Only Ironic public endpoint is supported
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
OpenStack Compute (nova) |
Fix Released
|
Medium
|
Matt Riedemann | ||
Queens |
Confirmed
|
Medium
|
Unassigned | ||
Rocky |
Fix Committed
|
Medium
|
Guang Yee |
Bug Description
Currently, there are number of places in Ironic that does endpoint lookup from the Keystone service catalog. By default, keystoneauth set it to 'public' if not specified.
Description
===========
We are supposed to be able to select the endpoint type by specify either the 'interface' or 'valid_interfaces' option in the [keystone_
Consequently, this makes it impossible to using Ironic without having to expose the public endpoint in the service catalog. Furthermore, for security reasons, our controller nodes (subnet) have no route to the public network and therefore will not be able to access the public endpoint. This is a rather significant limitation in deploying Ironic. Also, we seem to have broken backward compatibility as well as Ironic use to work in Pike without having to configure a public endpoint.
Steps to reproduce
==================
1) enable Ironic in devstack
2) delete the Ironic public endpoint in Keystone
3) set 'valid_interfaces = internal' in the [ironic] section in nova.conf and restart nova-compute service
4) try to provision a server and it will fail with errors similar to these in nova-compute logs
2019-02-28 18:00:28.136 48891 ERROR nova.virt.
Expected result
===============
Server created without error.
Actual result
=============
Server failed to create, with errors similar to these in nova-compute logs
2019-02-28 18:00:28.136 48891 ERROR nova.virt.
Environment
===========
This bug is reproducible in devstack with Ironic plugin enabled.
Related bugs:
Ironic: https:/
Nova: https:/
tags: | added: ironic |
Changed in nova: | |
importance: | Undecided → Medium |
Changed in nova: | |
assignee: | Guang Yee (guang-yee) → Eric Fried (efried) |
Changed in nova: | |
assignee: | Eric Fried (efried) → Guang Yee (guang-yee) |
Changed in nova: | |
assignee: | Guang Yee (guang-yee) → Eric Fried (efried) |
Fix proposed to branch: master /review. openstack. org/640879
Review: https:/