Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1080638 - openshift-enterprise HA template egress rules block cloud-init metadata
openshift-enterprise HA template egress rules block cloud-init metadata
Status: CLOSED ERRATA
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-heat-templates (Show other bugs)
4.0
Unspecified Unspecified
unspecified Severity unspecified
: z4
: 4.0
Assigned To: Aaron Weitekamp
Amit Ugol
: ZStream
Depends On:
Blocks:
  Show dependency tree / graph
 
Reported: 2014-03-25 16:28 EDT by Aaron Weitekamp
Modified: 2014-05-29 16:31 EDT (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: The egress firewall rules blocked the essential cloud-init metadata from getting to the instance. Consequence; The heat template resources were provisioned but the cloud init script was not added from the host to complete configuration. Fix: Egress rules were considered non-essential to securing the environment and therefore removed from the heat template. Result:This allows the heat template to complete successfully.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-05-29 16:31:49 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:0517 normal SHIPPED_LIVE Moderate: openstack-foreman-installer security, bug fix, and enhancement update 2014-05-29 20:26:29 EDT

  None (edit)
Description Aaron Weitekamp 2014-03-25 16:28:35 EDT 
Description of problem:
The openshift-enterprise HA template egress rules block cloud-init metadata

Version-Release number of selected component (if applicable):


How reproducible:
always

Steps to Reproduce:
1. create stack
2. user_data is never run
/var/log/cloud-init.log reports error using metadata from http://169.254.169.254

Workaround:
Remove egress security group rules and vpcid

ose_ha_stack.yaml
resources:
  ose_broker_sec_grp:
    type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: broker firewall rules
      #VpcId: { get_param: private_net_id }
      SecurityGroupIngress:
      - {IpProtocol: tcp, FromPort: '22', ToPort: '22', CidrIp: 0.0.0.0/0}
      - {IpProtocol: udp, FromPort: '53', ToPort: '53', CidrIp: 0.0.0.0/0}
      - {IpProtocol: tcp, FromPort: '53', ToPort: '53', CidrIp: 0.0.0.0/0}
      - {IpProtocol: tcp, FromPort: '80', ToPort: '80', CidrIp: 0.0.0.0/0}
      - {IpProtocol: tcp, FromPort: '443', ToPort: '443', CidrIp: 0.0.0.0/0}
      - {IpProtocol: tcp, FromPort: '27017', ToPort: '27017', CidrIp: 0.0.0.0/0}
      - {IpProtocol: tcp, FromPort: '61613', ToPort: '61613', CidrIp: 0.0.0.0/0}
      - {IpProtocol: tcp, FromPort: '61616', ToPort: '61616', CidrIp: 0.0.0.0/0}
      #SecurityGroupEgress:
      #- {IpProtocol: tcp, FromPort: '22', ToPort: '22', CidrIp: 0.0.0.0/0}
      #- {IpProtocol: udp, FromPort: '53', ToPort: '53', CidrIp: 0.0.0.0/0}
      #- {IpProtocol: tcp, FromPort: '53', ToPort: '53', CidrIp: 0.0.0.0/0}
      #- {IpProtocol: tcp, FromPort: '27017', ToPort: '27017', CidrIp: 0.0.0.0/0}
      #- {IpProtocol: tcp, FromPort: '61613', ToPort: '61613', CidrIp: 0.0.0.0/0}
      #- {IpProtocol: tcp, FromPort: '61616', ToPort: '61616', CidrIp: 0.0.0.0/0}

ose_node_stack.yaml
resources:
  ose_node_sec_grp:
    type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Node firewall rules
      #VpcId: { get_param: private_net_id }
      SecurityGroupIngress:
      - {IpProtocol: tcp, FromPort: '22', ToPort: '22', CidrIp: 0.0.0.0/0}
      - {IpProtocol: udp, FromPort: '53', ToPort: '53', CidrIp: 0.0.0.0/0}
      - {IpProtocol: tcp, FromPort: '53', ToPort: '53', CidrIp: 0.0.0.0/0}
      - {IpProtocol: tcp, FromPort: '80', ToPort: '80', CidrIp: 0.0.0.0/0}
      - {IpProtocol: tcp, FromPort: '443', ToPort: '443', CidrIp: 0.0.0.0/0}
      - {IpProtocol: tcp, FromPort: '8000', ToPort: '8000', CidrIp: 0.0.0.0/0}
      - {IpProtocol: tcp, FromPort: '8443', ToPort: '8443', CidrIp: 0.0.0.0/0}
      - {IpProtocol: tcp, FromPort: '2303', ToPort: '2308', CidrIp: 0.0.0.0/0}
      - {IpProtocol: tcp, FromPort: '35531', ToPort: '65535', CidrIp: 0.0.0.0/0}
      - {IpProtocol: tcp, FromPort: '27017', ToPort: '27017', CidrIp: 0.0.0.0/0}
      #SecurityGroupEgress:
      #- {IpProtocol: udp, FromPort: '53', ToPort: '53', CidrIp: 0.0.0.0/0}
      #- {IpProtocol: tcp, FromPort: '53', ToPort: '53', CidrIp: 0.0.0.0/0}
      #- {IpProtocol: tcp, FromPort: '443', ToPort: '443', CidrIp: 0.0.0.0/0}
      #- {IpProtocol: tcp, FromPort: '35531', ToPort: '65535', CidrIp: 0.0.0.0/0}
      #- {IpProtocol: tcp, FromPort: '61613', ToPort: '61613', CidrIp: 0.0.0.0/0}
Comment 3 Amit Ugol 2014-04-24 01:30:49 EDT 
If deleting the issue that causes the problem is a fix here, then this is verified
Comment 6 errata-xmlrpc 2014-05-29 16:31:49 EDT 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2014-0517.html
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.