Bug 1776608

Summary:	httpd logs in tls_proxy containers are recorded not on host but inside docker containers
Product:	Red Hat OpenStack	Reporter:	Takashi Kajinami <tkajinam>
Component:	openstack-tripleo-heat-templates	Assignee:	Michele Baldessari <michele>
Status:	CLOSED ERRATA	QA Contact:	David Rosenfeld <drosenfe>
Severity:	high	Docs Contact:
Priority:	medium
Version:	13.0 (Queens)	CC:	apetrich, drosenfe, mburns, michele
Target Milestone:	z11	Keywords:	Triaged, ZStream
Target Release:	13.0 (Queens)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openstack-tripleo-heat-templates-8.4.1-25.el7ost	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-03-10 11:23:19 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Takashi Kajinami 2019-11-26 05:18:17 UTC

Description of problem:

When we enable internal tls[1], we have the following independent docker containers to terminate tls,
and we have httpd running in these containers.
 neutron_server_tls_proxy
 glance_api_tls_proxy
 redis_tls_proxy

[1] https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html/advanced_overcloud_customization/sect-enabling_internal_ssltls_on_the_overcloud

However, these docker containers does not have bind related to log directories, and
we have log files inside docker container.
As we don't have any rotation mechanism inside docker container, this can cause filesystem grows and
can affect services running on the node

How reproducible:
Always

Steps to Reproduce:
1. Deploy overcloud with internal tls enabled
2. See docker container setup for tls_proxy containers by `docker inspect <container name>`
3. See lsof -p <pid of httpd> 

Actual results:
tls_proxy containers does not have bind related to log directory, and httpd is writing into log file inside container

Expected results:
tls_proxy containers has bind related to log directory, and httpd is writing into log file on host

Additional info:

Comment 11 David Rosenfeld 2020-02-20 13:33:03 UTC

Bind seen for httpd in both sudo docker inspect neutron_server_tls_proxy and sudo docker inspect glance_api_tls_proxy:

"/var/log/containers/httpd/neutron-api:/var/log/httpd"

bind was not seen for: sudo docker inspect redis_tls_proxy. Asked question in e-mail about that and response was:

Redis logs are provided via the journal, and are already available.

Comment 13 errata-xmlrpc 2020-03-10 11:23:19 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0760