tripleo

firewall rules defined in service templates missing on overcloud

Bug #1629934 reported by Pradeep Kilambi on 2016-10-03

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	tripleo	Fix Released	Critical	Emilien Macchi	tripleo newton-rc3 "newton-rc3"

Bug Description

The firewall rules for services defined in via service templates in tht are missing from the rules list after deployed. the current list we have is:

[root@controller-0 ~ ]# iptables Chain INPUT (policy ACCEPT)
num target prot opt source 1 nova-api-INPUT all -- 0.0.0.0/0 2 ACCEPT tcp -- 0.0.0.0/0 3 ACCEPT tcp -- 0.0.0.0/0 4 ACCEPT tcp -- 0.0.0.0/0 5 ACCEPT tcp -- 0.0.0.0/0 6 ACCEPT tcp -- 0.0.0.0/0 7 ACCEPT tcp -- 0.0.0.0/0 8 ACCEPT tcp -- 0.0.0.0/0 9 ACCEPT tcp -- 0.0.0.0/0 10 ACCEPT tcp -- 0.0.0.0/0 11 ACCEPT tcp -- 0.0.0.0/0 12 ACCEPT tcp -- 0.0.0.0/0 13 ACCEPT tcp -- 0.0.0.0/0 14 ACCEPT tcp -- 0.0.0.0/0 15 ACCEPT tcp -- 0.0.0.0/0 16 ACCEPT tcp -- 0.0.0.0/0 17 ACCEPT tcp -- 0.0.0.0/0 18 ACCEPT tcp -- 0.0.0.0/0 19 ACCEPT tcp -- 0.0.0.0/0 20 ACCEPT tcp -- 0.0.0.0/0 21 ACCEPT tcp -- 0.0.0.0/0 22 ACCEPT tcp -- 0.0.0.0/0 23 ACCEPT tcp -- 0.0.0.0/0 24 ACCEPT tcp -- 0.0.0.0/0 25 ACCEPT tcp -- 0.0.0.0/0 26 ACCEPT tcp -- 0.0.0.0/0 27 ACCEPT tcp -- 0.0.0.0/0 28 ACCEPT tcp -- 0.0.0.0/0 29 ACCEPT tcp -- 0.0.0.0/0 30 ACCEPT tcp -- 0.0.0.0/0 31 ACCEPT tcp -- 0.0.0.0/0 32 ACCEPT tcp -- 0.0.0.0/0 33 ACCEPT tcp -- 0.0.0.0/0 34 ACCEPT tcp -- 0.0.0.0/0 35 ACCEPT tcp -- 0.0.0.0/0 -L INPUT -n --line-numbers
destination
0.0.0.0/0
0.0.0.0/0 multiport dports 8042 /* 100 aodh_haproxy */ state NEW
0.0.0.0/0 multiport dports 13042 /* 100 aodh_haproxy_ssl */ state NEW
0.0.0.0/0 multiport dports 8777 /* 100 ceilometer_haproxy */ state NEW
0.0.0.0/0 multiport dports 13777 /* 100 ceilometer_haproxy_ssl */ state NEW
0.0.0.0/0 multiport dports 8776 /* 100 cinder_haproxy */ state NEW
0.0.0.0/0 multiport dports 13776 /* 100 cinder_haproxy_ssl */ state NEW
0.0.0.0/0 multiport dports 9292 /* 100 glance_api_haproxy */ state NEW
0.0.0.0/0 multiport dports 13292 /* 100 glance_api_haproxy_ssl */ state NEW
0.0.0.0/0 multiport dports 9191 /* 100 glance_registry_haproxy */ state NEW
0.0.0.0/0 /* 100 glance_registry_haproxy_ssl */ state NEW
0.0.0.0/0 multiport dports 8041 /* 100 gnocchi_haproxy */ state NEW
0.0.0.0/0 multiport dports 13041 /* 100 gnocchi_haproxy_ssl */ state NEW
0.0.0.0/0 multiport dports 8004 /* 100 heat_api_haproxy */ state NEW
0.0.0.0/0 multiport dports 13004 /* 100 heat_api_haproxy_ssl */ state NEW
0.0.0.0/0 multiport dports 8000 /* 100 heat_cfn_haproxy */ state NEW
0.0.0.0/0 multiport dports 13005 /* 100 heat_cfn_haproxy_ssl */ state NEW
0.0.0.0/0 multiport dports 8003 /* 100 heat_cloudwatch_haproxy */ state NEW
0.0.0.0/0 multiport dports 13003 /* 100 heat_cloudwatch_haproxy_ssl */ state NEW
0.0.0.0/0 multiport dports 35357 /* 100 keystone_admin_haproxy */ state NEW
0.0.0.0/0 multiport dports 13357 /* 100 keystone_admin_haproxy_ssl */ state NEW
0.0.0.0/0 multiport dports 5000 /* 100 keystone_public_haproxy */ state NEW
0.0.0.0/0 multiport dports 13000 /* 100 keystone_public_haproxy_ssl */ state NEW
0.0.0.0/0 multiport dports 9696 /* 100 neutron_haproxy */ state NEW
0.0.0.0/0 multiport dports 13696 /* 100 neutron_haproxy_ssl */ state NEW
0.0.0.0/0 multiport dports 8775 /* 100 nova_metadata_haproxy */ state NEW
0.0.0.0/0 /* 100 nova_metadata_haproxy_ssl */ state NEW
0.0.0.0/0 multiport dports 6080 /* 100 nova_novncproxy_haproxy */ state NEW
0.0.0.0/0 multiport dports 13080 /* 100 nova_novncproxy_haproxy_ssl */ state NEW
0.0.0.0/0 multiport dports 8774 /* 100 nova_osapi_haproxy */ state NEW
0.0.0.0/0 multiport dports 13774 /* 100 nova_osapi_haproxy_ssl */ state NEW
0.0.0.0/0 multiport dports 8386 /* 100 sahara_haproxy */ state NEW
0.0.0.0/0 multiport dports 13386 /* 100 sahara_haproxy_ssl */ state NEW
0.0.0.0/0 multiport dports 8080 /* 100 swift_proxy_server_haproxy */ state NEW
0.0.0.0/0 multiport dports 13808 /* 100 swift_proxy_server_haproxy_ssl */ state NEW

