Description of problem:
tripleo templates have hard-coded vncserver_listen value
this behavior causes vnc to listen on all ports on compute servers, including the routable ip, allowing connections from anybody. We would like to set this like: vncserver_proxyclient_address to the internapi network
/usr/share/openstack-tripleo-heat-templates/puppet/manifests/overcloud_compute.pp
if str2bool(hiera('nova::use_ipv6', false)) {
$vncserver_listen = '::0'
} else {
$vncserver_listen = '0.0.0.0'
}
class { '::nova::compute::libvirt' :
vncserver_listen => $vncserver_listen,
}
It's not possible to override this value with yaml parameters
Version-Release number of selected component (if applicable):
How reproducible:
Alaways
Steps to Reproduce:
1. Install openstack-tripleo-heat-templates
2. Look at the code
3.
Actual results:
Cannot override
Expected results:
Would like to override
Additional info:
David, this is not a bug but a feature.
If you want Live Migration to work, the vncserver_listen must be 0.0.0.0. Otherwise, your VM console won't be available anymore when you migrate your VM to another compute.
You can find some documentation here that confirms what I just wrote:
http://docs.openstack.org/admin-guide/compute-remote-console-access.html
I'm closing the bug.
Emilien, We've tested this with the customer and manually changing the VNC listening adress to the IP of the compute node does't seem to affect anything. Are we sure this is not outdated?
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2017:1501
The bug for which this was filed, openstack-puppet-modules-8.1.13-1.el7ost, was shipped. Please clone it if an additional fix is needed for openstack-tripleo-heat-templates.
Description of problem: tripleo templates have hard-coded vncserver_listen value this behavior causes vnc to listen on all ports on compute servers, including the routable ip, allowing connections from anybody. We would like to set this like: vncserver_proxyclient_address to the internapi network /usr/share/openstack-tripleo-heat-templates/puppet/manifests/overcloud_compute.pp if str2bool(hiera('nova::use_ipv6', false)) { $vncserver_listen = '::0' } else { $vncserver_listen = '0.0.0.0' } class { '::nova::compute::libvirt' : vncserver_listen => $vncserver_listen, } It's not possible to override this value with yaml parameters Version-Release number of selected component (if applicable): How reproducible: Alaways Steps to Reproduce: 1. Install openstack-tripleo-heat-templates 2. Look at the code 3. Actual results: Cannot override Expected results: Would like to override Additional info: