Comment 2 for bug 1420996

Revision history for this message
Caio Begotti (caio1982) wrote :

Sysadmins from Canonical confirmed the Juju + Openstack environments where I am testing this problem have no special differences between them. I don't see this problem occurring with Juju + Havana (Canonistack) though it doesn't mean this problem won't happen there, perhaps it is just how I tried to reproduce it there that didn't make a difference. I don't really know the release running on the other environment (Stagingstack).

I have tried sticking the SSH secgroup rule to IP range 0.0.0.0/0 just to see if it was the IP range I was using or what. I didn't matter, as you can see below.

Using open-port https://jujucharms.com/u/caio1982/open-port/ does not matter either, I had port 22 closed on Canonistack for the involved units and their secgroups did not get reset, they worked okay the next day. My open ports (all 22) on the other environment got their rules reset overnight, so I would this rule out.

Below you can see the result of my monitoring (running every 15min) showing the time the reset occured, approximately at 04:30AM UTC I think. I really wonder why this is the specific time it occurs...

Thu Feb 12 04:24:48 UTC 2015
+-------------+-----------+---------+-------------------+-------------------------+
| IP Protocol | From Port | To Port | IP Range | Source Group |
+-------------+-----------+---------+-------------------+-------------------------+
| tcp | 37017 | 37017 | 0.0.0.0/0 | |
| tcp | 17070 | 17070 | 0.0.0.0/0 | |
| tcp | 1 | 65535 | | juju-stg-pes-capomastro |
| udp | 1 | 65535 | | juju-stg-pes-capomastro |
| icmp | -1 | -1 | | juju-stg-pes-capomastro |
| tcp | 22 | 22 | 91...removed/32 | |
| tcp | 873 | 873 | 91...removed/32 | |
| tcp | 5666 | 5666 | 91...removed/32 | |
| icmp | -1 | -1 | 91...removed/32 | |
| tcp | 22 | 22 | 162...removed/32 | <- my rule |
| tcp | 22 | 22 | 162...removed/32 | <- my rule |
| tcp | 22 | 22 | 0.0.0.0/0 | <- my rule |
+-------------+-----------+---------+-------------------+-------------------------+
Thu Feb 12 04:39:49 UTC 2015
+-------------+-----------+---------+-----------------+-------------------------+
| IP Protocol | From Port | To Port | IP Range | Source Group |
+-------------+-----------+---------+-----------------+-------------------------+
| tcp | 37017 | 37017 | 0.0.0.0/0 | |
| tcp | 17070 | 17070 | 0.0.0.0/0 | |
| tcp | 1 | 65535 | | juju-stg-pes-capomastro |
| udp | 1 | 65535 | | juju-stg-pes-capomastro |
| icmp | -1 | -1 | | juju-stg-pes-capomastro |
| tcp | 22 | 22 | 91...removed/32 | |
| tcp | 873 | 873 | 91...removed/32 | |
| tcp | 5666 | 5666 | 91...removed/32 | |
| icmp | -1 | -1 | 91...removed/32 | |
+-------------+-----------+---------+-----------------+-------------------------+