which are from puppet-tripleo. But none from tht are there eg redis, mongodb etc..

Tags:

Pradeep Kilambi (pkilambi) on 2016-10-03

summary:	- firewall rules defined in service templates missing + firewall rules defined in service templates missing on overcloud
Changed in tripleo:
importance:	Undecided → Critical
milestone:	none → newton-rc3

Emilien Macchi (emilienm) on 2016-10-03

Changed in tripleo:
status:	New → Triaged

Emilien Macchi (emilienm) on 2016-10-03

Changed in tripleo:
assignee:	nobody → Dan Prince (dan-prince)

Emilien Macchi (emilienm) on 2016-10-03

Changed in tripleo:
status:	Triaged → In Progress

Revision history for this message

Dan Prince (dan-prince) wrote on 2016-10-04:

I tried to verify this using master today and it all looks to be working to me. I enabled firewall rules by adding the environments/manage-firewall.yaml to my deploy command. Once the deploy finished I logged into my controller to check the rules and found what I expected. I spot checked a couple services and things looked good. Keystone for example has its firewall ports defined in puppet/services/keystone.yaml and there were rules for this in place on my controller:

-A INPUT -p tcp -m multiport --dports 13357 -m comment --comment "100 keystone_admin_haproxy_ssl" -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m multiport --dports 5000 -m comment --comment "100 keystone_public_haproxy" -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m multiport --dports 13000 -m comment --comment "100 keystone_public_haproxy_ssl" -m state --state NEW -j ACCEPT

Changed in tripleo:
status:	In Progress → Incomplete

Revision history for this message

Dan Prince (dan-prince) wrote on 2016-10-04:

dprince controller firewall rules Edit (9.5 KiB, text/plain)

Example rules from working controller.

