Title
-----
software config/deploy return signal error
Brief Description
-----------------
The return signal for a software config/deploy is sent using the external address instead of the public. The result is that the signal from guest to StarlingX will never be received.
Severity
--------
Critical
Steps to Reproduce
------------------
Run the following stack
#############
heat_template_version: 2013-05-23
description: >
Minimal SoftwareDeployment
parameters:
flavor:
type: string
default: medium_flav
image:
type: string
default: ubuntu2
network:
default: net_a
type: string
user:
type: string
default: admin
resources:
my_key:
type: OS::Nova::KeyPair
properties:
name: my_key3
save_private_key: True
user: {get_param: user}
my_security_group:
type: OS::Neutron::SecurityGroup
properties:
rules:
- protocol: tcp
remote_ip_prefix: 0.0.0.0/0
port_range_min: 1
port_range_max: 65535
- protocol: icmp
remote_ip_prefix: 0.0.0.0/0
my_port:
type: OS::Neutron::Port
properties:
network: {get_param: network}
security_groups:
- default
- { get_resource: my_security_group }
my_software_config:
type: OS::Heat::SoftwareConfig
properties:
inputs:
- name: message
default: 'NONE'
outputs:
- name: file_content
group: script
config: |
#!/bin/sh -x
echo "PNYXTER EKO"
echo "${message}" > /tmp/pnyxter
cat /tmp/pnyxter > ${heat_outputs_path}.file_content
my_software_deployment:
type: OS::Heat::SoftwareDeployment
properties:
signal_transport: CFN_SIGNAL
config: {get_resource: my_software_config}
server: {get_resource: my_server}
input_values:
message: 'pnyxter mestxt'
my_server:
type: OS::Nova::Server
properties:
name: th3
image: {get_param: image}
flavor: {get_param: flavor}
key_name: {get_resource: my_key}
user_data_format: SOFTWARE_CONFIG
networks:
- port: {get_resource: my_port}
outputs:
deploy_output:
value:
get_attr: [my_software_deployment, file_content]
stdout:
value:
get_attr: [my_software_deployment, deploy_stdout]
stderr:
value:
get_attr: [my_software_deployment, deploy_stderr]
status_code:
value:
get_attr: [my_software_deployment, deploy_status_code]
private_key:
value:
get_attr: [my_key, private_key]
public_key:
value:
get_attr: [my_key, public_key]
##################
Expected Behavior
------------------
The server resource should have lock like this:
{
"type": "String",
"name": "deploy_signal_id",
"value": "http://<public_addr>:8000/v1/signal/....",
"description": "ID of signal to use for signaling output values"
},
Actual Behavior
----------------
The server resource should have lock like this:
{
"type": "String",
"name": "deploy_signal_id",
"value": "http://<internal_addr>:8000/v1/signal/....",
"description": "ID of signal to use for signaling output values"
},
System Configuration
--------------------
One node
Branch/Pull Time/Commit
-----------------------
ISO from http://mirror.starlingx.cengn.ca/mirror/starlingx/release/1000.10.1/centos/2018.10.0/outputs/iso/
Solution
----------
Add the following line to signal_responder.py to /usr/lib/python2.7/site-packages/heat/engine/resources/signal_responder.py
from
https://github.com/openstack/heat/blob/stable/pike/heat/engine/resources/signal_responder.py#L144
i.e.
--- /usr/lib/python2.7/site-packages/heat/engine/resources/signal_responder.py_org 2019-02-25 09:50:30.061517795 +0000
+++ /usr/lib/python2.7/site-packages/heat/engine/resources/signal_responder.py 2019-02-25 09:50:44.533517917 +0000
@@ -158,6 +158,7 @@
cfg.CONF.heat_api_cfn.bind_port,
"/v1",
signal_type)
+ signal_url = config_url.replace('/waitcondition', signal_type)
else:
heat_client_plugin = self.stack.clients.client_plugin('heat')
endpoint = heat_client_plugin.get_heat_cfn_url()
From Al Bailey:
---------------
The config url is set to: (public endpoint in my lab)
config_url http://
This is translated by the heat code to the internal url:
http://
The WRS code that does that is here:
https:/
This was done to fix CGTS-3907
If change that method to be similar to what upstream does, it should work for this customer as long as they are not using https or IPv6
This is the standard upstream code which does our alterations.
https:/
If you want to demonstrate that this fix works in this scenario, this is the file that needs to be changed:
/usr/lib/
find these lines (around line 155)
signal_url = "%s://%s:%s%s%s" % ("http",
and add the following one line right below it (which basically sets the variable to what upstream is doing)
signal_url = config_
Note: This will not work with IPv6 and https
This will however work for the tests highlighted here
After you make this change (and make sure you backup the original file), you can restart heat engine:
sudo sm-restart service heat-engine
then you should be able to create their stack.
Note: the stack uses a keypair, which may or may not need to be manually cleaned up