Amphora REST agent binds to all IPs

[Michael Johnson]

Currently the Amphora REST agent binds to '0.0.0.0' meaning it will bind to the vip and member network IP addresses.

This needs to be corrected in the flow by pushing a new agent configuration to the amphora after nova boot has completed and the management (lb_network) IP has been assigned.

[German Eichberger (german-eichberger)]

Needs more research...

[Phillip Toohill (phillip-toohill)]

Werkzeug reloader fails to reload completely to rebind to the host ip. The patch https://review.openstack.org/#/c/269450/3 sets up, but is not working yet. A manual reload fails completely. Will come back to this at some point..

[Daniel (daniel-zhang)]

It won't bind to the vip and member network IP addr since vip and member network IP addr are located in namespace amphora-haproxy.
Cloud you list more drawbacks of user scenarios when binds to '0.0.0.0'?
Thanks a lot.

root@amphora-84ef3a6b-f6b3-4aea-a106-a862de13ba5f:~# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1442 qdisc pfifo_fast state UP group default qlen 1000
    link/ether fa:16:3e:4a:bb:2e brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.3/24 brd 192.168.0.255 scope global eth0 <<<< lb-mgmt ip addr
       valid_lft forever preferred_lft forever
    inet6 fe80::f816:3eff:fe4a:bb2e/64 scope link
       valid_lft forever preferred_lft forever
root@amphora-84ef3a6b-f6b3-4aea-a106-a862de13ba5f:~# ip netns exec amphora-haproxy ip addr
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1442 qdisc pfifo_fast state UP group default qlen 1000
    link/ether fa:16:3e:1f:75:6e brd ff:ff:ff:ff:ff:ff
    inet 1.0.0.4/24 brd 1.0.0.255 scope global eth1 <<<< member network IP address
       valid_lft forever preferred_lft forever
    inet 1.0.0.100/24 brd 1.0.0.255 scope global secondary eth1:0 <<<< vip
       valid_lft forever preferred_lft forever
    inet6 fe80::f816:3eff:fe1f:756e/64 scope link
       valid_lft forever preferred_lft forever
root@amphora-84ef3a6b-f6b3-4aea-a106-a862de13ba5f:~#

[li,chen (chen-li)]

Agree with Daniel.

And octavia allow amphora to have more then one management networks by setting:

[controller_worker]
amp_boot_network_list =

A network can have multiple sub-nets. Then which network/sub-net the amphora-agent should bind ?

[Phillip Toohill (phillip-toohill)]

The reference implementation will make use of this list with one network only. The option was added for deployer specific use cases and potential expansion in the future for the reference. For the forseeable future no upstream code will be concerned with more than one network in this list.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/366997
Committed: https://git.openstack.org/cgit/openstack/octavia/commit/?id=e291a88210dfc108f78760dbfdd326a417aaca1a
Submitter: Jenkins
Branch: master

commit e291a88210dfc108f78760dbfdd326a417aaca1a
Author: Paul Glass <email address hidden>
Date: Wed Sep 7 21:30:38 2016 +0000

    Stop using bandit-baseline

    bandit-baseline finds *new* issues introduced in a commit, by comparing
    results between two git commits. If the git repository has uncommitted
    changes, bandit-baseline refuses to run.

    This switches over to using plain bandit instead of bandit-baseline,
    and resolves or stifles existing bandit errors so we have a clean run.
    These updates apply to bandit running as part of `tox -e pep8` or `tox
    -e bandit`.

    * Have bandit runs from tox ignore the octavia/tests directory
    * Resolve several instances of `B701 jinja2_autoescape_false`
    * Stifle several instances of `B303 md5`
    * Resolve two instances of `B104 hardcoded_bind_all_interfaces`
    * Stifle one instance of `B104 hardcoded_bind_all_interfaces` (see
    https://bugs.launchpad.net/octavia/+bug/1489963)

    Closes-Bug: #1621251
    Related-Bug: #1489963

    Change-Id: Iad3cbe5762949a6311bdd361b1f12c5a24c40633

[OpenStack Infra (hudson-openstack)]

Change abandoned by Armando Migliaccio (<email address hidden>) on branch: master
Review: https://review.openstack.org/269450
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[Gregory Thiemonge (gthiemonge)]

Abandoned after re-enabling the Octavia launchpad.