Bug 1276118

Summary: CFME should not use OpenStack adminURL endpoints for any services
Product: Red Hat CloudForms Management Engine Reporter: Greg Blomquist <gblomqui>
Component: ProvidersAssignee: Greg Blomquist <gblomqui>
Status: CLOSED ERRATA QA Contact: Milan Falešník <mfalesni>
Severity: high Docs Contact:
Priority: high    
Version: 5.4.0CC: cpelland, jfrey, jhardy, kmorey, mcornea, mfeifer, ncatling, obarenbo, simaishi, tcarlin
Target Milestone: GAKeywords: ZStream
Target Release: 5.5.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: 5.5.0.11 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1276353 (view as bug list) Environment:
Last Closed: 2015-12-08 13:41:37 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1276353    

Description Greg Blomquist 2015-10-28 18:53:21 UTC 
Description of problem:

If OpenStack is configured to have it's adminURL endpoints for services on a private network (or otherwise inaccessible to CFME), then CFME will fail to collect inventory.

I've been told by OSP developers that as of OSP7, external access to the adminURL endpoints is off limits and is explicitly blocked.

Steps to Reproduce:
1. Setup OSP7 with adminURL service endpoints on a private network
2. Connect CFME to the OSP7 environment
3. Attempt to gather inventory from OSP7

Actual results:

CFME fails to gather inventory.  The error in the log will reflect the type of networking problem encountered.  Usually, "No route to host".

Expected results:

CFME successfully collects inventory from OSP7.
Comment 1 Greg Blomquist 2015-10-28 19:10:12 UTC 
https://github.com/ManageIQ/manageiq/pull/5169
Comment 2 CFME Bot 2015-10-28 19:55:52 UTC 
New commit detected on ManageIQ/manageiq/master:
https://github.com/ManageIQ/manageiq/commit/72d6d7794f0ac06ad85058f99414cd9a27414c88

commit 72d6d7794f0ac06ad85058f99414cd9a27414c88
Author:     Greg Blomquist <gblomqui>
AuthorDate: Wed Oct 28 14:55:40 2015 -0400
Commit:     Greg Blomquist <gblomqui>
CommitDate: Wed Oct 28 14:55:40 2015 -0400

    Stop using adminURL OSP service endpoints
    
    Fog defaults to using adminURL OSP service endpoints for some services.  A blind
    grep of Fog code shows the following:
    
    > identity_v2.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > identity_v3.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v1.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v2.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > metering.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > planning.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > volume.rb:      @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    
    By explicitly setting the openstack_endpoint_type to 'publicURL', manageIQ will
    always use the publicURL for all connections to any OpenStack Service Endpoint.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1276118

 gems/pending/openstack/openstack_handle/handle.rb | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
Comment 3 Oleg Barenboim 2015-10-29 14:11:56 UTC 
Please create MR on downstream 5.5
Comment 4 CFME Bot 2015-11-12 20:20:02 UTC 
New commit detected on cfme/5.4.z:
https://code.engineering.redhat.com/gerrit/gitweb?p=cfme.git;a=commitdiff;h=24908430af1ca6ee6d12266b3fe27ddd42882eca

commit 24908430af1ca6ee6d12266b3fe27ddd42882eca
Author:     Greg Blomquist <gblomqui>
AuthorDate: Wed Oct 28 14:55:40 2015 -0400
Commit:     Greg Blomquist <gblomqui>
CommitDate: Tue Nov 10 16:41:16 2015 -0500

    Stop using adminURL OSP service endpoints
    
    Fog defaults to using adminURL OSP service endpoints for some services.  A blind
    grep of Fog code shows the following:
    
    > identity_v2.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > identity_v3.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v1.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v2.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > metering.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > planning.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > volume.rb:      @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    
    By explicitly setting the openstack_endpoint_type to 'publicURL', manageIQ will
    always use the publicURL for all connections to any OpenStack Service Endpoint.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1276118
    https://bugzilla.redhat.com/show_bug.cgi?id=1276353

 lib/openstack/openstack_handle/handle.rb | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
Comment 5 CFME Bot 2015-11-12 20:20:52 UTC 
New commit detected on cfme/5.4.z:
https://code.engineering.redhat.com/gerrit/gitweb?p=cfme.git;a=commitdiff;h=f1cf151a52faf1301d3f11fd117ae362d9eadfbe

commit f1cf151a52faf1301d3f11fd117ae362d9eadfbe
Merge: acee802 2490843
Author:     Jason Frey <jfrey>
AuthorDate: Wed Nov 11 16:18:07 2015 -0500
Commit:     Jason Frey <jfrey>
CommitDate: Wed Nov 11 16:18:07 2015 -0500

