novncproxy base uri using should use host/fqdn instead of IP

[Alexander Binzxxxxxx]

nova_novncproxy_base_uri uses the loadbalander IP instead of the hostname or FQDN. This causes ssl certificates beeing not accepted since they may not include IPs (like in a wildcard cert).
I recommend switching to something like:
nova_novncproxy_base_uri: "{{ nova_novncproxy_proto }}://{{ horizon_server_name }}:{{ nova_novncproxy_port }}"

[Jonathan Rosser (jrosser)]

Could you please give some more information about how you have set up your deployment, particularly SSL certificates for the external VIP and what you have configured external_lb_vip_address as?

[Alexander Binzxxxxxx (devil000000)]

The configuration is quite minimal and quite default for openstack-ansible (release xena).

as said, the ssl certificate is a wildcard certificate (e.g. *.example.com) and haproxy is configured to use that via:
haproxy_user_ssl_cert: '$some_path'
haproxy_user_ssl_key: '$some_path'
the external lb virtual ip address is set like this:
external_lb_vip_address: '192.168.10.200'

the nova_novncproxy_base_uri is by default build with external_lb_vip_address (so a IP based uri/url instead of host/FQDN based). The ssl wildcard certificate will not include the IP in the SAN part (which would be very unusual for a wildcard certificate to have but also for other certificates this would be unusual). So as soon as the console tab is opened the iframe loads the console via the IP based URL causing the browser to complain about a certificate and target missmatch causing the console request getting blocked.

The correct thing is to use the FQDN in all URLs including nova console ones.

Not sure what other information you need. Don't hesitate to ask if you need more information but please tell me what exactly you need.

[Jonathan Rosser (jrosser)]

I think that we expect external_lb_vip_address to be set to your FQDN rather than the IP in a production deployment, you should then find that the FQDN gets used in the places which build URLs during the deployment rather than the IP.

See https://github.com/openstack/openstack-ansible/blob/master/etc/openstack_deploy/openstack_user_config.yml.prod.example#L21

[Jonathan Rosser (jrosser)]

For what it's worth - I expect that not setting the external VIP to be your FQDN might also be related to your other bug https://bugs.launchpad.net/openstack-ansible/+bug/1971179

[Alexander Binzxxxxxx (devil000000)]

understand, you expect external_lb_vip_address to hold a FQDN.
the key name suggests to me "virtual IP" and "address" not "hostname" or "fqdn". also I think I have seen this in basically all examples with a IP not a FQDN given but I may be wrong on this one.

About the ticket relation: The legacy mode issue is as far as I can tell unrelated. The direct mode issue could be related.

[Alexander Binzxxxxxx (devil000000)]

I retested with your suggestion.
setting external_lb_vip_address to FQDN sets the nova_novncproxy_base_uri correct. That solved this issue for me. Maybe you want to document that more clearly or change the key name. see last comment.
About https://bugs.launchpad.net/openstack-ansible/+bug/1971179 -
it partially also helps for the image upload but does not solve it see that ticket for details.

[Dmitriy Rabotyagov (noonedeadpunk)]

Yeah, we totally need to document that in better way. As the only mention that it's supposed to be FQDN I can find here https://opendev.org/openstack/openstack-ansible/src/branch/master/etc/openstack_deploy/openstack_user_config.yml.pod.example#L33-L36

While it's not the most obvious place too look for...

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/openstack-ansible/+/842132

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/openstack-ansible/+/842132
Committed: https://opendev.org/openstack/openstack-ansible/commit/9bce86e4a3c466b1eade6e2c8290d208346e43ac
Submitter: "Zuul (22348)"
Branch: master

commit 9bce86e4a3c466b1eade6e2c8290d208346e43ac
Author: Dmitriy Rabotyagov <email address hidden>
Date: Tue May 17 16:51:35 2022 +0200

    [doc] Be even more explicit about lb_vip_address

    Add in several places in doc mentions that lb_vip_address can also be
    an FQDN, not necessarily an IP

    Closes-Bug: #1971175
    Change-Id: I812674728990fcbfb234db403c8ea5d4eefb6354

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/xena
Review: https://review.opendev.org/c/openstack/openstack-ansible/+/842327

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/wallaby
Review: https://review.opendev.org/c/openstack/openstack-ansible/+/842328

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/victoria
Review: https://review.opendev.org/c/openstack/openstack-ansible/+/842329

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/openstack-ansible/+/842327
Committed: https://opendev.org/openstack/openstack-ansible/commit/21e5e231255d795ca728129f902016253ee17fde
Submitter: "Zuul (22348)"
Branch: stable/xena

commit 21e5e231255d795ca728129f902016253ee17fde
Author: Dmitriy Rabotyagov <email address hidden>
Date: Tue May 17 16:51:35 2022 +0200

    [doc] Be even more explicit about lb_vip_address

    Add in several places in doc mentions that lb_vip_address can also be
    an FQDN, not necessarily an IP

    Closes-Bug: #1971175
    Change-Id: I812674728990fcbfb234db403c8ea5d4eefb6354
    (cherry picked from commit 9bce86e4a3c466b1eade6e2c8290d208346e43ac)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/openstack-ansible/+/842328
Committed: https://opendev.org/openstack/openstack-ansible/commit/bb0fbdba30b6f99de4cd266ad5bbd7371f6f6b8b
Submitter: "Zuul (22348)"
Branch: stable/wallaby

commit bb0fbdba30b6f99de4cd266ad5bbd7371f6f6b8b
Author: Dmitriy Rabotyagov <email address hidden>
Date: Tue May 17 16:51:35 2022 +0200

    [doc] Be even more explicit about lb_vip_address

    Add in several places in doc mentions that lb_vip_address can also be
    an FQDN, not necessarily an IP

    Closes-Bug: #1971175
    Change-Id: I812674728990fcbfb234db403c8ea5d4eefb6354
    (cherry picked from commit 9bce86e4a3c466b1eade6e2c8290d208346e43ac)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/openstack-ansible/+/842329
Committed: https://opendev.org/openstack/openstack-ansible/commit/e373a78f964479e462b7babf46872a0a0ebe7fe1
Submitter: "Zuul (22348)"
Branch: stable/victoria

commit e373a78f964479e462b7babf46872a0a0ebe7fe1
Author: Dmitriy Rabotyagov <email address hidden>
Date: Tue May 17 16:51:35 2022 +0200

    [doc] Be even more explicit about lb_vip_address

    Add in several places in doc mentions that lb_vip_address can also be
    an FQDN, not necessarily an IP

    Closes-Bug: #1971175
    Change-Id: I812674728990fcbfb234db403c8ea5d4eefb6354
    (cherry picked from commit 9bce86e4a3c466b1eade6e2c8290d208346e43ac)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-ansible 23.3.1 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-ansible 24.3.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-ansible 25.0.0.0b1 development milestone.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-ansible victoria-eom release.