://product-ci.infra.mirantis.net/job/9.x.system_test.ubuntu.multiracks_2/166/testReport/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/412532
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=bee30b3845664ff13bd1c135801dfaab0e5ae03c
Submitter: Jenkins
Branch: stable/newton

commit bee30b3845664ff13bd1c135801dfaab0e5ae03c
Author: Oleksiy Molchanov <email address hidden>
Date: Fri Dec 16 16:04:17 2016 +0200

    Move rules from mangle/prerouting to filter/input

    Move ddos-protection rules from mangle to filter table, because
    mangle shouldn't be used for any filtering purpose.

    Change-Id: I9d28be251d7e504892186bf5622d14bac88d6f3b
    Closes-Bug: 1645353

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/fuel-library 11.0.0.0rc1 release candidate.

[Ekaterina Shutova (eshutova)]

Nevertheless latest runs are failed but seems due to another problem.
Original problem is fixed, test was passed with fix for example here:
https://product-ci.infra.mirantis.net/view/10.0_swarm/job/10.0.system_test.ubuntu.multiracks_2/204/testReport/(root)/two_nodegroups_network_templates/two_nodegroups_network_templates/

[Ekaterina Shutova (eshutova)]

Verified on 10.1 #1448