Bug 1237009 – Swift proxy port not allowed in undercloud firewall

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1237009 - Swift proxy port not allowed in undercloud firewall

Summary:	Swift proxy port not allowed in undercloud firewall

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat OpenStack
Classification:	Red Hat
Component:	rhosp-director (Show other bugs)
Sub Component:
Version:	7.0 (Kilo)
Hardware:	Unspecified Unspecified

Priority	medium Severity medium
Target Milestone:	---
Target Release:	7.0 (Kilo)
Assigned To:	James Slagle
QA Contact:	yeylon@redhat.com
Docs Contact:

URL:
Whiteboard:
Keywords:	Triaged, ZStream

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2015-06-30 03:50 EDT by Marius Cornea
Modified:	2016-04-18 03:14 EDT (History)
CC List:	7 users (show)

See Also:
Fixed In Version:
Doc Type:	Known Issue
Doc Text:	The swift proxy port is denied in the Undercloud firewall. This means the swift proxy only accepts connections from localhost. As a workaround, open the swift proxy port in the firewall: # sudo iptables -I INPUT -p tcp --dport 8080 -j ACCEPT This enabled connections to the swift proxy from remote machines.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-01-08 13:55:26 EST
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Marius Cornea 2015-06-30 03:50:55 EDT

Description of problem:
The Swift proxy port(8080) is not allowed in undercloud iptables.

Version-Release number of selected component (if applicable):
instack-undercloud-2.1.2-6.el7ost.noarch
instack-0.0.7-1.el7ost.noarch

How reproducible:
100%

Steps to Reproduce:
1. iptables -nL | grep 8080
2.
3.

Actual results:
No entry matches port 8080

Expected results:
I'd expect port 8080 to be allowed. Ironic extra data is stored in swift now and we need to be able to access it for the CFME integration.

Additional info:

Comment 4 chris alfonso 2015-06-30 13:13:23 EDT

We'll doc the workaround of manually adding the rule when necessary.

Comment 5 Nick Satsia 2016-02-22 23:28:08 EST

This issue also exists in OSPd7 as of 19 February '16.

Note You need to log in before you can comment on or make changes to this bug.