    Merge branch 'bz1276353-os-use-public-endpoints' into '5.4.z'
    
    Stop using adminURL OSP service endpoints
    
    Fog defaults to using adminURL OSP service endpoints for some services.  A blind
    grep of Fog code shows the following:
    
    > identity_v2.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > identity_v3.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v1.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v2.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > metering.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > planning.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > volume.rb:      @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    
    By explicitly setting the openstack_endpoint_type to 'publicURL', manageIQ will
    always use the publicURL for all connections to any OpenStack Service Endpoint.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1276118
    https://bugzilla.redhat.com/show_bug.cgi?id=1276353
    
    Upstream: https://github.com/ManageIQ/manageiq/pull/5169
    
    See merge request !397

 lib/openstack/openstack_handle/handle.rb | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
Comment 6 CFME Bot 2015-11-12 20:30:45 UTC 
New commit detected on cfme/5.5.z:
https://code.engineering.redhat.com/gerrit/gitweb?p=cfme.git;a=commitdiff;h=15c079ef6f251fcd9c051e8bf97d1050ac62813c

commit 15c079ef6f251fcd9c051e8bf97d1050ac62813c
Author:     Greg Blomquist <gblomqui>
AuthorDate: Wed Oct 28 14:55:40 2015 -0400
Commit:     Greg Blomquist <gblomqui>
CommitDate: Mon Nov 9 16:38:23 2015 -0500

    Stop using adminURL OSP service endpoints
    
    Fog defaults to using adminURL OSP service endpoints for some services.  A blind
    grep of Fog code shows the following:
    
    > identity_v2.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > identity_v3.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v1.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v2.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > metering.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > planning.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > volume.rb:      @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    
    By explicitly setting the openstack_endpoint_type to 'publicURL', manageIQ will
    always use the publicURL for all connections to any OpenStack Service Endpoint.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1276118

 gems/pending/openstack/openstack_handle/handle.rb | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
Comment 7 CFME Bot 2015-11-12 20:33:04 UTC 
New commit detected on cfme/5.5.z:
https://code.engineering.redhat.com/gerrit/gitweb?p=cfme.git;a=commitdiff;h=47d06d59bfe8e5d65c03775f16268af488546823

commit 47d06d59bfe8e5d65c03775f16268af488546823
Merge: 70e08e4 15c079e
Author:     Jason Frey <jfrey>
AuthorDate: Wed Nov 11 16:17:09 2015 -0500
Commit:     Jason Frey <jfrey>
CommitDate: Wed Nov 11 16:17:09 2015 -0500

    Merge branch 'bz1276118-os-use-public-endpoints' into '5.5.z'
    
    Stop using adminURL OSP service endpoints
    
    Fog defaults to using adminURL OSP service endpoints for some services.  A blind
    grep of Fog code shows the following:
    
    > identity_v2.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > identity_v3.rb: @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v1.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > image_v2.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > metering.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > planning.rb:    @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    > volume.rb:      @openstack_endpoint_type  = options[:openstack_endpoint_type] || 'adminURL'
    
    By explicitly setting the openstack_endpoint_type to 'publicURL', manageIQ will
    always use the publicURL for all connections to any OpenStack Service Endpoint.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1276118
    
    Upstream: https://github.com/ManageIQ/manageiq/pull/5169
    
    See merge request !390

 gems/pending/openstack/openstack_handle/handle.rb | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
Comment 8 Milan Falešník 2015-11-19 12:24:42 UTC 
Verified in 5.5.0.11
Comment 10 errata-xmlrpc 2015-12-08 13:41:37 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2015:2551
Comment 11 Greg Blomquist 2016-02-05 17:59:28 UTC 
*** Bug 1257629 has been marked as a duplicate of this bug. ***