Bug 1327914

Summary:	Heat configuration points to internal api endpoints, making instances attempting to use heat fail
Product:	Red Hat OpenStack	Reporter:	Graeme Gillies <ggillies>
Component:	openstack-tripleo-heat-templates	Assignee:	Jiri Stransky <jstransk>
Status:	CLOSED DUPLICATE	QA Contact:	Arik Chernetsky <achernet>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.0 (Kilo)	CC:	aschultz, mburns, rhel-osp-director-maint, sbaker, shardy
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-07-28 18:47:10 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Graeme Gillies 2016-04-17 23:57:30 UTC

The following configuration items in heat engine

metadata_server_url
waitcondition_server_url
watch_server_url

Are configured to point to the internal_api network endpoints of heat. However, when instances attempt to use heat, these configuration values are what is passed to instances, and because the instances can't connect to the internal_api network (major security issue), they can't talk to heat. These configuration items should instead be configured to the publicURL endpoints of heat

Comment 2 Steve Baker 2016-04-18 00:05:04 UTC

Just tracking how metadata_server_url ends up with an internal network value, it is set from HeatApiVirtualIPUri which is set from this ServiceNetMap/VipMap lookup:

  HeatApiVirtualIPUri: {get_attr: [VipMap, net_ip_uri_map, {get_param: [ServiceNetMap, HeatApiNetwork]}]}

The default ServiceNetMap has HeatApiNetwork: internal_api

It looks like the solution is either to:
1. fix the ServiceNetMap to have HeatApiNetwork: external_api, or
2. to use something else entirely to build HeatApiVirtualIPUri.

Option 1. looks easiest but may cause other problems and may not actually be the right thing to do.

Setting needinfo on shardy for his opinion

Comment 3 Zane Bitter 2017-07-28 18:47:10 UTC


*** This bug has been marked as a duplicate of bug 1293700 ***