Changed in tripleo:
assignee:	Dan Prince (dan-prince) → nobody

Dan Prince (dan-prince) on 2016-10-04

Changed in tripleo:
assignee:	nobody → Dan Prince (dan-prince)
status:	Incomplete → In Progress

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-10-04: Fix proposed to tripleo-heat-templates (master)

Fix proposed to branch: master
Review: https://review.openstack.org/381864

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-10-04:

Fix proposed to branch: master
Review: https://review.openstack.org/381869

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-10-04: Fix merged to tripleo-heat-templates (master)

Reviewed: https://review.openstack.org/381869
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=3fa2ab420c2ba354fd709857e1ceaacf36a0f1b5
Submitter: Jenkins
Branch: master

commit 3fa2ab420c2ba354fd709857e1ceaacf36a0f1b5
Author: Dan Prince <email address hidden>
Date: Tue Oct 4 10:04:44 2016 -0400

Include redis/mongo hiera when using pacemaker

    This patch updates the pacemaker composable service templates for
    mongo and redis to extend the proper base (redis.yaml and mongo.yaml)
    templates instead of the -base.yaml versions. This was causing
    some missing hiera settings for these services which caused symptoms
    like missing firewall rules for these services.

Change-Id: I3f94acbf4d1baadbb151b1c4d34b4a0ab28ad5e5
Partial-bug: #1629934

OpenStack Infra (hudson-openstack) on 2016-10-06

Changed in tripleo:
assignee:	Dan Prince (dan-prince) → Emilien Macchi (emilienm)

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-10-06:

Reviewed: https://review.openstack.org/381864
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=ddd4d3cd9f5012b505c1ed2c4ee6a62dde37dbaf
Submitter: Jenkins
Branch: master

commit ddd4d3cd9f5012b505c1ed2c4ee6a62dde37dbaf
Author: Dan Prince <email address hidden>
Date: Tue Oct 4 09:59:56 2016 -0400

Re-enable ManageFirewall by default.

This default setting got lots in the composable roles/services patches.

Re-enable the ManageFirewall setting by default per what we did in
git commit 73c76b867ddc8a23a30b9a3cac4031189d4178c6.

We also fix a typo in neutron-api.yaml so that the firewall rules
matches to service_name. (otherwise it won't get loaded).

Also, drops the environments/manage-firewall.yaml which is
no longer needed if we enable firewall management by default.

Change-Id: Ie198e4efd190131d0722085b10ef77da9005bc1b
Closes-bug: 1629934

Changed in tripleo:
status:	In Progress → Fix Released

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-10-06: Fix proposed to tripleo-heat-templates (stable/newton)

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/383448

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-10-07: Fix merged to tripleo-heat-templates (stable/newton)

Reviewed: https://review.openstack.org/383448
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=2064ab8e62ac683adbe9caf828b2ee42d2f21cfb
Submitter: Jenkins
Branch: stable/newton

commit 2064ab8e62ac683adbe9caf828b2ee42d2f21cfb
Author: Dan Prince <email address hidden>
Date: Tue Oct 4 09:59:56 2016 -0400

Re-enable ManageFirewall by default.

This default setting got lots in the composable roles/services patches.

Re-enable the ManageFirewall setting by default per what we did in
git commit 73c76b867ddc8a23a30b9a3cac4031189d4178c6.

We also fix a typo in neutron-api.yaml so that the firewall rules
matches to service_name. (otherwise it won't get loaded).

Also, drops the environments/manage-firewall.yaml which is
no longer needed if we enable firewall management by default.

    Change-Id: Ie198e4efd190131d0722085b10ef77da9005bc1b
    Closes-bug: 1629934
    (cherry picked from commit ddd4d3cd9f5012b505c1ed2c4ee6a62dde37dbaf)

tags:

added: in-stable-newton

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-10-18: Fix included in openstack/tripleo-heat-templates 5.0.0.0rc3

This issue was fixed in the openstack/tripleo-heat-templates 5.0.0.0rc3 release candidate.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-11-03: Fix proposed to tripleo-heat-templates (stable/newton)

#10

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/393318

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-11-04: Fix merged to tripleo-heat-templates (stable/newton)

#11

Reviewed: https://review.openstack.org/393318
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=39bc64527402c3bffe0fe01d6b3ec1a0ab9bfc40
Submitter: Jenkins
Branch: stable/newton

commit 39bc64527402c3bffe0fe01d6b3ec1a0ab9bfc40
Author: Dan Prince <email address hidden>
Date: Tue Oct 4 10:04:44 2016 -0400

Include redis/mongo hiera when using pacemaker

    Change-Id: I3f94acbf4d1baadbb151b1c4d34b4a0ab28ad5e5
    Partial-bug: #1629934
    (cherry picked from commit 3fa2ab420c2ba354fd709857e1ceaacf36a0f1b5)