Nova SSH key distribution incomplete when run with --limit

Bug #1830434 reported by Jeff Albert
16
This bug affects 3 people
Affects Status Importance Assigned to Milestone
OpenStack-Ansible
Fix Released
Undecided
Dmitriy Rabotyagov

Bug Description

The Nova SSH key distribution plays are subject to the global behavior of --limit in playbook invocation. This means if you follow the scaling documentation to add a single new compute host with `openstack-ansible setup-openstack.yml --limit localhost,NEW_HOST_NAME`, you'll end up with a new compute host that only knows its own SSH keys, and none of the pre-existing compute nodes will know the SSH key of the new one.

I assume there's no way to override the limit argument at the play level to force a given play to run on all or a specified set of hosts regardless of limit, although in this scenario that would seem like the best option.

Failing that, I think the scaling documentation needs to be updated to explicitly state the need to run the os_nova-install playbook with the nova-key tag whenever a new host is created; if you agree I'll be happy to open a merge request for such a change.

Revision history for this message
Romain Acciari (romain-acciari) wrote :

Same problem over here, the --limit option with Ansible is a real trap and should be avoided in most cases.

Revision history for this message
Dmitriy Rabotyagov (noonedeadpunk) wrote :

I'd recommend running os-nova-install.yml --tags nova-key --limit nova_compute afterwards to distribute nova keys.
Actually this task is also included into add-compute.sh script which you're very welcome to test
https://opendev.org/openstack/openstack-ansible/src/branch/master/scripts/add-compute.sh#L37

Revision history for this message
Dmitriy Rabotyagov (noonedeadpunk) wrote :

Btw, everybody is really welcome to push a patch to Gerrit if some issue is found.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to openstack-ansible (master)

Fix proposed to branch: master
Review: https://review.opendev.org/718515

Changed in openstack-ansible:
assignee: nobody → Dmitriy Rabotyagov (noonedeadpunk)
status: New → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to openstack-ansible (master)

Reviewed: https://review.opendev.org/718515
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible/commit/?id=600b23b1addc8be4a95cc55e86382c9faf4c9af7
Submitter: Zuul
Branch: master

commit 600b23b1addc8be4a95cc55e86382c9faf4c9af7
Author: Dmitriy Rabotyagov <email address hidden>
Date: Wed Apr 8 19:42:50 2020 +0300

    [doc] Add line to distribute nova keys

    Change-Id: Id809956c7b3080cd302ef49c367d01e4f9fb8d3f
    Closes-Bug: #1830434

Changed in openstack-ansible:
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.