Juniper Openstack

[fabric-utils] Metadata service: metadata_proxy_secret is not provisioned in /etc/contrail/contrail-vrouter-agent.conf on compute (vrouter) nodes from the Openstack node

  1. Series r3.2
  2. Bug #1697515
Bug #1697515 reported by Mihai-Costin Broc
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Juniper Openstack
Status tracked in Trunk
R3.2
Fix Committed
Undecided
Kumar Harsh
Juniper Openstack r3.2.4.0
R4.0
Fix Committed
Undecided
Kumar Harsh
Juniper Openstack r4.0.1.0 "r4.0.1.0"
Trunk
Fix Committed
Undecided
Kumar Harsh
Juniper Openstack r4.1.0.0-fcs "r4.1"

Bug Description

Hi,

On a setup with 3 nodes (running Centos 7.3):
-Openstack node (Mitaka)
-Contrail config, controller, analytics node (Contrail 3.2)
-compute node
The Openstack was installed first, then Contrail was installed and provisioned using the fab tool.

Problem:
1)Boot up a VM from openstack (I used a Cirros VM)
2)Go to the VM console and try to access the metadata service using the link local address:

curl http://169.254.169.254/openstack

It will return an error message (403 Forbidden):
<html>
 <head>
  <title>403 Forbidden</title>
 </head>
 <body>
  <h1>403 Forbidden</h1>
  Invalid proxy request signature.<br /><br />
 </body>
</html>

The problem is that the metadata_proxy_shared_secret field from /etc/nova/nova.conf )on the openstack node is not configured also in the metadata_proxy_secret field from /etc/contrail/contrail-vrouter-agent.conf on the compute node.

After manually configured it and restart the vrouter service on the compute node (service supervisor-vrouter restart) it worked. See Contrail feature guide 3.2 chapter 24 Common Support Answers, Troubleshooting Procedure for Link-Local Metadata Service page 650.

The contrail-fabric-utils and contrail-provisioning scripts seems to have the code to configure metadata_proxy_secret field from /etc/contrail/contrail-vrouter-agent.conf.

The value to be put in metadata_proxy_secret field is taken from /etc/nova/nova.conf by the get_metadata_secret() from /opt/contrail/utils/fabfile/utils/cluster.py (contrail-fabric-utils project) and then passed to setup-vnc-compute command (contrail-provisioning project) which should write it into /etc/contrail/contrail-vrouter-agent.conf.

Looking into the code from get_metadata_secret(), it first try to determine the version of openstack since the field from /etc/nova/nova.conf was called 'neutron_metadata_proxy_shared_secret' in the older versions and 'metadata_proxy_shared_secret' in the newer version.

Looking into the log generated when running the fab tool:
opt/contrail/utils/setup_without_openstack_2017_05_17_20_56_14_623756.log:1665:2017-05-17 20:58:45:709851: WARNING: Exception (No option 'neutron_metadata_proxy_shared_secret' in section: 'DEFAULT') during retrieving (neutron_metadata_proxy_shared_secret) from section (DEFAULT

So it seems that it wrongly looked for the field neutron_metadata_proxy_shared_secret in /etc/nova/nova.conf instead of the correct name metadata_proxy_shared_secret for Mitaka.

The code that implemented the logic for deciding the name on the field was the following (in get_metadata_secret()):

                    api_version = sudo("rpm -q --queryformat='%{VERSION}' openstack-nova-api")
                    is_juno_or_higher = LooseVersion(api_version) >= LooseVersion('2014.2.2')

When I executed manually the command "rpm -q --queryformat='%{VERSION}' openstack-nova-api" on the openstack node from my setup, I obtained the version 13.0.0.

Looking into the OpenStack Nova release versioning scheme (https://releases.openstack.org/teams/nova.html)
it seems that before Liberty, the versions started with the year (like 2014.2.x for Juno, 2015.1.x for Kilo), then the versioning was changed from Liberty (12.0.x for Liberty, 13.1.x for Mitaka, 14.0.x for Newton etc)

Thank you,
Mihai

Mihai-Costin Broc (mbroc)
information type: Proprietary → Public
Jeba Paulaiyan (jebap)
tags: added: provisioning
tags: added: vrouter
Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : [Review update] R3.2

Review in progress for https://review.opencontrail.org/33599
Submitter: Kumar Harsh (<email address hidden>)

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : A change has been merged

Reviewed: https://review.opencontrail.org/33599
Committed: http://github.com/Juniper/contrail-fabric-utils/commit/18b8f874b75f29af28aca2daa98a29bcee8ec098
Submitter: Zuul (<email address hidden>)
Branch: R3.2

commit 18b8f874b75f29af28aca2daa98a29bcee8ec098
Author: Kumar Harsh <email address hidden>
Date: Thu Jul 13 16:13:14 2017 +0530

Check for openstack version while provisioning metadata_proxy_secret

For openstack sku juno and above use metadata_proxy_shared_secret from nova.conf .

Change-Id: Ibecced3f88a7bf07512f23e6730c20dc2b5568fb
Closes-Bug: 1697515

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : [Review update] master

Review in progress for https://review.opencontrail.org/33681
Submitter: Kumar Harsh (<email address hidden>)

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : [Review update] R4.0

Review in progress for https://review.opencontrail.org/33687
Submitter: Kumar Harsh (<email address hidden>)

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : A change has been merged

Reviewed: https://review.opencontrail.org/33687
Committed: http://github.com/Juniper/contrail-ansible/commit/16bc3a6aa626e521d8afadd8c8025592a69d9ac4
Submitter: Zuul (<email address hidden>)
Branch: R4.0

commit 16bc3a6aa626e521d8afadd8c8025592a69d9ac4
Author: Harsh Kumar <email address hidden>
Date: Mon Jul 17 14:28:09 2017 +0530

Ansible change for metadata_proxy_secret provisioning for baremetal agent

metadata_proxy_secret will be updated in inventory file by server manager
same will be set in contrail-vrouter-agent.conf

Change-Id: I90ea84d51187d3e12e310a41ba6ffcf1d332cfd0
Closes-Bug: #1697515

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote :

Reviewed: https://review.opencontrail.org/33681
Committed: http://github.com/Juniper/contrail-ansible/commit/b7d3e38ca5dc1b586c79013728216b096c616475
Submitter: Zuul (<email address hidden>)
Branch: master

commit b7d3e38ca5dc1b586c79013728216b096c616475
Author: Harsh Kumar <email address hidden>
Date: Mon Jul 17 11:21:56 2017 +0530

Ansible change for metadata_proxy_secret provisioning for baremetal agent

metadata_proxy_secret will be updated in inventory file by server manager
same will be set in contrail-vrouter-agent.conf

Change-Id: Iab051339d40cd3fbbbf8a411847279b3b775e7ff
Closes-Bug: #1697515

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.