Murano needs dedicated rabbitmq

[Bartłomiej Daca]

When using separate networks for api calls and for VMs traffic, the murano agents installed on VMs are unable to communicate to the murano engine. This way none of the environments can be properly deployed.

Communication between murano agents and murano engine is realised by the rabbitmq. Kolla configures murano to use the rabbitmq that carries all the communication between OpenStack components. This rabbitmq is limited to work only in api network and api network is isolated from the network that VMs use. This is good in terms of security.

There are two options to allow murano agents to communicate with murano engine:
1. Expose rabbitmq to the external network
2. Install separate rabbitmq and expose it to the external network to handle the communication for murano.

Option 1. is considered unsafe, option 2. is suggested by the murano installation instructions.

[zhubingbing (zhubingbing)]

You can refer to this link.
http://www.gossamer-threads.com/lists/openstack/operators/57816

[Bartłomiej Daca (bartek-daca)]

Ok, thanks for this info!

Shouldn't still kolla take care of creating the separate vhosts and users for murano? Because without this murano still simply doesn't work in multinode deployment.

[zhubingbing (zhubingbing)]

hi bdaca, now we did't know to do with it either, so We can wait until the next version(coata-1) to see if there is any good solution，you can talk more with pbourke, he look familiar with murano

[Paul Bourke (pauldbourke)]

Had a chat with bdaca, he's helpfully going to take on adding a separate rabbitmq instance for murano. We may also want to support the vhost route also, but going the ML thread linked above a separate instance seems a good idea in order to avoid impacting the stability of the entire cluster.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/374525

[Vladislav Belogrudov (vlad-belogrudov)]

this is a security hole, how come this is low priority??

[OpenStack Infra (hudson-openstack)]

Change abandoned by Paul Bourke (pbourke) (<email address hidden>) on branch: master
Review: https://review.openstack.org/374525
Reason: Picking up this work under kolla-ansible at https://review.openstack.org/#/c/453724/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/453735
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=329293b182ba5e72e633a66d767a888ed201058c
Submitter: Jenkins
Branch: master

commit 329293b182ba5e72e633a66d767a888ed201058c
Author: Paul Bourke <email address hidden>
Date: Wed Apr 5 17:16:58 2017 +0100

    Make rabbitmq log dir configurable

    Change-Id: I020eb6219f89a310451becde41f6f1c7f54baadd
    Partial-Bug: #1620374

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 5.0.0.0b3 development milestone.